diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bd183c2b97..75cb7255c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -18,7 +18,7 @@ We've tried to make editing an existing, public file as simple as possible. **To edit a topic** -1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. +1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. ![GitHub Web, showing the Edit link](images/contribute-link.png) @@ -30,12 +30,12 @@ We've tried to make editing an existing, public file as simple as possible. ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) -4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: +4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) -5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. +5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) @@ -45,19 +45,19 @@ We've tried to make editing an existing, public file as simple as possible. The **Comparing changes** screen appears to see what the changes are between your fork and the original content. -7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. +7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. If there are no problems, you’ll see the message, **Able to merge**. ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) -8. Click **Create pull request**. +8. Click **Create pull request**. -9. Enter a title and description to give the approver the appropriate context about what’s in the request. +9. Enter a title and description to give the approver the appropriate context about what’s in the request. -10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. +10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. -11. Click **Create pull request** again to actually submit the pull request. +11. Click **Create pull request** again to actually submit the pull request. The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: diff --git a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md index 2d6285a59d..e5a7ff9155 100644 --- a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md +++ b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md @@ -11,7 +11,7 @@ ms.topic: include | | | |----------|------| -|**Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

Public browsing

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an End session button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | -| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

Public browsing

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | +|**Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

Public browsing

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an End session button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | +| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

Public browsing

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | --- diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 15858b4039..c90d6b1c59 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -154,11 +154,11 @@ If you choose to use WMI as your data output, you need to make sure that your WM **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index d634c34fd0..3a2826187a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -154,11 +154,11 @@ If you choose to use WMI as your data output, you need to make sure that your WM **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md index 91517251f0..77eb2fa5b1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md @@ -24,7 +24,7 @@ IE11 works differently with search, based on whether your organization is domain - **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider. -To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like ` contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. +To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. **To enable single-word intranet search** diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md index 7e475887ce..ca25c64f0e 100644 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md @@ -75,8 +75,8 @@ If you cannot uninstall IE using **Uninstall or change a program** in the Contro ## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). -1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. -2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory. +1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. +2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory.   ## Unicode characters are not supported in IEAK 11 path names diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md index 8c74b3b97e..dfe9539b1b 100644 --- a/devices/hololens/hololens-cortana.md +++ b/devices/hololens/hololens-cortana.md @@ -31,13 +31,13 @@ Here are some things you can try saying (remember to say "Hey Cortana" first): - Restart. - Go to sleep. - Mute. -- Launch . -- Move here (gaze at the spot you want the app to move to). +- Launch ``. +- Move `` here (gaze at the spot you want the app to move to). - Go to Start. - Take a picture. - Start recording. (Starts recording a video.) - Stop recording. (Stops recording a video.) -- Call . (Requires Skype.) +- Call ``. (Requires Skype.) - What time is it? - Show me the latest NBA scores. - How much battery do I have left? diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md index 25bf786333..8cbeaf26eb 100644 --- a/devices/hololens/hololens-encryption.md +++ b/devices/hololens/hololens-encryption.md @@ -45,7 +45,7 @@ Provisioning packages are files created by the Windows Configuration Designer to ![Require device encryption setting configured to yes](images/device-encryption.png) -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. +2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. >[!NOTE] >You can configure [additional settings in the provisioning package](hololens-provisioning.md). diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 226a0c18ff..77bb29070f 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -59,7 +59,7 @@ HoloLens doesn't have an on-device command line. With that in mind, the setting Open settings by opening the start menu and clicking on the **Settings** in the top bar. You can also ask Cortana to open settings. -Follow [this guide](https://docs.microsoft.com/en-us/windows/mixed-reality/navigating-the-windows-mixed-reality-home) to navigate around the HoloLens home. +Follow [this guide](https://docs.microsoft.com/windows/mixed-reality/navigating-the-windows-mixed-reality-home) to navigate around the HoloLens home. ### Connect bluetooth devices diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md index bfafb1d925..57bf3d0e04 100644 --- a/devices/hololens/hololens-upgrade-enterprise.md +++ b/devices/hololens/hololens-upgrade-enterprise.md @@ -47,7 +47,7 @@ Provisioning packages are files created by the Windows Configuration Designer to ![Upgrade edition with license setting selected](images/icd1.png) -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. +2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. >[!NOTE] >You can configure [additional settings in the provisioning package](hololens-provisioning.md). diff --git a/devices/hololens/index.md b/devices/hololens/index.md index 3320efb458..abb50c076e 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -18,7 +18,7 @@ ms.date: 07/14/2019

Now, with the introduction of HoloLens 2, every device provides commercial ready management enhanced by the reliability, security, and scalability of cloud and AI services from Microsoft.

-![Hololens](images/hololens2-side-render.png) +HoloLens 2 side view ## Guides in this section diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 7eac6565e2..d9bdb48c3a 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -5,7 +5,7 @@ ## Overview ### [What's new in Surface Hub 2S for IT admins](surface-hub-2s-whats-new.md) ### [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) -### [Operating system essentials (Surface Hub) ](differences-between-surface-hub-and-windows-10-enterprise.md) +### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) ### [Adjust Surface Hub 2S brightness, volume, and input](surface-hub-2s-onscreen-display.md) ## Plan diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 27ebc7924e..00620b9f7c 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -534,7 +534,7 @@ if ($status.Count -gt 0) elseif ($v[0] -eq "F") { $color = "red" - $v += " Go to http://aka.ms/shubtshoot" + $v += " Go to https://aka.ms/shubtshoot" } Write-Host -NoNewline $k -ForegroundColor $color @@ -978,7 +978,7 @@ if ($status.Count -gt 0) elseif ($v[0] -eq "F") { $color = "red" - $v += " Go to http://aka.ms/shubtshoot for help" + $v += " Go to https://aka.ms/shubtshoot for help" } Write-Host -NoNewline $k -ForegroundColor $color diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index 09c4b1ea60..2075507bd4 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -44,15 +44,15 @@ If you see a blank screen for long periods of time during the **Reset device** p ## Reset a Surface Hub from Settings **To reset a Surface Hub** -1. On your Surface Hub, open **Settings**. +1. On your Surface Hub, open **Settings**. ![Image showing Settings app for Surface Hub.](images/sh-settings.png) -2. Click **Update & Security**. +2. Click **Update & Security**. ![Image showing Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png) -3. Click **Recovery**, and then, under **Reset device**, click **Get started**. +3. Click **Recovery**, and then, under **Reset device**, click **Get started**. ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md index cf30261837..73a50f66c9 100644 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md @@ -127,7 +127,7 @@ The administrative features in Windows 10 Enterprise, such as the Microsoft Mana ### Remote management and monitoring -Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/en-us/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). +Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). *Organization policies that this may affect:*
Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager. diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md index d559575749..20c6c45925 100644 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ b/devices/surface-hub/install-apps-on-surface-hub.md @@ -40,10 +40,10 @@ By enabling developer mode, you can also install developer-signed UWP apps. > After developer mode has been enabled, you will need to reset the Surface Hub to disable it. Resetting the device removes all local user files and configurations and then reinstalls Windows. **To turn on developer mode** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **Update & security** > **For developers**. -4. Select **Developer mode** and accept the warning prompt. +1. From your Surface Hub, start **Settings**. +2. Type the device admin credentials when prompted. +3. Navigate to **Update & security** > **For developers**. +4. Select **Developer mode** and accept the warning prompt. ### Visual Studio During development, the easiest way to test your app on a Surface Hub is using Visual Studio. Visual Studio's remote debugging feature helps you discover issues in your app before deploying it broadly. For more information, see [Test Surface Hub apps using Visual Studio](https://msdn.microsoft.com/windows/uwp/debug-test-perf/test-surface-hub-apps-using-visual-studio). @@ -102,10 +102,10 @@ To evaluate apps released on the Microsoft Store, use the Microsoft Store app on > - To install apps, you will need to manually sign in to the Microsoft Store app on each Surface Hub you own. **To browse the Microsoft Store on Surface Hub** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **This device** > **Apps & features**. -4. Select **Open Store**. +1. From your Surface Hub, start **Settings**. +2. Type the device admin credentials when prompted. +3. Navigate to **This device** > **Apps & features**. +4. Select **Open Store**. ### Download app packages from Microsoft Store for Business To download the app package you need to install apps on your Surface Hub, visit the [Microsoft Store for Business](https://www.microsoft.com/business-store). The Store for Business is where you can find, acquire, and manage apps for the Windows 10 devices in your organization, including Surface Hub. diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md index f030a801e9..e90e7d8f95 100644 --- a/devices/surface-hub/monitor-surface-hub.md +++ b/devices/surface-hub/monitor-surface-hub.md @@ -95,10 +95,10 @@ This table describes the sample queries in the Surface Hub solution: | Hardware | Error | **Contact Microsoft support**.
Indicates impact to core functionality (such as Skype, projection, touch, and internet connectivity).
**Note** Some events, including heartbeat, include the device’s serial number that you can use when contacting support.| Triggers when there is an error with any of the following hardware components.
**Components that affect Skype**:
- Speaker driver
- Microphone driver
- Camera driver
**Components that affect wired and wireless projection**:
- Wired touchback driver
- Wired ingest driver
- Wireless adapter driver
- Wi-Fi Direct error
**Other components**:
- Touch digitizer driver
- Network adapter error (not reported to OMS)| **To set up an alert** -1. From the Surface Hub solution, select one of the sample queries. -2. Modify the query as desired. See Log Analytics search reference to learn more. -3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. -4. Click **Save** to complete the alert rule. It will start running immediately. +1. From the Surface Hub solution, select one of the sample queries. +2. Modify the query as desired. See Log Analytics search reference to learn more. +3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. +4. Click **Save** to complete the alert rule. It will start running immediately. ## Enroll your Surface Hub diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md index a6fa631e1b..c60e7826dc 100644 --- a/devices/surface-hub/skype-hybrid-voice.md +++ b/devices/surface-hub/skype-hybrid-voice.md @@ -80,14 +80,14 @@ If you deployed Skype for Business Cloud PBX with one of the hybrid voice option Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true ``` -10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. +10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. ``` Set-CalendarProcessing surfacehub2@adatum.com -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false Set-CalendarProcessing surfacehub2@adatum.com -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" ``` -11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. +11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. ``` Get-CsTenant | select registrarpool diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md index 1225c31187..1b6f56eda7 100644 --- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md +++ b/devices/surface-hub/surface-hub-2s-phone-authenticate.md @@ -40,4 +40,4 @@ Password-less phone sign-in simplifies signing-in to your meetings and files on 3. If prompted, enter the PIN or biometric ID on your phone to complete sign-in. ## Learn more -For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-phone-sign-in). +For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-phone-sign-in). diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md index efe6fa26b5..10b5238246 100644 --- a/devices/surface-hub/surface-hub-2s-prepare-environment.md +++ b/devices/surface-hub/surface-hub-2s-prepare-environment.md @@ -45,6 +45,6 @@ If you affiliate Surface Hub 2S with on-premises Active Directory Domain Service ## Azure Active Directory -When choosing to affiliate your Surface Hub 2S with Azure AD, any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Alternatively, you can configure the Device Administrator role to sign in to the Settings app. For more information, see [Administrator role permissions in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#device-administrators). Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. +When choosing to affiliate your Surface Hub 2S with Azure AD, any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Alternatively, you can configure the Device Administrator role to sign in to the Settings app. For more information, see [Administrator role permissions in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles#device-administrators). Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. If you enabled Intune Automatic Enrollment for your organization, Surface Hub 2S will automatically enroll itself with Intune. The device’s Bitlocker key is automatically saved in Azure AD. When affiliating Surface Hub 2S with Azure AD, single sign-on and Easy Authentication will not work. diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md index aa4816960b..6329c3b696 100644 --- a/devices/surface-hub/surface-hub-2s-setup.md +++ b/devices/surface-hub/surface-hub-2s-setup.md @@ -44,7 +44,7 @@ When you first start Surface Hub 2S, the device automatically enters first time ## Configuring device admin accounts -You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/en-us/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). +You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). In the **Setup admins for this device** window, select one of the following options: Active Directory Domain Services, Azure Active Directory, or Local admin. @@ -92,7 +92,7 @@ If you insert a USB thumb drive with a provisioning package into one of the USB ![* Choose provisioning package to use*](images/sh2-run13.png)
-3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/en-us/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). +3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png)
diff --git a/devices/surface-hub/surface-hub-2s-techspecs.md b/devices/surface-hub/surface-hub-2s-techspecs.md index 9be8b7a5e1..89a4871fbb 100644 --- a/devices/surface-hub/surface-hub-2s-techspecs.md +++ b/devices/surface-hub/surface-hub-2s-techspecs.md @@ -20,6 +20,7 @@ ms.localizationpriority: Normal |**Dimensions**| 29.2" x 43.2" x 3.0” (741 mm x 1097 mm x 76 mm) | |**Shipping dimensions**| 47.64" x 36.89" x 9.92" (1,210 mm x 937 mm x 252 mm)| |**Weight**| 61.6 lbs. (28 kg) | +|**Shipping Weight**| 81.08 lbs. (36.77 kg) | |**Resolution**| 3840 x 2560 | |**Display**| PixelSense Display, 3:2 aspect ratio, 10-bit color, 15.5 mm border, anti-glare, IPS LCD | |**Processor**| Quad-core 8th Generation Intel Core i5 processor, 8 GB RAM, 128 GB SSD 1 | diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md index 525c84acb2..2c8a3793a6 100644 --- a/devices/surface-hub/whiteboard-collaboration.md +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -44,14 +44,14 @@ To get Whiteboard to Whiteboard collaboration up and running, you’ll need to m To start a collaboration session: -1. In the Whiteboard app, tap the **Sign in** button. -2. Sign in with your organization ID. -3. Tap the **Invite** button next to your name at the top of the app. -4. Tap **Start session**. Whiteboard will generate a link that you can share. +1. In the Whiteboard app, tap the **Sign in** button. +2. Sign in with your organization ID. +3. Tap the **Invite** button next to your name at the top of the app. +4. Tap **Start session**. Whiteboard will generate a link that you can share. ![screenshot of the link dialog box on whiteboard](images/wb-collab-link.png) -5. Copy and paste this link into a Skype chat with another Surface Hub +5. Copy and paste this link into a Skype chat with another Surface Hub When the other Surface Hub receives the link, the recipient can tap on the link, sign in to Whiteboard, and then begin collaborating. You can copy and paste other content, use smart ink features like Ink to Shape, and co-author together. diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 9448059c5b..5c4cc7c4a3 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -54,7 +54,7 @@ Before users can install or deploy an app from a company’s Microsoft Store for ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
*Figure 1. Enable apps for offline use* -4. Add Surface app to your Microsoft Store for Business account by following this procedure: +4. Add Surface app to your Microsoft Store for Business account by following this procedure: * Click the **Shop** menu. * In the search box, type **Surface app**, and then click the search icon. * After the Surface app is presented in the search results, click the app’s icon. @@ -99,21 +99,21 @@ Figure 5 shows the required frameworks for the Surface app. >The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Microsoft Store for Business. Always use the Surface app and recommended framework versions as provided by Microsoft Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. To download the required frameworks for the Surface app, follow these steps: -1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. -2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. +1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. +2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. >[!NOTE] >Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. ## Install Surface app on your computer with PowerShell The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. -1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. -2. Begin an elevated PowerShell session. +1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. +2. Begin an elevated PowerShell session. >[!NOTE] >If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app. -3. In the elevated PowerShell session, copy and paste the following command: +3. In the elevated PowerShell session, copy and paste the following command: ``` Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml ``` @@ -125,7 +125,7 @@ The following procedure provisions the Surface app onto your computer and makes Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml ``` -4. The Surface app will now be available on your current Windows computer. +4. The Surface app will now be available on your current Windows computer. Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app. @@ -151,18 +151,18 @@ The following procedure uses MDT to automate installation of the Surface app at * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies. -1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. +1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. +2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. +3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. To configure the frameworks as dependencies of the Surface app, use this process: -1. Open the properties of the Surface app in the MDT Deployment Workbench. -2. Click the **Dependencies** tab, and then click **Add**. -3. Select the check box for each framework using the name you provided in the New Application Wizard. +1. Open the properties of the Surface app in the MDT Deployment Workbench. +2. Click the **Dependencies** tab, and then click **Add**. +3. Select the check box for each framework using the name you provided in the New Application Wizard. After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process: -1. Open your deployment task sequence in the MDT Deployment Workbench. -2. Add a new **Install Application** task in the **State Restore** section of deployment. -3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. +1. Open your deployment task sequence in the MDT Deployment Workbench. +2. Add a new **Install Application** task in the **State Restore** section of deployment. +3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index e749f22972..ea5592fb85 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -579,10 +579,10 @@ After the task sequence is created it can be modified for increased automation, 8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field. 9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. -11. Repeat Steps 6 through 10 for the Surface app. -12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. -13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. +10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. +11. Repeat Steps 6 through 10 for the Surface app. +12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. +13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. 14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options: * **Name** – Set DriverGroup001 * **Task Sequence Variable** – DriverGroup001 @@ -592,8 +592,8 @@ After the task sequence is created it can be modified for increased automation, *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* -15. Select the **Inject Drivers** step, the next step in the task sequence. -16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: +15. Select the **Inject Drivers** step, the next step in the task sequence. +16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: * In the **Choose a selection profile** drop-down menu, select **Nothing**. * Click the **Install all drivers from the selection profile** button. @@ -601,7 +601,7 @@ After the task sequence is created it can be modified for increased automation, *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows* -17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. +17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. ### Configure deployment share rules diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 3d04792b01..7eb53c4ec9 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -63,15 +63,15 @@ To create a Surface UEFI configuration package, follow these steps: *Figure 4. Disable or enable individual Surface components* -11. Click **Next**. -12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. +11. Click **Next**. +12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. ![Control advanced Surface UEFI settings and Surface UEFI pages](images/surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages") *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM* -13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. -14. When the package is created and saved, the **Successful** page is displayed. +13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. +14. When the package is created and saved, the **Successful** page is displayed. >[!NOTE] >Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md index 8b78717d6c..cd0812b2d9 100644 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ b/devices/surface/surface-diagnostic-toolkit-business.md @@ -59,9 +59,9 @@ SDT for Business is supported on Surface 3 and later devices, including: To create an SDT package that you can distribute to users in your organization: -1. Sign in to your Surface device using the Administrator account. -2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. -3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. +1. Sign in to your Surface device using the Administrator account. +2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. +3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. >[!NOTE] >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. @@ -72,15 +72,15 @@ To create an SDT package that you can distribute to users in your organization: 4. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA) -5. On the Install Options screen, change the default install location if desired. -6. Under Setup Type, select **Advanced**. +5. On the Install Options screen, change the default install location if desired. +6. Under Setup Type, select **Advanced**. >[!NOTE] >The standard option allows users to run the diagnostic tool directly on their Surface device provided they are signed into their device using an Administrator account. ![Install Options: Advanced](images/sdt-install.png) -7. Click **Next** and then click **Install**. +7. Click **Next** and then click **Install**. ## Installing using the command line If desired, you can install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags: @@ -90,7 +90,7 @@ If desired, you can install SDT at a command prompt and set a custom flag to ins ### To install SDT from the command line: -1. Open a command prompt and enter: +1. Open a command prompt and enter: ``` msiexec.exe /i ADMINMODE=1. @@ -116,8 +116,8 @@ In addition to the .exe file, SDT installs a JSON file and an admin.dll file (mo Creating a custom package allows you to target the tool to specific known issues. -1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. -2. When the tool opens, click **Create Custom Package**, as shown in figure 3. +1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. +2. When the tool opens, click **Create Custom Package**, as shown in figure 3. ![Create custom package option](images/sdt-3.png) diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md index abce43dabc..9022fb4770 100644 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md @@ -16,9 +16,9 @@ manager: dansimp This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. -1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. +1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. -2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. +2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. ![Start SDT in desktop mode](images/sdt-desk-1.png) @@ -63,9 +63,9 @@ For each test, if functionality does not work as expected and the user clicks ** *Figure 4. Running hardware diagnostics* -1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. -2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. -3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. +1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. +2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. +3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. ### Repairing applications diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index 9244515eb1..df65b6c73d 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -226,8 +226,16 @@ create a reset package using PowerShell to reset SEMM. ## Version History + + +### Version 2.43.136.0 +* Support to enable/disable simulatenous multithreating +* Separate options for WiFi and Bluetooth for some devices +* Battery Limit removed for Surface Studio + ### Version 2.26.136.0 * Add support to Surface Studio 2 +* Battery Limit feature ### Version 2.21.136.0 * Add support to Surface Pro 6 diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md index 6531857a06..edcfcdf120 100644 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -118,9 +118,9 @@ To initiate a Recovery Request, follow these steps: *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request* -11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. -12. Browse to and select your SEMM certificate file, and then click **OK**. -13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. +11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. +12. Browse to and select your SEMM certificate file, and then click **OK**. +13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. ![Type password for SEMM certificate](images/surface-semm-unenroll-fig11.png "Type password for SEMM certificate") @@ -137,7 +137,7 @@ To initiate a Recovery Request, follow these steps: * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field. * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**. -16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. +16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. ![Display of the reset verification code](images/surface-semm-unenroll-fig13.png "Display of the reset verification code") @@ -145,13 +145,13 @@ To initiate a Recovery Request, follow these steps: * Click the **Share** button to send the reset verification code by email. -17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. -18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. +17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. +18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. ![Example display of successful unenrollment from SEMM](images/surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM") *Figure 14. Successful unenrollment from SEMM* -19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. +19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md index de79c73b49..52e96859b3 100644 --- a/devices/surface/using-the-sda-deployment-share.md +++ b/devices/surface/using-the-sda-deployment-share.md @@ -141,23 +141,23 @@ In the previous example for including drivers for a POS system, you would also n 9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. -10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. +10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. -11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. +11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. ![A new Install Application step for Sample POS App](images/using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App") *Figure 3. A new Install Application step for Sample POS App* -12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. +12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. -13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. +13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -14. Select your app from the list of applications, and then click **OK**. +14. Select your app from the list of applications, and then click **OK**. -15. Click **OK** to close the task sequence properties. +15. Click **OK** to close the task sequence properties. -16. Close the Deployment Workbench. +16. Close the Deployment Workbench. ## Work with existing deployment shares diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index 5e23d71b86..f1d88dc8c8 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -182,9 +182,9 @@ Use video to create a project summary. 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**. -10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**. +10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**. -11. Select the last card on the Storyboard and select **3D effects**. +11. Select the last card on the Storyboard and select **3D effects**. 1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser. 2. Find the **lightning bolt** effect and click or drag to add it to the scene. Rotate, scale, and position the effect so it looks like the lightning is coming out of the laser beam and hitting the black back of the mirror. 3. Position the blue anchor over the end of the laser pointer in the video and toggle on **Attach to a point** for the lightning bolt effect to anchor the effect in the scene. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 16dfd33925..bb621c32d8 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -1247,7 +1247,7 @@ You can use Windows Deployment Services in conjunction with System Center Config To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request. For more information about how to perform this step, see [Install site system roles for System Center Configuration Manager](https://technet.microsoft.com/library/mt704036.aspx), [Use PXE to deploy Windows over the network with System Center Configuration Manager](https://technet.microsoft.com/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/library/mt627944.aspx#BKMK_PXEDistributionPoint). -3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. +3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index 5ddc9d7456..cb30050aa8 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -123,10 +123,10 @@ If you want to delete either (or both) the Skype and the Xbox accounts, here’s To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515) If you need help deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you’ve signed in, you can: -1. Select a help topic (**Account and Password**) -2. Select a related problem (**Deleting an account**) -3. Click **Next**. -4. Select a contact method to get answers to your questions. +1. Select a help topic (**Account and Password**) +2. Select a related problem (**Deleting an account**) +3. Click **Next**. +4. Select a contact method to get answers to your questions. #### Xbox diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 3432624379..838aa85226 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -49,9 +49,9 @@ You can purchase individual Minecraft: Education Edition subscriptions for you a To purchase individual Minecraft: Education Edition subscriptions (i.e. direct purchase): -1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account. -2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it) -3. Click **Buy** +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account. +2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it) +3. Click **Buy** >[!Note] >Administrators can restrict the ability for teachers to purchase applications in the Microsoft Store for Education. If you do not have the ability to Buy, contact your school administration or IT administrator. diff --git a/it-client b/it-client deleted file mode 160000 index 61e0a21977..0000000000 --- a/it-client +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 61e0a21977430f3c0eef1c32e398999dc090c332 diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md index b5f9062d59..925e63a5c9 100644 --- a/mdop/appv-v4/delete-package.md +++ b/mdop/appv-v4/delete-package.md @@ -19,7 +19,7 @@ ms.date: 06/16/2016 Removes a package record and the applications associated with it. -` SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` +`SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md index 0b72c8c94c..38b1c28072 100644 --- a/mdop/appv-v4/sfttray-command-reference.md +++ b/mdop/appv-v4/sfttray-command-reference.md @@ -31,23 +31,23 @@ There is only one Application Virtualization Client Tray instance for each user -` Sfttray.exe /?` +`Sfttray.exe /?` ### Command Usage -` Sfttray.exe [/HIDE | /SHOW]` +`Sfttray.exe [/HIDE | /SHOW]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` -` Sfttray.exe /EXIT` +`Sfttray.exe /EXIT` ### Command-Line Switches diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md index d9862868d2..ee45693fca 100644 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md +++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md @@ -51,21 +51,16 @@ Use the following procedure to install the publishing server on a separate compu 9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - `` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - `` + ```xml + + + + + + + + + ``` **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md index b304366dd1..c9ed253251 100644 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md +++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md @@ -51,21 +51,16 @@ Use the following procedure to install the publishing server on a separate compu 9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - `` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - `` + ```xml + + + + + + + + + ``` **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md index b300c0341b..e0dec01036 100644 --- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md +++ b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md @@ -88,49 +88,55 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab Modify the MBAM Recovery and Hardware Database to use the full recovery mode. - `USE master;` + ```sql + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Recovery and Hardware"` + ALTER DATABASE "MBAM Recovery and Hardware" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO + ``` Create MBAM Recovery and Hardware Database Data and MBAM Recovery logical backup devices. - `USE master` + ```sql + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - `'Z:\MBAM Recovery and Hardware Database Data.bak';` + 'Z:\MBAM Recovery and Hardware Database Data.bak'; - `GO` + GO + ``` Back up the full MBAM Recovery and Hardware database. - `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];` + ```sql + BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - `GO` + GO - `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]` + BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - `TO FILE = 'Z:\SQLServerInstanceCertificateFile'` + TO FILE = 'Z:\SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` ENCRYPTION BY PASSWORD = '$PASSWORD$'` + ENCRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` **Note** Replace the values from the preceding example with those that match your environment: @@ -181,43 +187,51 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab 4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - `-- Restore MBAM Recovery and Hardware Database. ` + ```sql + -- Restore MBAM Recovery and Hardware Database. - `USE master` + USE master - `GO` + GO + ``` Drop the certificate created by MBAM Setup. - `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]` + ```sql + DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - `GO` + GO + ``` Add certificate - `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]` + ```sql + CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'` + FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` DECRYPTION BY PASSWORD = '$PASSWORD$'` + DECRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` Restore the MBAM Recovery and Hardware database data and the log files. - `RESTORE DATABASE [MBAM Recovery and Hardware]` + ```sql + RESTORE DATABASE [MBAM Recovery and Hardware] - ` FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak'` + FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` **Note** Replace the values from the preceding example with those that match your environment: @@ -354,35 +368,37 @@ If you choose to move the MBAM Compliance Status Database feature from one compu 2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Modify the MBAM Compliance Status Database to use the full recovery model.` + ```sql + -- Modify the MBAM Compliance Status Database to use the full recovery model. - `USE master;` + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Compliance Status"` + ALTER DATABASE "MBAM Compliance Status" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO - `-- Create MBAM Compliance Status Data logical backup devices.` + -- Create MBAM Compliance Status Data logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - `'Z: \MBAM Compliance Status Database Data.bak';` + 'Z: \MBAM Compliance Status Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery and Hardware database. - `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];` + BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - `GO` + GO + ``` 3. Run the SQL file with a command that is similar to the following one, by using the SQL Server PowerShell: @@ -422,19 +438,21 @@ If you choose to move the MBAM Compliance Status Database feature from one compu 3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Create MBAM Compliance Status Database Data logical backup devices. ` + ```sql + -- Create MBAM Compliance Status Database Data logical backup devices. - `Use master` + Use master - `GO` + GO -- Restore the MBAM Compliance Status database data files. - `RESTORE DATABASE [MBAM Compliance Status Database]` + RESTORE DATABASE [MBAM Compliance Status Database] - ` FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'` + FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` 4. Run the SQL File with a command that is similar to the following one, by using the SQL Server PowerShell: diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md index 46aeb38af7..7888f34d72 100644 --- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md +++ b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md @@ -88,49 +88,51 @@ To move the Recovery Database from one computer to another (for example, from Se Modify the MBAM Recovery Database to use the full recovery mode. - `USE master;` + ```sql + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Recovery and Hardware"` + ALTER DATABASE "MBAM Recovery and Hardware" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - `'Z:\MBAM Recovery Database Data.bak';` + 'Z:\MBAM Recovery Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery Database. - `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];` + BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - `GO` + GO - `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]` + BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - `TO FILE = 'Z:\SQLServerInstanceCertificateFile'` + TO FILE = 'Z:\SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` ENCRYPTION BY PASSWORD = '$PASSWORD$'` + ENCRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` **Note** Replace the following values in the example above with those that match your environment: @@ -183,43 +185,45 @@ To move the Recovery Database from one computer to another (for example, from Se 4. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Restore MBAM Recovery Database. ` + ```sql + -- Restore MBAM Recovery Database. - `USE master` + USE master - `GO` + GO -- Drop certificate created by MBAM Setup. - `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]` + DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - `GO` + GO --Add certificate - `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]` + CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'` + FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` DECRYPTION BY PASSWORD = '$PASSWORD$'` + DECRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO -- Restore the MBAM Recovery Database data and log files. - `RESTORE DATABASE [MBAM Recovery and Hardware]` + RESTORE DATABASE [MBAM Recovery and Hardware] - ` FROM DISK = 'Z:\MBAM Recovery Database Data.bak'` + FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` **Note** Replace the following values in the example above with those that match your environment: @@ -362,35 +366,37 @@ If you want to move the MBAM Compliance and Audit Database from one computer to 2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Modify the MBAM Compliance Status Database to use the full recovery model.` + ```sql + -- Modify the MBAM Compliance Status Database to use the full recovery model. - `USE master;` + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Compliance Status"` + ALTER DATABASE "MBAM Compliance Status" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO - `-- Create MBAM Compliance Status Data logical backup devices.` + -- Create MBAM Compliance Status Data logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - `'Z: \MBAM Compliance Status Database Data.bak';` + 'Z: \MBAM Compliance Status Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery database. - `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];` + BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - `GO` + GO + ``` 3. Run the SQL file by using a Windows PowerShell command line that is similar to the following: @@ -430,19 +436,21 @@ If you want to move the MBAM Compliance and Audit Database from one computer to 3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Create MBAM Compliance Status Database Data logical backup devices. ` + ```sql + -- Create MBAM Compliance Status Database Data logical backup devices. - `Use master` + Use master - `GO` + GO -- Restore the MBAM Compliance Status database data files. - `RESTORE DATABASE [MBAM Compliance Status]` + RESTORE DATABASE [MBAM Compliance Status] - ` FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'` + FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` 4. Run the SQL File by using a Windows PowerShell command line that is similar to the following: diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md index 22008a42bb..a33c126e12 100644 --- a/mdop/mbam-v25/TOC.md +++ b/mdop/mbam-v25/TOC.md @@ -83,6 +83,7 @@ #### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) ### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) ## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) +## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md) ## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) ### [Client Event Logs](client-event-logs.md) ### [Server Event Logs](server-event-logs.md) diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md index cf5d567d3a..fd3074b66a 100644 --- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md @@ -240,7 +240,7 @@ Version identifies the version of the settings location template for administrat **Hint:** You can save notes about version changes using XML comment tags ``, for example: -``` syntax +```xml `, for example: -``` syntax - - 4 + Version 1 Jul 05, 2012 Initial template created by Generator - Denise@Contoso.com + Version 2 Jul 31, 2012 Added support for app.exe v2.1.3 - Mark@Contoso.com + Version 3 Jan 01, 2013 Added font settings support - Mark@Contoso.com + Version 4 Jan 31, 2013 Added support for plugin settings - Tony@Contoso.com + --> +4 ``` **Important**   @@ -1216,25 +1215,25 @@ Author identifies the creator of the settings location template. Two optional ch Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: -``` syntax - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - +```xml + + MyApplication.exe + Win64 + MyApplication + MyApplication.exe + + + + + + + + + + + + + ``` ### Filename @@ -1291,14 +1290,14 @@ UE-V does not support ARM processors in this version. ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: -``` syntax - - MyApplication.exe - My Application 6.x by Contoso.com - - - - +```xml + + MyApplication.exe + My Application 6.x by Contoso.com + + + + ``` ### FileDescription @@ -1311,23 +1310,22 @@ FileDescription is an optional tag that allows for an administrative description For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: -``` syntax +```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - + + MyApplication.exe + My Application Main Engine + + + + + + MyApplicationHelper.exe + My Application Background Process Executable + + + + ``` @@ -1345,44 +1343,44 @@ The product and file version elements may be left unspecified. Doing so makes th Product version: 1.0 specified in the UE-V Generator produces the following XML: -``` syntax - - - - +```xml + + + + ``` **Example 2:** File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: -``` syntax - - - - - - +```xml + + + + + + ``` **Incorrect Example 1 – incomplete range:** Only the Minimum attribute is present. Maximum must be included in a range as well. -``` syntax - - - +```xml + + + ``` **Incorrect Example 2 – Minor specified without Major element:** Only the Minor element is present. Major must be included as well. -``` syntax - - - +```xml + + + ``` ### FileVersion @@ -1399,19 +1397,19 @@ Including a FileVersion element for an application allows for more granular fine The child elements and syntax rules for FileVersion are identical to those of ProductVersion. -``` syntax - - MSACCESS.EXE - Win32 - - - - - - - - - +```xml + + MSACCESS.EXE + Win32 + + + + + + + + + ``` ### Application Element diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 3b6a6ab7cf..cfbb3dcb99 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -61,13 +61,13 @@ People in your org can request license for apps that they need, or that others n ## Acquire apps **To acquire an app** -1. Sign in to http://businessstore.microsoft.com -2. Select **Shop for my group**, or use Search to find an app. -3. Select the app you want to purchase. -4. On the product description page, choose your license type - either online or offline. +1. Sign in to http://businessstore.microsoft.com +2. Select **Shop for my group**, or use Search to find an app. +3. Select the app you want to purchase. +4. On the product description page, choose your license type - either online or offline. 5. Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and select **Next**. -6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one. -7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**. +6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one. +7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**. You’ll also need to have your business address saved on **My organization - Profile**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings#organization-tax-information). diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md index c7b0c2dce6..17369a8148 100644 --- a/store-for-business/app-inventory-management-microsoft-store-for-business.md +++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md @@ -75,10 +75,10 @@ For online-licensed apps, you can assign apps directly to people in your organiz **To assign an app to an employee** -1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses, and then choose **Assign to people**. -4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. +1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Inventory**. +3. Find an app, click the ellipses, and then choose **Assign to people**. +4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. Employees will receive an email with a link that will install the app on their device. Click the link to start the Microsoft Store app, and then click **Install**. Also, in the Microsoft Store app, they can find the app under **My Library**. @@ -103,9 +103,9 @@ Employees can claim apps that admins added to the private store by doing the fol ### Get and remove private store apps **To claim an app from the private store** -1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app. -2. Click the private store tab. -3. Click the app you want to install, and then click **Install**. +1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app. +2. Click the private store tab. +3. Click the app you want to install, and then click **Install**. Another way to distribute apps is by assigning them to people in your organization. diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md index 50f43122c5..d45e508ac3 100644 --- a/store-for-business/distribute-apps-from-your-private-store.md +++ b/store-for-business/distribute-apps-from-your-private-store.md @@ -43,13 +43,11 @@ Microsoft Store adds the app to **Products and services**. Click **Manage**, **A -3. Use **Refine results** to search for online-licensed apps under **License type**. -4. From the list of online-licensed apps, click the ellipses for the app you want, and then choose **Add to private store**. +3. Click on the application to open the application settings, then select **Private store availability**. +4. Select **Everyone** to make application available for all people in your organization. -The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store. - >[!Note] > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be available in **Products & services** before adding it to your private store. For more information, see [Working with line-of-business apps](working-with-line-of-business-apps.md). diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md index 696f1be75a..52c8ea4a6b 100644 --- a/store-for-business/distribute-offline-apps.md +++ b/store-for-business/distribute-offline-apps.md @@ -66,8 +66,8 @@ There are several items to download or create for offline-licensed apps. The app 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. -3. Under **Shopping Experience**, set **Show offline apps** to **On**. -4. Click **Shop for my group**. Search for the required inbox-app, select it, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. +3. Click **Settings**. +4. Click **Shop**. Search for the **Shopping experience** section, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. 5. Click **Manage**. You now have access to download the appx bundle package metadata and license file. 6. Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.) diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md index 6a2f39e62d..115dd3fa5b 100644 --- a/store-for-business/manage-orders-microsoft-store-for-business.md +++ b/store-for-business/manage-orders-microsoft-store-for-business.md @@ -55,10 +55,10 @@ Refunds work a little differently for free apps, and apps that have a price. In Reclaim licenses, and then request a refund. If you haven't assigned licenses, start on step 5. 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, and then choose **Apps & software**. -3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**. +2. Click **Manage**, and then choose **Apps & software**. +3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**. 4. Select the people who you want to reclaim license from, click the ellipses under **Actions**, and then choose **Reclaim licenses**. -5. Click **Order history**, click the order you want to refund, and click **Refund order**. +5. Click **Order history**, click the order you want to refund, and click **Refund order**. For free apps, the app will be removed from your inventory in **Apps & software**. diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md index 495b200df1..1cb95fa906 100644 --- a/store-for-business/update-microsoft-store-for-business-account-settings.md +++ b/store-for-business/update-microsoft-store-for-business-account-settings.md @@ -94,7 +94,7 @@ If you qualify for tax-exempt status in your market, start a service request to **To start a service request** 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com). -2. Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**. +2. Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**. You’ll need this documentation: diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index 90350a2913..f4075f53b1 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -42,7 +42,7 @@ Before attempting this procedure, you should read and understand the information 2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - ``` syntax + ```powershell <# .SYNOPSIS This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. @@ -59,9 +59,6 @@ Before attempting this procedure, you should read and understand the information .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 #> - []() - - []() function ConvertSIDToHexFormat {    param([System.Security.Principal.SecurityIdentifier]$sidToConvert) diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index dddf40f87f..58e0e60b57 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -40,8 +40,8 @@ Benefits of this design change include: >**Try This** > > To see the refactoring behavior, create a Windows 10 version 1703 VM and configure the memory settings as follows: -> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. -> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. +> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. +> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. Refactoring also makes it easier to view running processes in Task Manager. You can look at Task Manager and know exactly which service is using what resources, without having to expand many separate host groups. diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index f8b87748fa..9761cd0e66 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -60,13 +60,13 @@ When managing over OMA DM, make sure to always use a unique GUID. Provisioning w Braces { } are required around the GUID. In OMA Client Provisioning, you can type the braces. For example: -``` syntax +```xml ``` For OMA DM, you must use the ASCII values of %7B and %7D for the opening and closing braces, respectively. For example, if the GUID is "C556E16F-56C4-4EDB-9C64-D9469EE1FBE0", type: -``` syntax +```xml ./Vendor/MSFT/ActiveSync/Accounts/%7BC556E16F-56C4-4EDB-9C64-D9469EE1FBE0%7D diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index ed052860e4..d1e42bc7aa 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -14,6 +14,7 @@ ms.date: 09/18/2018 # AssignedAccess CSP +**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. @@ -134,7 +135,7 @@ Additionally, the Status payload includes the following fields: Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** -Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. Shell Launcher V2 is introduced in Windows 10, version 1903 to support both UWP and Win32 apps as the custom shell. For more information, see [Shell Launcher](https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher). +Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. Shell Launcher V2 is introduced in Windows 10, version 1903 to support both UWP and Win32 apps as the custom shell. For more information, see [Shell Launcher](https://docs.microsoft.com/windows/configuration/kiosk-shelllauncher). > [!Note] > You cannot set both ShellLauncher and KioskModeApp at the same time on the device. @@ -246,6 +247,8 @@ KioskModeApp Replace ## AssignedAccessConfiguration XSD +Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + ```xml + + + @@ -270,6 +278,7 @@ KioskModeApp Replace + @@ -286,6 +295,10 @@ KioskModeApp Replace + + + + @@ -304,7 +317,13 @@ KioskModeApp Replace + + + + + + @@ -322,7 +341,8 @@ KioskModeApp Replace - + + @@ -340,6 +360,7 @@ KioskModeApp Replace + @@ -365,6 +386,22 @@ KioskModeApp Replace + + + + + + + + + + + + + + + + @@ -385,7 +422,94 @@ KioskModeApp Replace +``` +Here is the schema for new features introduced in Windows 10 1809 release +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +Schema for Windows 10 prerelease +```xml + + + + + + + + + + + + + + + + + + +``` + +To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +```xml + + + + + + ``` ## Example AssignedAccessConfiguration XML @@ -796,7 +920,7 @@ StatusConfiguration Get StatusConfiguration Replace On -```syntax +```xml @@ -1219,7 +1343,7 @@ ShellLauncherConfiguration Get ## AssignedAccessAlert XSD -```syntax +```xml 1 @@ -379,7 +379,7 @@ Add a root certificate to the MDM server. Get all installed client certificates. -``` syntax +```xml 1 @@ -394,7 +394,7 @@ Get all installed client certificates. Delete a root certificate. -``` syntax +```xml 1 @@ -409,7 +409,7 @@ Delete a root certificate. Configure the device to enroll a client certificate through SCEP. -``` syntax +```xml 100 @@ -588,7 +588,7 @@ Configure the device to enroll a client certificate through SCEP. Configure the device to automatically renew an MDM client certificate with the specified renew period and retry interval. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 6ef3f48d8b..567dfd207e 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -198,7 +198,7 @@ The following diagram shows the CM\_CellularEntries configuration service provid To delete a connection, you must first delete any associated proxies and then delete the connection. The following example shows how to delete the proxy and then the connection. -``` syntax +```xml @@ -214,7 +214,7 @@ To delete a connection, you must first delete any associated proxies and then de Configuring a GPRS connection: -``` syntax +```xml @@ -231,7 +231,7 @@ Configuring a GPRS connection: Configuring an LTE connection: -``` syntax +```xml @@ -250,7 +250,7 @@ Configuring an LTE connection: Configuring a CDMA connection: -``` syntax +```xml diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index e9c0f37c15..1dfca8abb1 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -240,7 +240,7 @@ Specifies the type of connection being referenced. The following list describes Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -285,7 +285,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -334,7 +334,7 @@ Adding a host-based mapping policy. In this example, the ConnectionId for type C Adding an application-based mapping policy: -``` syntax +```xml @@ -401,7 +401,7 @@ Adding an application-based mapping policy: Adding a host-based mapping policy: -``` syntax +```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index f601f858de..08d0040594 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -240,7 +240,7 @@ Specifies the type of connection being referenced. The following list describes Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -285,7 +285,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -334,7 +334,7 @@ Adding a host-based mapping policy. In this example, the ConnectionId for type C Adding an application-based mapping policy: -``` syntax +```xml @@ -401,7 +401,7 @@ Adding an application-based mapping policy: Adding a host-based mapping policy: -``` syntax +```xml diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index a282ba8384..6889f31898 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -23,7 +23,7 @@ For information about the bridge WMI provider classes that map to these CSPs, se Additional lists: -- [List of CSPs supported in Windows Holographic](#hololens) +- [List of CSPs supported in HoloLens devices](#hololens) - [List of CSPs supported in Microsoft Surface Hub](#surfacehubcspsupport) - [List of CSPs supported in Windows 10 IoT Core](#iotcoresupport) @@ -2709,37 +2709,40 @@ You can download the DDF files for various CSPs from the links below: - [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -## CSPs supported in Windows Holographic +## CSPs supported in HoloLens devices -The following list shows the configuration service providers supported in Windows Holographic editions. +The following list shows the CSPs supported in HoloLens devices: -| Configuration service provider | Windows Holographic edition | Windows Holographic for Business edition | -|--------|--------|------------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) -| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| -| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| -| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [VPN2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | +|------|--------|--------|--------| +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) +| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | ## CSPs supported in Microsoft Surface Hub diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 6e5b89a1b1..05add93e6a 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -38,7 +38,7 @@ Package Full Name of the App that needs be launched in the background. This can **Set StartupAppID** -``` syntax +```xml @@ -60,7 +60,7 @@ Package Full Name of the App that needs be launched in the background. This can **Get all background tasks** -``` syntax +```xml @@ -78,7 +78,7 @@ Package Full Name of the App that needs be launched in the background. This can **Add background task** -``` syntax +```xml diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 0888128b87..13a78b2032 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -648,7 +648,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego Example -``` syntax +```xml $CmdID$ @@ -919,7 +919,7 @@ The following screenshots of the administrator console shows the list of update Set auto update to notify and defer. -``` syntax +```xml diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 40379541ed..09d6af05e4 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -70,7 +70,7 @@ The parent node to group SIM2 specific information in case of dual SIM mode. The following sample shows how to query roaming status and phone number on the device. -``` syntax +```xml 2 @@ -88,7 +88,7 @@ The following sample shows how to query roaming status and phone number on the d Response from the phone. -``` syntax +```xml 3 1 diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index b2cf37371d..246408076e 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -126,7 +126,7 @@ Required. This node has the same set of policy nodes as the **ProviderID** node. Set device lock policies: -``` syntax +```xml 13 diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 98c675ebf6..44c558fde0 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -420,7 +420,7 @@ Default value is 0 meaning no keyword. Get provider **Keywords** -``` syntax +```xml @@ -440,7 +440,7 @@ Get provider **Keywords** Set provider **Keywords** -``` syntax +```xml diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 6c7e0be2f3..3cb1682333 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -105,7 +105,7 @@ After the previous package is sent, the unenrollment process begins. When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with messageid=1. -``` syntax +```xml 4 1226 diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 4dd6ad8b3d..7946edba39 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -70,7 +70,7 @@ Supported operation is Get. The following is a Get command example. -``` syntax +```xml 12 @@ -173,7 +173,7 @@ To work around the timeout, you can use this setting to keep the session alive b Here is an example of DM message sent by the device when it is in pending state: -``` syntax +```xml 1.2 @@ -229,7 +229,7 @@ Added in Windows 10, version 1607. The list of management server URLs in the fo -``` syntax +```xml 101 @@ -770,7 +770,7 @@ Note that <LocURI>./Vendor/MSFT/DMClient/Unenroll</LocURI> is suppor The following SyncML shows how to remotely unenroll the device. Note that this command should be inserted in the general DM packages sent from the server to the device. -``` syntax +```xml 2 diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index d8747df10d..e7d55aedc0 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -29,7 +29,7 @@ The following diagram shows the DynamicManagement configuration service provider

Default value is False. Supported operations are Get and Replace.

Example to turn on NotificationsEnabled:

-``` syntax +```xml 100 @@ -84,7 +84,7 @@ The following diagram shows the DynamicManagement configuration service provider Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 meters radius of the specified latitude/longitude -``` syntax +```xml 200 @@ -138,7 +138,7 @@ Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 me Disable camera using network trigger with time trigger, from 9-5, when ip4 gateway is 192.168.0.1 -``` syntax +```xml 300 @@ -193,7 +193,7 @@ Disable camera using network trigger with time trigger, from 9-5, when ip4 gatew Delete a context -``` syntax +```xml 400 @@ -206,7 +206,7 @@ Delete a context Get ContextStatus and SignalDefinition from a specific context -``` syntax +```xml 400 diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 0080b3d273..49635be46f 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -142,11 +142,11 @@ The following list describes the prerequisites for a certificate to be used with - The certificate must have at least one of the following EKU (Extended Key Usage) properties: - Client Authentication - - As defined by RFC 5280, this is a well-defined OID with Value 1.3.6.1.5.5.7.3.2 + - As defined by RFC 5280, this is a well-defined OID with Value 1.3.6.1.5.5.7.3.2 - Any Purpose - - An EKU Defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering. + - An EKU Defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering. - All Purpose - - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. + - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. - The user or the computer certificate on the client chains to a trusted root CA - The user or the computer certificate does not fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. - The user or the computer certificate does not fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index 8e61116fdd..f97a70c2f7 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -64,7 +64,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( > [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. -``` syntax +```xml @@ -114,7 +114,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( Here is the snippet from appv.admx: - ``` syntax + ```xml @@ -226,7 +226,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( > [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - ``` syntax + ```xml @@ -264,7 +264,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( The \ payload is \. Here is an example to disable AppVirtualization/PublishingAllowServer2. -``` syntax +```xml diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index 645484d8fa..e05ab31e6f 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -275,7 +275,7 @@ After the installation of updates is completed, the IT Admin can use the DURepor ## Example PowerShell script -``` syntax +```powershell param ( # [Parameter (Mandatory=$true, HelpMessage="Input File")] [String]$inputFile, diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 1d7810f0e3..f374eaec31 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -50,7 +50,7 @@ Requirements: - Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD -1. Run GPEdit.msc +1. Run GPEdit.msc Click Start, then in the text box type gpedit. @@ -62,11 +62,11 @@ Requirements: ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Auto MDM Enrollment with AAD Token**. +4. Double-click **Auto MDM Enrollment with AAD Token**. ![MDM autoenrollment policy](images/autoenrollment-policy.png) -5. Click **Enable**, then click **OK**. +5. Click **Enable**, then click **OK**. A task is created and scheduled to run every 5 minutes for the duration of 1 day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." @@ -76,9 +76,9 @@ Requirements: ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) -6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. +6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. -7. Click **Info** to see the MDM enrollment information. +7. Click **Info** to see the MDM enrollment information. ![Work School Settings](images/autoenrollment-settings-work-school.png) @@ -91,9 +91,9 @@ Requirements: ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) -2. Under **Best match**, click **Task Scheduler** to launch it. +2. Under **Best match**, click **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. +3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) @@ -122,11 +122,11 @@ Requirements: > 5. Restart the Primary Domain Controller for the policy to be available. > This procedure will work for any future version as well. -1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. -2. Create a Security Group for the PCs. -3. Link the GPO. -4. Filter using Security Groups. -5. Enforce a GPO link. +1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. +2. Create a Security Group for the PCs. +3. Link the GPO. +4. Filter using Security Groups. +5. Enforce a GPO link. > [!NOTE] > Version 1903 (March 2019) is actually on the Insider program and doesn't yet contain a downloadable version of Templates (version 1903). diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index 2502635341..b809041a65 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -78,7 +78,7 @@ Note that performing a full inventory of a device can be resource intensive on t Here is an example of a query for all apps on the device. -``` syntax +```xml 1 @@ -92,7 +92,7 @@ Here is an example of a query for all apps on the device. Here is an example of a query for a specific app for a user. -``` syntax +```xml 1 @@ -121,7 +121,7 @@ For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP]( Here is an example of a query for all app licenses on a device. -``` syntax +```xml 1 @@ -135,7 +135,7 @@ Here is an example of a query for all app licenses on a device. Here is an example of a query for all app licenses for a user. -``` syntax +```xml 1 @@ -161,7 +161,7 @@ For more information about the AllowAllTrustedApps policy, see [Policy CSP](poli Here are some examples. -``` syntax +```xml 1 @@ -199,7 +199,7 @@ For more information about the AllowDeveloperUnlock policy, see [Policy CSP](pol Here is an example. -``` syntax +```xml 1 @@ -244,7 +244,7 @@ Here are the requirements for this scenario: Here are some examples. -``` syntax +```xml 1 @@ -281,7 +281,7 @@ In the SyncML, you need to specify the following information in the Exec command Here is an example of an offline license installation. -``` syntax +```xml 1 @@ -315,7 +315,7 @@ The Add command for the package family name is required to ensure proper removal Here is an example of a line-of-business app installation. -``` syntax +```xml 0 @@ -342,7 +342,7 @@ Here is an example of a line-of-business app installation. Here is an example of an app installation with dependencies. -``` syntax +```xml 0 @@ -376,7 +376,7 @@ Here is an example of an app installation with dependencies. Here is an example of an app installation with dependencies and optional packages. -``` syntax +```xml 0 @@ -438,7 +438,7 @@ Here is an example of app installation. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -475,7 +475,7 @@ Here is an example of app installation with dependencies. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -526,7 +526,7 @@ When an app is installed successfully, the node is cleaned up and no longer pres Here is an example of a query for a specific app installation. -``` syntax +```xml 2 @@ -540,7 +540,7 @@ Here is an example of a query for a specific app installation. Here is an example of a query for all app installations. -``` syntax +```xml 2 @@ -558,7 +558,7 @@ Application installations can take some time to complete, hence they are done as Here is an example of an alert. -``` syntax +```xml 4 1226 @@ -594,7 +594,7 @@ To uninstall an app, you delete it under the origin node, package family name, a Here is an example for uninstalling all versions of an app for a user. -``` syntax +```xml 1 @@ -608,7 +608,7 @@ Here is an example for uninstalling all versions of an app for a user. Here is an example for uninstalling a specific version of the app for a user. -``` syntax +```xml 1 @@ -631,7 +631,7 @@ Removing provisioned app occurs in the device context. Here is an example for removing a provisioned app from a device. -``` syntax +```xml 1 @@ -645,7 +645,7 @@ Here is an example for removing a provisioned app from a device. Here is an example for removing a specific version of a provisioned app from a device: -``` syntax +```xml 1 @@ -663,7 +663,7 @@ You can remove app licenses from a device per app based on the content ID. Here is an example for removing an app license for a user. -``` syntax +```xml 1 @@ -677,7 +677,7 @@ Here is an example for removing an app license for a user. Here is an example for removing an app license for a provisioned package (device context). -``` syntax +```xml 1 @@ -697,7 +697,7 @@ For user-based uninstallation, use ./User in the LocURI, and for provisioning, u Here is an example. There is only one uninstall for hosted and store apps. -``` syntax +```xml 1226 @@ -723,7 +723,7 @@ To update an app from Microsoft Store, the device requires contact with the stor Here is an example of an update scan. -``` syntax +```xml 1 @@ -737,7 +737,7 @@ Here is an example of an update scan. Here is an example of a status check. -``` syntax +```xml 1 @@ -766,7 +766,7 @@ Turning off updates only applies to updates from the Microsoft Store at the devi Here is an example. -``` syntax +```xml 1 @@ -795,7 +795,7 @@ You can install app on non-system volumes, such as a secondary partition or remo Here is an example. -``` syntax +```xml 1 @@ -832,7 +832,7 @@ The RestrictAppDataToSystemVolume policy in [Policy CSP](policy-configuration-se Here is an example. -``` syntax +```xml 1 @@ -873,7 +873,7 @@ The valid values are 0 (off, default value) and 1 (on). Here is an example. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index 2b091686b2..d2b3bddc1d 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -132,7 +132,7 @@ The following image shows the EnterpriseAPN configuration service provider in tr ## Examples -``` syntax +```xml diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index e5e5177782..486334505b 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -209,7 +209,7 @@ The Microsoft Store application has a GUID of d5dc1ebb-a7f1-df11-9264-00237de2db Use the following SyncML format to query to see if the application is installed on a managed device: -``` syntax +```xml 1 @@ -222,7 +222,7 @@ Use the following SyncML format to query to see if the application is installed Response from the device (it contains list of subnodes if this app is installed in the device). -``` syntax +```xml 3 1 @@ -266,7 +266,7 @@ The value actually applied to the device can be queried via the nodes under the Enroll enterprise ID “4000000001” for the first time: -``` syntax +```xml 2 @@ -293,7 +293,7 @@ Enroll enterprise ID “4000000001” for the first time: Update the enrollment token (for example, to update an expired application enrollment token): -``` syntax +```xml 2 @@ -310,7 +310,7 @@ Update the enrollment token (for example, to update an expired application enrol Query all installed applications that belong to enterprise id “4000000001”: -``` syntax +```xml 2 @@ -325,7 +325,7 @@ Query all installed applications that belong to enterprise id “4000000001”: Response from the device (that contains two installed applications): -``` syntax +```xml 3 1 @@ -444,7 +444,7 @@ To perform an XAP update, create the Name, URL, Version, and DownloadInstall nod -``` syntax +```xml 2 ` node among with other `` nodes, it shares most grammar with the Application Node, **folderId** is mandatory, **folderName** is optional, which is the folder name displayed on Start. **folderId** is a unique unsigned integer for each folder. Folder example: -``` syntax +```xml Large @@ -123,7 +123,7 @@ Folder example: ``` An application that belongs in the folder would add an optional attribute **ParentFolderId**, which maps to **folderId** of the folder. In this case, the location of this application will be located inside the folder. -``` syntax +```xml Medium @@ -252,7 +252,7 @@ For example, in place of SettingPageDisplay, you would use ms-settings:display. Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -327,14 +327,14 @@ Starting in Windows 10, version 1703, Quick action settings no longer require an In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked. -``` syntax +```xml ``` In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names. -``` syntax +```xml @@ -350,7 +350,7 @@ In this example for Windows 10, version 1511, all System setting pages are ena ``` Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -382,7 +382,7 @@ Buttons | The following list identifies the hardware buttons on the device that > Custom buttons are hardware buttons that can be added to devices by OEMs. Buttons example: -``` syntax +```xml @@ -407,7 +407,7 @@ The Search and custom buttons can be remapped or configured to open a s To remap a button in lockdown XML, you supply the button name, the button event (typically "press"), and the product ID for the application the button will open. -``` syntax +```xml
+ + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcross markcross markcross markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +Specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + +Value type is integer. + + + +ADMX Info: +- GP English name: Let Windows apps access background spatial perception +- GP name: LetAppsAccessBackgroundSpatialPerception +- GP element: LetAppsAccessBackgroundSpatialPerception_Enum +- GP path: Windows Components/App Privacy +- GP ADMX file name: AppPrivacy.admx + + + + +The following list shows the supported values: + +- 0 (default) – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
+ + +**Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcross markcross markcross markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: Let Windows apps access background spatial perception +- GP name: LetAppsAccessBackgroundSpatialPerception +- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List +- GP path: Windows Components/App Privacy +- GP ADMX file name: AppPrivacy.admx + + + + + + + + +
+ + +**Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcross markcross markcross markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: Let Windows apps access background spatial perception +- GP name: LetAppsAccessBackgroundSpatialPerception +- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List +- GP path: Windows Components/App Privacy +- GP ADMX file name: AppPrivacy.admx + + + + + + +
+ + + +
+ + +**Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcross markcross markcross markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. +The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: Let Windows apps access background spatial perception +- GP name: LetAppsAccessBackgroundSpatialPerception +- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List +- GP path: Windows Components/App Privacy +- GP ADMX file name: AppPrivacy.admx + + + + + + +
+ **Privacy/LetAppsAccessCalendar** @@ -4978,18 +5244,34 @@ ADMX Info: - -## Privacy policies supported by Windows Holographic + +## Privacy policies supported by HoloLens 2 - [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - +- [LetAppsAccessAccountInfo](#privacy-letappsaccessaccountinfo) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [LetAppsAccessBackgroundSpatialPerception](#privacy-letappsaccessbackgroundspatialperception) +- [LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) +- [LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) +- [LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessLocation](#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessMicrophone](#privacy-letappsaccessmicrophone) + -## Privacy policies supported by Windows Holographic for Business +## Privacy policies supported by HoloLens (1st gen) Commercial Suite - [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) + +## Privacy policies supported by HoloLens (1st gen) Development Edition + +- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) + ## Privacy policies supported by Windows 10 IoT Core - [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 7f5f4f91db..c9c9ba51bf 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -224,7 +224,7 @@ This policy setting specifies whether to prevent the mapping of client drives in By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format `` on ``. You can use this policy setting to override this behavior. -If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP. +If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2019 and Windows 10. If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 9c125b8c0f..2ee10fa612 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -76,7 +76,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. -``` syntax +```xml diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index d5903f1493..f551f810e3 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -921,18 +921,24 @@ The following list shows the supported values: - -## Search policies supported by Windows Holographic + +## Search policies supported by HoloLens 2 - [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - + -## Search policies supported by Windows Holographic for Business +## Search policies supported by HoloLens (1st gen) Commercial Suite - [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) + +## Search policies supported by HoloLens (1st gen) Development Edition + +- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) + +
Footnotes: diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 4467309f6d..22bddbe478 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -744,18 +744,24 @@ The following list shows the supported values: - -## Security policies supported by Windows Holographic + +## Security policies supported by HoloLens 2 - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - + -## Security policies supported by Windows Holographic for Business +## Security policies supported by HoloLens (1st gen) Commercial Suite - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) + +## Security policies supported by HoloLens (1st gen) Development Edition + +- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) + +
Footnotes: @@ -765,4 +771,4 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index cecaec5871..81727ffef1 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -844,20 +844,27 @@ To validate on Desktop, do the following: - -## Settings policies supported by Windows Holographic + +## Settings policies supported by HoloLens 2 - [Settings/AllowDateTime](#settings-allowdatetime) - [Settings/AllowVPN](#settings-allowvpn) - + -## Settings policies supported by Windows Holographic for Business +## Settings policies supported by HoloLens (1st gen) Commercial Suite - [Settings/AllowDateTime](#settings-allowdatetime) - [Settings/AllowVPN](#settings-allowvpn) + +## Settings policies supported by HoloLens (1st gen) Development Edition + +- [Settings/AllowDateTime](#settings-allowdatetime) +- [Settings/AllowVPN](#settings-allowvpn) + +
Footnotes: @@ -867,3 +874,4 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 61a11806fa..333716f687 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -73,6 +73,9 @@ manager: dansimp Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. +> [!Note] +> This policy will block installation only while the device is online. To block offline installation too, **SmartScreen/PreventOverrideForFilesInShell** and **SmartScreen/EnableSmartScreenInShell** policies should also be enabled. + ADMX Info: diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 9d1d87faa3..0f385479cb 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -87,18 +87,24 @@ The following list shows the supported values: - -## Speech policies supported by Windows Holographic + +## Speech policies supported by HoloLens 2 - [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - + -## Speech policies supported by Windows Holographic for Business +## Speech policies supported by HoloLens (1st gen) Commercial Suite - [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) + +## Speech policies supported by HoloLens (1st gen) Development Edition + +- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) + +
Footnotes: @@ -108,3 +114,4 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 99b3c5e4f3..af2069854f 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1581,20 +1581,29 @@ The following list shows the supported values: - -## System policies supported by Windows Holographic + +## System policies supported by HoloLens 2 -- [System/AllowTelemetry](#system-allowtelemetry) +- [System/AllowCommercialDataPipeline](#system-allowcommercialdatapipeline) - [System/AllowLocation](#system-allowlocation) - +- [System/AllowStorageCard](#system-allowstoragecard) +- [System/AllowTelemetry](#system-allowtelemetry) + -## System policies supported by Windows Holographic for Business +## System policies supported by HoloLens (1st gen) Commercial Suite -- [System/AllowTelemetry](#system-allowtelemetry) - [System/AllowLocation](#system-allowlocation) +- [System/AllowTelemetry](#system-allowtelemetry) + +## System policies supported by HoloLens (1st gen) Development Edition + +- [System/AllowLocation](#system-allowlocation) +- [System/AllowTelemetry](#system-allowtelemetry) + +
Footnotes: diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index e4c57fa46a..92367a4c2e 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -3958,21 +3958,25 @@ ADMX Info: - -## Update policies supported by Windows Holographic + +## Update policies supported by HoloLens 2 - [Update/AllowAutoUpdate](#update-allowautoupdate) - [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) +- [Update/BranchReadinessLevel](#update-branchreadinesslevel) +- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) +- [Update/ManagePreviewBuilds](#update-managepreviewbuilds) +- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) +- [Update/PauseQualityUpdates](#update-pausequalityupdates) - [Update/ScheduledInstallDay](#update-scheduledinstallday) - [Update/ScheduledInstallTime](#update-scheduledinstalltime) - [Update/UpdateServiceUrl](#update-updateserviceurl) - + -## Update policies supported by Windows Holographic for Business +## Update policies supported by HoloLens (1st gen) Commercial Suite - [Update/AllowAutoUpdate](#update-allowautoupdate) - [Update/AllowUpdateService](#update-allowupdateservice) @@ -3984,6 +3988,19 @@ ADMX Info: + +## Update policies supported by HoloLens (1st gen) Development Edition + +- [Update/AllowAutoUpdate](#update-allowautoupdate) +- [Update/AllowUpdateService](#update-allowupdateservice) +- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) +- [Update/RequireUpdateApproval](#update-requireupdateapproval) +- [Update/ScheduledInstallDay](#update-scheduledinstallday) +- [Update/ScheduledInstallTime](#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](#update-updateserviceurl) + + + ## Update policies supported by IoT Core diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index a045fc0a48..bf7b2a8067 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -20,7 +20,7 @@ User rights are assigned for user accounts or groups. The name of the policy def Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. -```syntax +```xml diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index ec997ee27b..9bc832c1ff 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -391,18 +391,24 @@ Supported operations are Add, Delete, Get, and Replace. - [Wifi/AllowWiFi](#wifi-allowwifi) - -## Wifi policies supported by Windows Holographic + +## Wifi policies supported by HoloLens 2 - [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - + + -## Wifi policies supported by Windows Holographic for Business +## Wifi policies supported by HoloLens (1st gen) Commercial Suite - [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) + +## Wifi policies supported by HoloLens (1st gen) Development Edition + +- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) + + ## Wifi policies supported by IoT Core @@ -427,3 +433,4 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index e147d62c40..dd40314d62 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -305,7 +305,7 @@ If you disable or don't configure this policy setting, any user can disconnect t Here is an example to enable this policy: -``` syntax +```xml diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 533315cd32..164f8d4a66 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -17,7 +17,7 @@ ms.date: 06/26/2017 This topic shows the OMA DM device description framework (DDF) for the **Registry** configuration service provider. DDF files are used only with OMA DM provisioning XML. -``` syntax +```xml 1.2 diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index 55e3d22e71..554e07f2d4 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -102,7 +102,7 @@ Supported operation is Get. ## Examples -``` syntax +```xml diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index c82c69f352..146160c8a3 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -131,7 +131,7 @@ If the BCD has the correct entries, check whether the **winload** and **bootmgr* If the files are missing, and you want to rebuild the boot files, follow these steps: -1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: +1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: ``` D:\> Mkdir BootBackup @@ -155,13 +155,13 @@ R:\> Copy *.* D:\BootBackup If you do not have a Windows 10 ISO, you must format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: -1. Start **Notepad** . +1. Start **Notepad** . -2. Press Ctrl+O. +2. Press Ctrl+O. -3. Navigate to the system partition (in this example, it is R). +3. Navigate to the system partition (in this example, it is R). -4. Right-click the partition, and then format it. +4. Right-click the partition, and then format it. ### Troubleshooting if this issue occurs after a Windows Update installation @@ -175,31 +175,31 @@ After you run this command, you will see the **Install pending** and **Uninstall ![Dism output](images/pendingupdate.png) -1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. +1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. ![Dism output](images/revertpending.png) -2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. +2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. -3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. +3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. -4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. +4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. -5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive +5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive ![Load Hive](images/loadhive.png) -6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. +6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. -7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. +7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) -8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. +8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. -9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. +9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. -10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. +10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. 11. Expand **Control\Session Manager**. Check whether the **PendingFileRenameOperations** key exists. If it does, back up the **SessionManager** key, and then delete the **PendingFileRenameOperations** key. @@ -209,9 +209,9 @@ After you run this command, you will see the **Install pending** and **Uninstall 1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after an Windows Update installation" section. (Step 11 does not apply to this procedure.) -2. Expand **Services**. +2. Expand **Services**. -3. Make sure that the following registry keys exist under **Services**: +3. Make sure that the following registry keys exist under **Services**: * ACPI diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 2049a34777..a33d808d2f 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -78,9 +78,9 @@ Reboot of the server will resolve the issue temporarily, but you would see all t If you suspect that the machine is in a state of port exhaustion: -1. Try making an outbound connection. From the server/machine, access a remote share or try an RDP to another server or telnet to a server on a port. If the outbound connection fails for all of these, go to the next step. +1. Try making an outbound connection. From the server/machine, access a remote share or try an RDP to another server or telnet to a server on a port. If the outbound connection fails for all of these, go to the next step. -2. Open event viewer and under the system logs, look for the events which clearly indicate the current state: +2. Open event viewer and under the system logs, look for the events which clearly indicate the current state: a. **Event ID 4227** @@ -133,12 +133,12 @@ For Windows 7 and Windows Server 2008 R2, you can update your Powershell version If method 1 does not help you identify the process (prior to Windows 10 and Windows Server 2012 R2), then have a look at Task Manager: -1. Add a column called “handles” under details/processes. -2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. +1. Add a column called “handles” under details/processes. +2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. ![Screenshot of handles column in Windows Task Maner](images/tcp-ts-21.png) -3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. +3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. ### Method 3 @@ -147,13 +147,13 @@ If Task Manager did not help you identify the process, then use Process Explorer Steps to use Process explorer: 1. [Download Process Explorer](https://docs.microsoft.com/sysinternals/downloads/process-explorer) and run it **Elevated**. -2. Alt + click the column header, select **Choose Columns**, and on the **Process Performance** tab, add **Handle Count**. -3. Select **View \ Show Lower Pane**. -4. Select **View \ Lower Pane View \ Handles**. -5. Click the **Handles** column to sort by that value. -6. Examine the processes with higher handle counts than the rest (will likely be over 10,000 if you can't make outbound connections). -7. Click to highlight one of the processes with a high handle count. -8. In the lower pane, the handles listed as below are sockets. (Sockets are technically file handles). +2. Alt + click the column header, select **Choose Columns**, and on the **Process Performance** tab, add **Handle Count**. +3. Select **View \ Show Lower Pane**. +4. Select **View \ Lower Pane View \ Handles**. +5. Click the **Handles** column to sort by that value. +6. Examine the processes with higher handle counts than the rest (will likely be over 10,000 if you can't make outbound connections). +7. Click to highlight one of the processes with a high handle count. +8. In the lower pane, the handles listed as below are sockets. (Sockets are technically file handles). File \Device\AFD diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 2d7183fc7b..7fd5ff086f 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -73,16 +73,16 @@ With Registry Editor, you can modify the following parameters for RPC. The RPC P In this example ports 5000 through 6000 inclusive have been arbitrarily selected to help illustrate how the new registry key can be configured. This is not a recommendation of a minimum number of ports needed for any particular system. -1. Add the Internet key under: HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc +1. Add the Internet key under: HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc -2. Under the Internet key, add the values "Ports" (MULTI_SZ), "PortsInternetAvailable" (REG_SZ), and "UseInternetPorts" (REG_SZ). +2. Under the Internet key, add the values "Ports" (MULTI_SZ), "PortsInternetAvailable" (REG_SZ), and "UseInternetPorts" (REG_SZ). For example, the new registry key appears as follows: Ports: REG_MULTI_SZ: 5000-6000 PortsInternetAvailable: REG_SZ: Y UseInternetPorts: REG_SZ: Y -3. Restart the server. All applications that use RPC dynamic port allocation use ports 5000 through 6000, inclusive. +3. Restart the server. All applications that use RPC dynamic port allocation use ports 5000 through 6000, inclusive. You should open up a range of ports above port 5000. Port numbers below 5000 may already be in use by other applications and could cause conflicts with your DCOM application(s). Furthermore, previous experience shows that a minimum of 100 ports should be opened, because several system services rely on these RPC ports to communicate with each other. diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 576ee3a7c0..920e5a1ff0 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -204,7 +204,7 @@ If the physical computer is still running in a frozen state, follow these steps 2. From a remote computer that is preferably in the same network and subnet, go to **Registry Editor** \> **Connect Network Registry**. Then, connect to the concerned computer, and verify the following settings: - * ` `*HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled` Make sure that the [CrashDumpEnabled](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-2000-server/cc976050(v=technet.10)) registry entry is `1`. diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index f78666d243..3dc34d0551 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -978,12 +978,12 @@ Thisis a lists of attributes that are supported by DHA and can trigger the corre Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. Here is what occurs when a smartphone is turned on: -1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. -2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. -3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. -4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. -6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. +1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. +2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. +3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. +4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. +6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. ### Asset reporting diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 73ee1abcef..095fa77861 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -30,22 +30,22 @@ You must be a CRM administrator to turn on and use Preview features. For more in **To turn on Cortana with Dynamics CRM** -1. Go to **Settings**, and then click **Administration**. +1. Go to **Settings**, and then click **Administration**. -2. Choose **System Settings**, and then click the **Previews** tab. +2. Choose **System Settings**, and then click the **Previews** tab. -3. Read the license terms, and if you agree, select the **I’ve read and agree to the license terms** check box. +3. Read the license terms, and if you agree, select the **I’ve read and agree to the license terms** check box. -4. For each preview feature you want to enable, click **Yes**. +4. For each preview feature you want to enable, click **Yes**. ## Turn on Cortana with Dynamics CRM on your employees’ devices You must tell your employees to turn on Cortana, before they’ll be able to use it with Dynamics CRM. **To turn on local Cortana with Dynamics CRM** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. +2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. ![Cotana at work, showing how to turn on the connected services for Dynamics CRM](../images/cortana-connect-crm.png) @@ -55,10 +55,10 @@ You must tell your employees to turn on Cortana, before they’ll be able to use Cortana can only access data in Dynamics CRM when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off. **To turn off Cortana with Dynamics CRM** -1. Go to **Settings**, and then click **Administration**. +1. Go to **Settings**, and then click **Administration**. -2. Choose **System Settings**, and then click the **Previews** tab. +2. Choose **System Settings**, and then click the **Previews** tab. -3. Click **No** for **Cortana**. +3. Click **No** for **Cortana**. All Dynamics CRM functionality related to Cortana is turned off in your organization. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 1a16f56f24..351942547a 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -45,9 +45,9 @@ You must tell your employees to turn on Cortana before they’ll be able to use **To turn on local Cortana with Office 365** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. +2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. ![Cotana at work, showing how to turn on the connected services for Office 365](../images/cortana-connect-o365.png) @@ -57,13 +57,13 @@ You must tell your employees to turn on Cortana before they’ll be able to use Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. **To turn off Cortana with Office 365** -1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. +1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. -2. Go to the [admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). +2. Go to the [admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). -3. Expand **Service Settings**, and select **Cortana**. +3. Expand **Service Settings**, and select **Cortana**. -4. Click **Cortana** to toggle Cortana off. +4. Click **Cortana** to toggle Cortana off. All Office 365 functionality related to Cortana is turned off in your organization and your employees are unable to use her at work. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index b0dd7c40b5..8ca269aefe 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -35,9 +35,9 @@ To use this walkthrough, you’ll need: - **Azure Active Directory (Azure AD)/Work or School account**. You can use the account that you created for Office 365, or you can create a new one while you’re establishing your Power BI account. If you choose to use Azure AD, you must connect your Azure AD account to your Windows account. **To connect your account to Windows** - a. Open **Windows Settings**, click **Accounts**, click **Access work or school**, and then in the **Connect to work or school** section, click **Connect**. + a. Open **Windows Settings**, click **Accounts**, click **Access work or school**, and then in the **Connect to work or school** section, click **Connect**. - b. Follow the instructions to add your Azure Active Directory (Azure AD) account to Windows. + b. Follow the instructions to add your Azure Active Directory (Azure AD) account to Windows. ## Set up your test environment for Cortana for Power BI Before you can start this testing scenario, you must first set up your test environment and data, and then you must turn on and set up Cortana to connect and work with Power BI. @@ -50,31 +50,31 @@ Before you can start this testing scenario, you must first set up your test envi ![Cortana at work, showing the navigation expand icon in Power BI](../images/cortana-powerbi-expand-nav.png) -3. Click **Get Data** from the left-hand navigation in Power BI. +3. Click **Get Data** from the left-hand navigation in Power BI. ![Cortana at work, showing the Get Data link](../images/cortana-powerbi-getdata.png) -4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. +4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) -5. Click **Retail Analysis Sample**, and then click **Connect**. +5. Click **Retail Analysis Sample**, and then click **Connect**. ![Cortana at work, showing the Samples link](../images/cortana-powerbi-retail-analysis-sample.png) The sample data is imported and you’re returned to the **Power BI** screen. -6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. +6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. ![Cortana at work, showing a dashboard view of the sample data](../images/cortana-powerbi-retail-analysis-dashboard.png) -7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. +7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. ![Cortana at work, showing where to find the Settings option](../images/cortana-powerbi-settings.png) -8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. +8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. -9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. +9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) @@ -90,31 +90,31 @@ After you’ve finished creating your Answer Page, you can continue to the inclu >It can take up to 30 minutes for a custom Answer Page to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately. **To create a custom sales data Answer Page for Cortana** -1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. +1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. ![Cortana at work, showing where to create the new report](../images/cortana-powerbi-create-report.png) -2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. +2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. A blank report page appears. -3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. +3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. ![Cortana at work, showing the Visualizations options](../images/cortana-powerbi-pagesize.png) -4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. +4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. ![Cortana at work, showing the Field options](../images/cortana-powerbi-field-selection.png) The automatically generated graph is added to your blank report. You have the option to change colors, add borders, add additional visualizations, and modify this page so that it answers the question about sales data as precisely, and in as custom a way, as you want. You just need to make sure that it all stays within the page borders. -5. In the **Visualizations** pane, click the paint roller icon again, expand **Page Information**, type _Sales data 2016_ into the **Name** box, turn on **Q&A**, and then add alternate report names (separated by commas) into the text box. +5. In the **Visualizations** pane, click the paint roller icon again, expand **Page Information**, type _Sales data 2016_ into the **Name** box, turn on **Q&A**, and then add alternate report names (separated by commas) into the text box. The alternate names help Cortana to know what questions to look for and when to show this report. To also improve your results, you should avoid using the names of your report columns. ![Cortana at work, showing the page info for your specific report](../images/cortana-powerbi-report-qna.png) -6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. +6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. Because this is part of the Retail Analysis Sample, it will automatically be included as part of the dataset you included for Cortana. However, you will still need to log in and out of Windows 10, or otherwise restart Cortana, before the new content appears. @@ -122,15 +122,15 @@ After you’ve finished creating your Answer Page, you can continue to the inclu Now that you’ve set up your device, you can use Cortana to show your info from within Power BI. **To use Cortana with Power BI** -1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. +1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -2. Type _This year in sales_. +2. Type _This year in sales_. Cortana shows you the available results. ![Cortana at work, showing the best matches based on the Power BI data](../images/cortana-powerbi-search.png) -3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. +3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. Cortana returns your custom report. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index 8842961ced..a1dfe7d5c0 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -47,14 +47,14 @@ This process helps you to sign out of a Microsoft Account and to sign into an Az ## Use Cortana to manage the notebook content This process helps you to manage the content Cortana shows in your Notebook. -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. +1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. -2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. +2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. -3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. +3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. ![Cortana at work, showing the multiple Weather screens](../images/cortana-weather-multipanel.png) -4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. +4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. ![Cortana at work, showing Redmond, WA weather](../images/cortana-redmond-weather.png) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index 27a951f3bc..70a280cb22 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -38,6 +38,6 @@ This process helps you to use Cortana at work and voice commands to perform a qu 1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). -2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. +2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. ![Cortana at work, showing the current weather in Chicago, IL](../images/cortana-chicago-weather.png) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index f01109a686..e82abbd92a 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -85,4 +85,4 @@ This process helps you to edit or archive and existing or completed reminder. ![Cortana at work, showing the reminder editing screen](../images/cortana-reminder-edit.png) -3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. +3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index 4a461ce194..3283f2d1ad 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -41,9 +41,9 @@ This process helps you find your upcoming meetings. ## Find out about upcoming meetings by using voice commands This process helps you to use Cortana at work and voice commands to find your upcoming meetings. -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. -2. Say _Show me what meeting I have at 3pm tomorrow_. +2. Say _Show me what meeting I have at 3pm tomorrow_. >[!IMPORTANT] >Make sure that you have a meeting scheduled for the time you specify here. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index fa8db5b62f..7fe284c023 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -25,34 +25,34 @@ This scenario helps you to send an email to a co-worker listed in your work addr ## Send an email to a co-worker This process helps you to send a quick message to a co-worker from the work address book. -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. +1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -3. Type _Send an email to <contact_name>_. +3. Type _Send an email to <contact_name>_. Where _<contact_name>_ is the name of someone in your work address book. -4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. +4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. ![Cortana at work, showing the email text](../images/cortana-send-email-coworker.png) ## Send an email to a co-worker by using voice commands This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. -2. Say _Send an email to <contact_name>_. +2. Say _Send an email to <contact_name>_. Where _<contact_name>_ is the name of someone in your work address book. -3. Add your email message by saying, _Hello this is a test email using Cortana at work._ +3. Add your email message by saying, _Hello this is a test email using Cortana at work._ The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. ![Cortana at work, showing the email text created from verbal commands](../images/cortana-send-email-coworker-mic.png) -4. Say _Send it_. +4. Say _Send it_. The email is sent. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index 65a1d5f319..f731e345d8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -41,7 +41,7 @@ Cortana automatically finds patterns in your email, suggesting reminders based t 5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, _I’ll finish this project by end of day today_. -6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. +6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index 2a804ea6f2..01f326616c 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -24,16 +24,16 @@ This optional scenario helps you to protect your organization’s data on a devi ## Use Cortana and WIP to protect your organization’s data -1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). +1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). -2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_. +2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_. -3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. +3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. Cortana automatically pulls your commitment to sending the presentation out of your email, showing it to you. -4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_. +4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_. -5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. +5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. Because it was in an WIP-protected email, the presentation info isn’t pulled out and it isn’t shown to you. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index af76d42aea..825037d62d 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -42,23 +42,23 @@ To enable voice commands in Cortana While these aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization. **To get a Microsoft Store app** -1. Go to the Microsoft Store, scroll down to the **Collections** area, click **Show All**, and then click **Better with Cortana**. +1. Go to the Microsoft Store, scroll down to the **Collections** area, click **Show All**, and then click **Better with Cortana**. -2. Click **Uber**, and then click **Install**. +2. Click **Uber**, and then click **Install**. -3. Open Uber, create an account or sign in, and then close the app. +3. Open Uber, create an account or sign in, and then close the app. **To set up the app with Cortana** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Uber**, and then click **Connect**. +2. Click on **Connected Services**, click **Uber**, and then click **Connect**. ![Cortana at work, showing where to connect the Uber service to Cortana](../images/cortana-connect-uber.png) **To use the voice-enabled commands with Cortana** -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). -2. Say _Uber get me a taxi_. +2. Say _Uber get me a taxi_. Cortana changes, letting you provide your trip details for Uber. diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 2fd51caeeb..aa221c4b9e 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -91,7 +91,7 @@ When you have the Start layout that you want your users to see, use the [Export- 2. On a device running Windows 10, version 1607, 1703, or 1803, at the Windows PowerShell command prompt, enter the following command: - `Export-StartLayout –path .xml ` + `Export-StartLayout –path .xml` On a device running Windows 10, version 1809, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 5caeb82469..0647e4eec3 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -130,7 +130,7 @@ After you use Group Policy to apply a customized Start and taskbar layout on a c - [Add image for secondary tiles](start-secondary-tiles.md) - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index f2ab6d4bd9..2cde6940fa 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -26,7 +26,7 @@ ms.topic: article ## Full XML sample >[!NOTE] ->Updated for Windows 10, version 1809. +>Updated for Windows 10, version 1903, and Windows 10 Prerelease ```xml @@ -165,11 +165,479 @@ ms.topic: article ``` +## Auto Launch Sample XML + +This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + aauser1 + + + + aauser2 + + + + + +``` + +## [Preview] Global Profile Sample XML +Global Profile is currently supported in Windows 10 Prerelease. Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. + +This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + +``` + +Below sample shows dedicated profile and global profile mixed usage, aauser would use one profile, everyone else that's non-admin will use another profile. +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + aauser + + + + + +``` + +## [Preview] Folder Access sample xml +In Windows 10 1809 release, folder access is locked down that when common file dialog is opened, IT Admin can specify if user has access to the Downloads folder, or no access to any folder at all. This restriction has be redesigned for finer granulatity and easier use, available in current Windows 10 Prerelease. + +IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Note that Downloads and Removable Drives can be allowed at the same time. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + multi1 + + + + multi2 + + + + multi3 + + + + multi4 + + + + multi5 + + + + multi6 + + + + + + +``` ## XSD for AssignedAccess configuration XML >[!NOTE] ->Updated for Windows 10, version 1809. +>Updated for Windows 10, version 1903 and Windows 10 Prerelease. +Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. ```xml @@ -179,172 +647,174 @@ ms.topic: article xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" + xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
``` -## XSD schema for new elements in Windows 10, version 1809 - +Here is the schema for new features introduced in Windows 10 1809 release ```xml - - - - - + - - - + + + + + + + + + - - - - - + + + - + + + + + - + - + - + + + ``` + +Schema for Windows 10 prerelease +```xml + + + + + + + + + + + + + + + + + + +``` + +To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +```xml + + + + + + +``` diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index a8d16003c6..5d8414295c 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -172,7 +172,7 @@ Here are the predefined assigned access AppLocker rules for **desktop apps**: The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in. -xml +```xml <AllAppsList> <AllowedApps> <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> @@ -184,6 +184,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula <App DesktopAppPath="C:\Windows\System32\notepad.exe" rs5:AutoLaunch="true" rs5:AutoLaunchArguments="123.txt"/> </AllowedApps> </AllAppsList> +``` ##### FileExplorerNamespaceRestrictions @@ -217,6 +218,13 @@ The following example shows how to allow user access to the Downloads folder in ``` +FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace http://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace http://schemas.microsoft.com/AssignedAccess/2020/config. + +* When FileExplorerNamespaceRestrictions node is not used, or used but left empty, user will not be able to access any folder in common dialog (e.g. Save As in Microsoft Edge browser). +* When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder. +* When AllowRemovableDrives is used, user will be to access removable drives. +* When NoRestriction is used, no restriction will be applied to the dialog. +* AllowRemovableDrives and AllowedNamespace:Downloads can be used at the same time. ##### StartLayout @@ -401,6 +409,67 @@ Group accounts are specified using ``. Nested groups are not supporte +#### [Preview] Global Profile +Global profile is added in curernt Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. + +Usage is demonstrated below, by using the new xml namespace and specify GlobalProfile from that namespace. When GlobalProfile is configured, a non-admin account logs in, if this user does not have designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, global profile will be applied for the user. + +Note: +1. GlobalProfile can only be multi-app profile +2. Only one GlobalProfile can be used in one AssignedAccess Configuration Xml +3. GlobalProfile can be used as the only config, or it can be used among with regular user or group Config. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + +``` + ### Add XML file to provisioning package Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml). diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 44291012be..107e1b4b1c 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -1,6 +1,6 @@ --- title: Introduction to configuration service providers (CSPs) for IT pros (Windows 10) -description: Configuration service providers (CSPs) expose device configuration settings in Windows 10. +description: Configuration service providers (CSPs) expose device configuration settings in Windows 10. ms.assetid: 25C1FDCA-0E10-42A1-A368-984FFDB2B7B6 ms.reviewer: manager: dansimp @@ -16,35 +16,33 @@ ms.date: 07/27/2017 # Introduction to configuration service providers (CSPs) for IT pros - **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile -Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. +Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. -The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. +The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. >[!NOTE] ->The explanation of CSPs and CSP documentation also apply to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. +>This explanation of CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. [See what's new for CSPs in Windows 10, version 1809.](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809) ## What is a CSP? +A CSP is an interface in the client operating system, between configuration settings specified in a provisioning document, and configuration settings on the device. CSPs are similar to Group Policy client-side extensions, in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable, and some are read-only. -A CSP is an interface in the client operating system between configuration settings specified in a provisioning document and configuration settings on the device. Their function is similar to that of Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable and some are read-only. - -Starting in Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. In the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. +Starting with Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. On the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. -CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). +CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). ![how intune maps to csp](../images/policytocsp.png) -CSPs receive configuration policies in the XML-based SyncML format pushed to it from an MDM-compliant management server such as Microsoft Intune. Traditional enterprise management systems, such as System Center Configuration Manager, can also target CSPs by using a client-side WMI-to-CSP bridge. +CSPs receive configuration policies in the XML-based SyncML format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as System Center Configuration Manager, can also target CSPs, by using a client-side WMI-to-CSP bridge. ### Synchronization Markup Language (SyncML) @@ -52,22 +50,21 @@ The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based ### The WMI-to-CSP Bridge -The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. +The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software, such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. [Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) ## Why should you learn about CSPs? - Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices. -In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. +In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +Some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. -### CSPs in Windows Configuration Designer +### CSPs in Windows Configuration Designer -You can use Windows Configuration Designer to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. +You can use Windows Configuration Designer to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. @@ -83,12 +80,11 @@ When a CSP is available but is not explicitly included in your MDM solution, you ### CSPs in Lockdown XML -Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](../mobile-devices/lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). In Windows 10, version 1703, you can also use the new [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML. +Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](../mobile-devices/lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). In Windows 10, version 1703, you can also use the new [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML. ## How do you use the CSP documentation? - -All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). +All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). The [main CSP topic](https://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. @@ -98,17 +94,17 @@ The documentation for each CSP follows the same structure. After an introduction The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices’ root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. -The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. +The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. ![assigned access csp tree](../images/provisioning-csp-assignedaccess.png) -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). +The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). ```XML ./Vendor/MSFT/AssignedAccess/KioskModeApp ``` -When an element in the diagram uses italic font, it indicates a placeholder for specific information, such as the tenant ID in the following example. +When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. ![placeholder in csp tree](../images/csp-placeholder.png) @@ -120,12 +116,11 @@ The documentation for most CSPs will also include an XML example. ## CSP examples - CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. - [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) - The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. + The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. In addition to lockscreen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml which can be used to lock down the device through the following settings: @@ -139,7 +134,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - Creating role-specific configurations. - [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) - The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. + The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. Some of the settings available in the Policy CSP include the following: @@ -159,7 +154,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - **Update**, such as specifying whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store - **WiFi**, such as whether to enable Internet sharing -Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: +Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: - [ActiveSync CSP](https://go.microsoft.com/fwlink/p/?LinkId=723219) - [Application CSP](https://go.microsoft.com/fwlink/p/?LinkId=723220) @@ -218,13 +213,3 @@ Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile E - [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=71743) - [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723274) - [WindowsSecurityAuditing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723415) - - - - - - - - - - diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index 399946fcc1..b7a9b2ca2d 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -214,7 +214,7 @@ XML files can and should be tested locally on a Hyper-V or other virtual machine ### Symptom: Start menu no longer works after a PC is refreshed using F12 during start up -**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. +**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. **Cause**: This is a known issue and has been resolved in a cumulative update released August 30th 2018. diff --git a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md index b8ef5003a2..bead7186c8 100644 --- a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md +++ b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md @@ -20,15 +20,15 @@ ms.topic: article If you’re already using UE-V 2.x and you’re planning to upgrade user devices to Windows 10, version 1607 or later releases, you need to make only a few adjustments to your existing environment. These steps are explained in more detail below. -1. Upgrade user devices to Windows 10, version 1607 or later release. +1. Upgrade user devices to Windows 10, version 1607 or later release. -2. Verify that UE-V settings were migrated correctly. +2. Verify that UE-V settings were migrated correctly. 3. Set the template storage path to your current template store. -4. Enable the UE-V service on user devices. +4. Enable the UE-V service on user devices. -5. Install the UE-V template generator if you want to synchronize application settings for custom applications. +5. Install the UE-V template generator if you want to synchronize application settings for custom applications. > **Important**  You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607.. @@ -42,21 +42,21 @@ After upgrading a user device to Windows 10, version 1607, it’s important to v **To verify UE-V settings using Windows PowerShell** -1. Run PowerShell as Administrator, type **Get-UEVConfiguration**, and press ENTER to view current configurations. +1. Run PowerShell as Administrator, type **Get-UEVConfiguration**, and press ENTER to view current configurations. -2. Check that the settings were successfully updated. +2. Check that the settings were successfully updated. -3. Type **Get-UEVTemplate** and press ENTER to check that your templates are still registered. +3. Type **Get-UEVTemplate** and press ENTER to check that your templates are still registered. > **Note** You’ll need to register the NotePad template again after you upgrade the device to Windows 10. **To verify UE-V settings using the device’s registry** -1. In a command prompt, run **Regedit** as Administrator. +1. In a command prompt, run **Regedit** as Administrator. -2. Navigate to **HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration.** +2. Navigate to **HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration.** -3. Verify that the settings storage path and the settings template catalog path are pointing to the same locations as before you upgraded the device to Windows 10. +3. Verify that the settings storage path and the settings template catalog path are pointing to the same locations as before you upgraded the device to Windows 10. ## Set the template storage path to your current template store @@ -72,21 +72,21 @@ With Windows 10, version 1607 and later, the UE-V service replaces the UE-V Agen **To enable the UE-V service with Group Policy** -1. Open the device’s **Group Policy Editor**. +1. Open the device’s **Group Policy Editor**. -2. Navigate to **Computer Configuration > Administrative Templates > Windows Components > Microsoft User Experience Virtualization**. +2. Navigate to **Computer Configuration > Administrative Templates > Windows Components > Microsoft User Experience Virtualization**. -3. Run **Enable UEV** +3. Run **Enable UEV** -4. Restart the device. +4. Restart the device. **To enable the UE-V service with Windows PowerShell** -1. Run PowerShell as Administrator, type **Enable-UEV**, and press ENTER. +1. Run PowerShell as Administrator, type **Enable-UEV**, and press ENTER. -2. Restart the device. +2. Restart the device. -3. Type **Get-UEVStatus** and press ENTER to verify that the service was successfully enabled. +3. Type **Get-UEVStatus** and press ENTER to verify that the service was successfully enabled. ## Install the UE-V template generator @@ -94,13 +94,13 @@ The UE-V template generator is included in the Windows Assessment and Deployment **To install the UE-V template generator** -1. Go to [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) to access the ADK. +1. Go to [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) to access the ADK. 2. Select the **Get Windows ADK for Windows 10** button on this page to start the ADK installer. On the screen pictured below, select **Microsoft User Experience Virtualization (UE-V) Template Generator** and then select **Install**. ![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) -3. To open the generator, open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator**. +3. To open the generator, open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator**. diff --git a/windows/deployment/deploy-m365.md b/windows/deployment/deploy-m365.md index 8c363af466..45e5fb53df 100644 --- a/windows/deployment/deploy-m365.md +++ b/windows/deployment/deploy-m365.md @@ -67,7 +67,7 @@ Examples of these two deployment advisors are shown below. ## M365 Enterprise poster -[![M365 Enterprise poster](images/m365e.png)](http://aka.ms/m365eposter) +[![M365 Enterprise poster](images/m365e.png)](https://aka.ms/m365eposter) ## Related Topics diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 568b71cc11..c6933b26b5 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -419,7 +419,7 @@ This issue occurs because in Windows 10, version 1903 and later versions, MBR2GP To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. To do this, follow these steps: -1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). +1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). 2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM. @@ -427,7 +427,7 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from **Command 1:** ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgnet*.*" "C:\WinPE_Mount\Windows\System32" + copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" ``` This command copies three files: @@ -437,16 +437,16 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from **Command 2:** ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgnet*.*" "C:\WinPE_Mount\Windows\System32\En-Us" + copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" ``` This command copies two files: * ReAgent.adml * ReAgent.dll.mui - >![Note] - >If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. + > [!NOTE] + > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. -3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). +3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). ## Related topics diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index b0e171d783..72e45ad5e7 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -6,6 +6,7 @@ ms.mktglfcycl: plan ms.localizationpriority: medium ms.sitesec: library author: greg-lindsay +manager: laurawi ms.author: greglin ms.topic: article --- diff --git a/windows/deployment/planning/windows-10-1709-removed-features.md b/windows/deployment/planning/windows-10-1709-removed-features.md index d4796ebda4..a8ef0ceac2 100644 --- a/windows/deployment/planning/windows-10-1709-removed-features.md +++ b/windows/deployment/planning/windows-10-1709-removed-features.md @@ -6,6 +6,7 @@ ms.mktglfcycl: plan ms.localizationpriority: medium ms.sitesec: library author: greg-lindsay +manager: laurawi ms.topic: article --- # Features that are removed or deprecated in Windows 10, version 1709 @@ -42,4 +43,4 @@ For more information about a listed feature or functionality and its replacemen |**Trusted Platform Module (TPM): TPM.msc and TPM Remote Management**
To be replaced by a new user interface in a future release.| | X | |**Trusted Platform Module (TPM) Remote Management**
This legacy code to be removed in a future release.|| X | |**Windows Hello for Business deployment that uses System Center Configuration Manager**
Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience.|| X | -|**Windows PowerShell 2.0**
Applications and components should be migrated to PowerShell 5.0+.| | X | \ No newline at end of file +|**Windows PowerShell 2.0**
Applications and components should be migrated to PowerShell 5.0+.| | X | diff --git a/windows/deployment/planning/windows-10-1903-removed-features.md b/windows/deployment/planning/windows-10-1903-removed-features.md index 7bd3264aa0..9e5370e4e5 100644 --- a/windows/deployment/planning/windows-10-1903-removed-features.md +++ b/windows/deployment/planning/windows-10-1903-removed-features.md @@ -6,6 +6,7 @@ ms.mktglfcycl: plan ms.localizationpriority: medium ms.sitesec: library author: greg-lindsay +manager: laurawi ms.author: greglin ms.topic: article --- diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md index df669aaff6..b945d2692b 100644 --- a/windows/deployment/update/feature-update-maintenance-window.md +++ b/windows/deployment/update/feature-update-maintenance-window.md @@ -24,13 +24,13 @@ Use the following information to deploy feature updates during a maintenance win ### Step 1: Configure maintenance windows -1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. -2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). -3. On the **Home** tab, in the **Properties** group, choose **Properties**. -4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon. -5. Complete the `` Schedule dialog. -6. Select from the Apply this schedule to drop-down list. -7. Choose **OK** and then close the **\ Properties** dialog box. +1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. +2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). +3. On the **Home** tab, in the **Properties** group, choose **Properties**. +4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon. +5. Complete the `` Schedule dialog. +6. Select from the Apply this schedule to drop-down list. +7. Choose **OK** and then close the **\ Properties** dialog box. ### Step 2: Review computer restart device settings @@ -172,10 +172,10 @@ Before you deploy the feature updates, you can download the content as a separat 9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. +4. On the **Home** tab, in the Content group, click **View Status**. ### Step 3: Deploy the feature update(s) After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). @@ -250,12 +250,12 @@ After you determine which feature updates you intend to deploy, you can manually >[!NOTE] >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index 489c2fcbfd..fe17e6fb8e 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -150,10 +150,10 @@ Before you deploy the feature updates, you can download the content as a separat 9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click **Close**. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. +4. On the **Home** tab, in the Content group, click **View Status**. ### Step 3: Deploy the feature update(s) After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). @@ -228,12 +228,12 @@ After you determine which feature updates you intend to deploy, you can manually >[!NOTE] >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index a62a880de1..4a3ce5b3d2 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -27,16 +27,16 @@ Steps are provided in sections that follow the recommended setup process: ## Update Compliance prerequisites Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites: -1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. -2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them. -3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device. -4. To show device names for versions of Windows 10 starting with 1803 in Windows Analytics you must opt in. For details about this, see the "AllowDeviceNameinTelemetry (in Windows 10)" entry in the table in the [Distributing policies at scale](windows-analytics-get-started.md#deploying-windows-analytics-at-scale) section of [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). -5. To use the Windows Defender Status, devices must be E3-licensed and have Cloud Protection enabled. E5-licensed devices will not appear here. For E5 devices, you should use [Windows Defender ATP](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) instead. For more information on Windows 10 Enterprise licensing, see [Windows 10 Enterprise: FAQ for IT Professionals](https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro). +1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. +2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them. +3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device. +4. To show device names for versions of Windows 10 starting with 1803 in Windows Analytics you must opt in. For details about this, see the "AllowDeviceNameinTelemetry (in Windows 10)" entry in the table in the [Distributing policies at scale](windows-analytics-get-started.md#deploying-windows-analytics-at-scale) section of [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). +5. To use the Windows Defender Status, devices must be E3-licensed and have Cloud Protection enabled. E5-licensed devices will not appear here. For E5 devices, you should use [Windows Defender ATP](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) instead. For more information on Windows 10 Enterprise licensing, see [Windows 10 Enterprise: FAQ for IT Professionals](https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro). ## Add Update Compliance to your Azure subscription Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps: -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. +1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. > [!NOTE] > Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance. @@ -69,7 +69,7 @@ Update Compliance is offered as a solution which is linked to a new or existing ## Enroll devices in Windows Analytics Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are two key steps for enrollment: -1. Deploy your Commercial ID (from the Update Compliance Settings page) to your Windows 10 devices (typically by using Group Policy, [Mobile Device Management](https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm), [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) or similar). -2. Ensure the Windows Diagnostic Data setting on devices is set to at least Basic (typically using Group Policy or similar). For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). +1. Deploy your Commercial ID (from the Update Compliance Settings page) to your Windows 10 devices (typically by using Group Policy, [Mobile Device Management](https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm), [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) or similar). +2. Ensure the Windows Diagnostic Data setting on devices is set to at least Basic (typically using Group Policy or similar). For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices. diff --git a/windows/deployment/update/update-compliance-wd-av-status.md b/windows/deployment/update/update-compliance-wd-av-status.md index 962f5cdcfd..716a071e38 100644 --- a/windows/deployment/update/update-compliance-wd-av-status.md +++ b/windows/deployment/update/update-compliance-wd-av-status.md @@ -39,4 +39,4 @@ Because of the way Windows Defender is associated with the rest of Windows devic ## Related topics -- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites) +- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index a2b5054ca7..59f1889887 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -136,9 +136,9 @@ If you don’t see any bytes coming from peers the cause might be one of the fol If you suspect this is the problem, try these steps: -1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. -3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. +1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. @@ -146,10 +146,10 @@ If you suspect this is the problem, try these steps: If you suspect this is the problem, try these steps: -1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. -3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. -4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. +1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. ### Clients aren't able to connect to peers offered by the cloud service diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md index cba86c0a75..c572ab8879 100644 --- a/windows/deployment/update/waas-manage-updates-configuration-manager.md +++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md @@ -48,13 +48,13 @@ For the Windows 10 servicing dashboard to display information, you must adhere t **To configure Upgrade classification** - 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. + 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. - 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. + 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. ![Example of UI](images/waas-sccm-fig1.png) - 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. + 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. @@ -67,81 +67,81 @@ Regardless of the method by which you deploy Windows 10 feature updates to your **To create collections for deployment rings** -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. -3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. +3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. -4. Click **Browse** to select the limiting collection, and then click **All Systems**. +4. Click **Browse** to select the limiting collection, and then click **All Systems**. -5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. +5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. -6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. +6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. -7. On the **Criteria** tab, click the **New** icon. +7. On the **Criteria** tab, click the **New** icon. ![Example of UI](images/waas-sccm-fig4.png) -8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. +8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. -9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. +9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. ![Example of UI](images/waas-sccm-fig5.png) >[!NOTE] >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. -10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. +10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. ![Example of UI](images/waas-sccm-fig6.png) -11. Now that the **OSBranch** attribute is correct, verify the operating system version. +11. Now that the **OSBranch** attribute is correct, verify the operating system version. -12. On the **Criteria** tab, click the **New** icon again to add criteria. +12. On the **Criteria** tab, click the **New** icon again to add criteria. -13. In the **Criterion Properties** dialog box, click **Select**. +13. In the **Criterion Properties** dialog box, click **Select**. -14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. +14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. ![Example of UI](images/waas-sccm-fig7.png) -15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. +15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. ![Example of UI](images/waas-sccm-fig8.png) -16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. +16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. -17. Click **Summary**, and then click **Next**. +17. Click **Summary**, and then click **Next**. -18. Close the wizard. +18. Close the wizard. >[!IMPORTANT] >Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 4 Broad broad business users** collection. Complete the following steps to create the **Ring 4 Broad business users** device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. -3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. +3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. -4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. +4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. -5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. +5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. -6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. +6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. -7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. +7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. -8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. +8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. -9. Click **Next**, and then click **Close**. +9. Click **Next**, and then click **Close**. -10. In the **Create Device Collection Wizard** dialog box, click **Summary**. +10. In the **Create Device Collection Wizard** dialog box, click **Summary**. -11. Click **Next**, and then click **Close**. +11. Click **Next**, and then click **Close**. ## Use Windows 10 servicing plans to deploy Windows 10 feature updates @@ -150,13 +150,13 @@ There are two ways to deploy Windows 10 feature updates with System Center Confi **To configure Windows feature updates for CBB clients in the Ring 4 Broad business users deployment ring using a servicing plan** -1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. +1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. -2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. +2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. -3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. +3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. -4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. +4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. >[!IMPORTANT] >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. @@ -165,33 +165,33 @@ There are two ways to deploy Windows 10 feature updates with System Center Confi > >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). -5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. +5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. Doing so deploys CBB feature updates to the broad business users deployment ring immediately after they are released to CBB. On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. -6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. +6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. -7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. +7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. -8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. +8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. Doing so allows installation and restarts after the 7-day deadline on workstations only. -9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. +9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. ![Example of UI](images/waas-sccm-fig10.png) -10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. +10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. ![Example of UI](images/waas-sccm-fig11.png) Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. -11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. +11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. You have now created a servicing plan for the **Ring 4 Broad business users** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. @@ -208,62 +208,62 @@ There are times when deploying a Windows 10 feature update requires the use of a Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. -2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. +2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. -3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. +3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. >[!NOTE] >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. -4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. +4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. -5. On the **Summary** page, click **Next** to create the package. +5. On the **Summary** page, click **Next** to create the package. -6. On the **Completion** page, click **Close**. +6. On the **Completion** page, click **Close**. Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. -2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. +2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. -3. In the Distribute Content Wizard, on the **General** page, click **Next**. +3. In the Distribute Content Wizard, on the **General** page, click **Next**. -4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. +4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. -5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. +5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. -6. On the **Content Destination** page, click **Next**. +6. On the **Content Destination** page, click **Next**. -7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. +7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. -8. On the **Completion** page, click **Close**. +8. On the **Completion** page, click **Close**. Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. -2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. +2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. -3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. +3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. -4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. +4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. -5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. +5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. -6. Click **Next**. +6. Click **Next**. -7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. +7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. -8. On the **Install Applications** page, click **Next**. +8. On the **Install Applications** page, click **Next**. -9. On the **Summary** page, click **Next** to create the task sequence. +9. On the **Summary** page, click **Next** to create the task sequence. -10. On the **Completion** page, click **Close**. +10. On the **Completion** page, click **Close**. With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 4 Broad business users collection**. @@ -272,29 +272,29 @@ With the task sequence created, you’re ready to deploy it. If you’re using t **To deploy your task sequence** -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. -2. On the Ribbon, in the **Deployment** group, click **Deploy**. +2. On the Ribbon, in the **Deployment** group, click **Deploy**. -3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. +3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. -4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. +4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. -5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. +5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. -6. In the **Assignment Schedule** dialog box, click **Schedule**. +6. In the **Assignment Schedule** dialog box, click **Schedule**. -7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. +7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. -8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. +8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. -9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. +9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. -10. Use the defaults for the remaining settings. +10. Use the defaults for the remaining settings. -11. Click **Summary**, and then click **Next** to deploy the task sequence. +11. Click **Summary**, and then click **Next** to deploy the task sequence. -12. Click **Close**. +12. Click **Close**. ## Steps to manage updates for Windows 10 diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 4d88af99d2..7eccb49914 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -50,11 +50,11 @@ With Windows 10, quality updates will be larger than traditional Windows Updates **To configure WSUS to download Express Update Files** -1. Open the WSUS Administration Console. +1. Open the WSUS Administration Console. -2. In the navigation pane, go to *Your_Server*\\**Options**. +2. In the navigation pane, go to *Your_Server*\\**Options**. -3. In the **Options** section, click **Update Files and Languages**. +3. In the **Options** section, click **Update Files and Languages**. ![Example of UI](images/waas-wsus-fig1.png) @@ -126,15 +126,15 @@ You can use computer groups to target a subset of devices that have specific qua **To create computer groups in the WSUS Administration Console** -1. Open the WSUS Administration Console. +1. Open the WSUS Administration Console. -2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. +2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. ![Example of UI](images/waas-wsus-fig7.png) 3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**. -4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. +4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). @@ -151,15 +151,15 @@ When new computers communicate with WSUS, they appear in the **Unassigned Comput **To assign computers manually** -1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. -2. Select both computers, right-click the selection, and then click **Change Membership**. +2. Select both computers, right-click the selection, and then click **Change Membership**. ![Example of UI](images/waas-wsus-fig8.png) -3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. +3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. @@ -177,7 +177,7 @@ Another way to add multiple computers to a deployment ring in the WSUS Administr ![Example of UI](images/waas-wsus-fig9.png) -4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. +4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. You can now see these computers in the **Ring 3 Broad IT** computer group. @@ -189,11 +189,11 @@ The WSUS Administration Console provides a friendly interface from which you can **To configure WSUS to allow client-side targeting from Group Policy** -1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. +1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. ![Example of UI](images/waas-wsus-fig10.png) -2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. +2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. >[!NOTE] >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. @@ -205,39 +205,39 @@ Now that WSUS is ready for client-side targeting, complete the following steps t >[!TIP] >When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. -1. Open GPMC. +1. Open GPMC. -2. Expand Forest\Domains\\*Your_Domain*. +2. Expand Forest\Domains\\*Your_Domain*. -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. -4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. +4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. -5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. +5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. ![Example of UI](images/waas-wsus-fig11.png) -6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. -7. Right-click **Enable client-side targeting**, and then click **Edit**. +7. Right-click **Enable client-side targeting**, and then click **Edit**. -8. In the **Enable client-side targeting** dialog box, select **Enable**. +8. In the **Enable client-side targeting** dialog box, select **Enable**. -9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. +9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. ![Example of UI](images/waas-wsus-fig12.png) -10. Close the Group Policy Management Editor. +10. Close the Group Policy Management Editor. Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. **To scope the GPO to a group** -1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. +1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. -2. Click the **Scope** tab. +2. Click the **Scope** tab. -3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. +3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. ![Example of UI](images/waas-wsus-fig13.png) @@ -252,29 +252,29 @@ For clients that should have their feature updates approved as soon as they’re **To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. -2. On the **Update Rules** tab, click **New Rule**. +2. On the **Update Rules** tab, click **New Rule**. -3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. +3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. ![Example of UI](images/waas-wsus-fig14.png) -4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. +4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. -5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. +5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. Windows 10 is under All Products\Microsoft\Windows. -6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. +6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. -7. Leave the deadline set for **7 days after the approval at 3:00 AM**. +7. Leave the deadline set for **7 days after the approval at 3:00 AM**. -8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. +8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. ![Example of UI](images/waas-wsus-fig15.png) -9. In the **Automatic Approvals** dialog box, click **OK**. +9. In the **Automatic Approvals** dialog box, click **OK**. >[!NOTE] >WSUS does not honor any existing month/week/day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. @@ -289,41 +289,41 @@ You can manually approve updates and set deadlines for installation within the W 1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. -2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. +2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. -3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. +3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. -4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. +4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. Windows 10 is under All Products\Microsoft\Windows. -5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. +5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. ![Example of UI](images/waas-wsus-fig16.png) Now that you have the All Windows 10 Upgrades view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. -2. Right-click the feature update you want to deploy, and then click **Approve**. +2. Right-click the feature update you want to deploy, and then click **Approve**. ![Example of UI](images/waas-wsus-fig17.png) -3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. +3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. ![Example of UI](images/waas-wsus-fig18.png) -4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. +4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. ![Example of UI](images/waas-wsus-fig19.png) -5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. +5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. If the deployment is successful, you should receive a successful progress report. ![Example of UI](images/waas-wsus-fig20.png) -6. In the **Approval Progress** dialog box, click **Close**. +6. In the **Approval Progress** dialog box, click **Close**.
diff --git a/windows/deployment/update/waas-morenews.md b/windows/deployment/update/waas-morenews.md index 2d91a632b5..454491e609 100644 --- a/windows/deployment/update/waas-morenews.md +++ b/windows/deployment/update/waas-morenews.md @@ -16,6 +16,8 @@ ms.topic: article Here's more news about [Windows as a service](windows-as-a-service.md): **Important**
Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Windows Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Windows Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Windows Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates are not shared with Windows Defender Application Guard.| |Allow users to trust files that open in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.

**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Windows Defender Application Guard.| + + diff --git a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md index 3792441270..7bd4873234 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md @@ -29,11 +29,11 @@ You can see how an employee would use standalone mode with Application Guard. 1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). -2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu. +2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu. ![New Application Guard window setting option](images/appguard-new-window.png) -3. Wait for Application Guard to set up the isolated environment. +3. Wait for Application Guard to set up the isolated environment. >[!NOTE] >Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays. @@ -108,13 +108,13 @@ You have the option to change each of these settings to work with your enterpris #### Copy and paste options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings**. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings**. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) -3. Choose how the clipboard works: +3. Choose how the clipboard works: - Copy and paste from the isolated session to the host PC @@ -122,7 +122,7 @@ You have the option to change each of these settings to work with your enterpris - Copy and paste both directions -4. Choose what can be copied: +4. Choose what can be copied: - **1.** Only text can be copied between the host PC and the isolated container. @@ -130,33 +130,33 @@ You have the option to change each of these settings to work with your enterpris - **3.** Both text and images can be copied between the host PC and the isolated container. -5. Click **OK**. +5. Click **OK**. #### Print options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard print** settings. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard print** settings. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Print options](images/appguard-gp-print.png) -3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. +3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. 4. Click **OK**. #### Data persistence options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) -3. Open Microsoft Edge and browse to an untrusted, but safe URL. +3. Open Microsoft Edge and browse to an untrusted, but safe URL. The website opens in the isolated session. -4. Add the site to your **Favorites** list and then close the isolated session. +4. Add the site to your **Favorites** list and then close the isolated session. 5. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -171,29 +171,29 @@ You have the option to change each of these settings to work with your enterpris #### Download options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow files to download and save to the host operating system from Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow files to download and save to the host operating system from Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Download options](images/appguard-gp-download.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Download a file from Windows Defender Application Guard. +4. Download a file from Windows Defender Application Guard. -5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. +5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. #### Hardware acceleration options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) -3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. +3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. -4. Assess the visual experience and battery performance. +4. Assess the visual experience and battery performance. **Applies to:** - Windows 10 Enterpise edition, version 1809 @@ -201,39 +201,39 @@ You have the option to change each of these settings to work with your enterpris #### File trust options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard** setting. -2. Click **Enabled**, set **Options** to 2, and click **OK**. +2. Click **Enabled**, set **Options** to 2, and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Open a file in Edge, such an Office 365 file. +4. Open a file in Edge, such an Office 365 file. -5. Check to see that an antivirus scan completed before the file was opened. +5. Check to see that an antivirus scan completed before the file was opened. #### Camera and microphone options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-camera-and-mic.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Open an application with video or audio capability in Edge. +4. Open an application with video or audio capability in Edge. -5. Check that the camera and microphone work as expected. +5. Check that the camera and microphone work as expected. #### Root certificate sharing options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device** setting. -2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. +2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-root-certificates.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. diff --git a/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md b/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md new file mode 100644 index 0000000000..7eed1f912d --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md @@ -0,0 +1,82 @@ +--- +title: Overview of Secure score in Windows Defender Security Center +description: Expand your visibility into the overall security posture of your organization +keywords: secure score, security controls, improvement opportunities, security score over time, score, posture, baseline +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 09/03/2018 +--- + +# Overview of Secure score in Windows Defender Security Center +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. + +>[!IMPORTANT] +> This feature is available for machines on Windows 10, version 1703 or later. + + +The **Secure score dashboard** displays a snapshot of: +- Microsoft secure score +- Secure score over time +- Top recommendations +- Improvement opportunities + + +![Secure score dashboard](images/new-secure-score-dashboard.png) + +## Microsoft secure score +The Microsoft secure score tile is reflective of the sum of all the Windows Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings. + +![Image of Microsoft secure score tile](images/mss.png) + +Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar). + +The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess). + +In the example image, the total points for the Windows security controls and Office 365 add up to 602 points. + +You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md). + +## Secure score over time +You can track the progression of your organizational security posture over time using this tile. It displays the overall score in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture. The expected update schedule for Secure Score is about 24 hours. In some cases, depending of the size of the organization, number of computers and other factors, this update can take up to 72 hours. + +![Image of the security score over time tile](images/new-ssot.png) + +You can mouse over specific date points to see the total score for that security control is on a specific date. + + +## Top recommendations +Reflects specific actions you can take to significantly increase the security stance of your organization and how many points will be added to the secure score if you take the recommended action. + +![Top recommendations tile](images/top-recommendations.png) + +## Improvement opportunities +Improve your score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control. + +Clicking on the affected machines link at the top of the table takes you to the Machines list. The list is filtered to reflect the list of machines where improvements can be made. + + + +![Improvement opportunities](images/io.png) + + +Within the tile, you can click on each control to see the recommended optimizations. + +Clicking the link under the Misconfigured machines column opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice. + +## Related topic +- [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [Threat analytics for Spectre and Meltdown](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 9d5715caa9..e78eb77ef5 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -114,6 +114,8 @@ This rule blocks the following file types from launching from email in Microsoft - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) SCCM name: Block executable content from email client and webmail @@ -126,6 +128,8 @@ This rule blocks Office apps from creating child processes. This includes Word, This is a typical malware behavior, especially malware that abuses Office as a vector, using VBA macros and exploit code to download and attempt to run additional payload. Some legitimate line-of-business applications might also use behaviors like this, including spawning a command prompt or using PowerShell to configure registry settings. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps launching child processes SCCM name: Block Office application from creating child processes @@ -138,6 +142,8 @@ This rule prevents Office apps, including Word, Excel, and PowerPoint, from crea This rule targets a typical behavior where malware uses Office as a vector to break out of Office and save malicious components to disk, where they persist and survive a computer reboot. This rule prevents malicious code from being written to disk. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps/macros creating executable content SCCM name: Block Office applications from creating executable content @@ -150,6 +156,8 @@ Attackers might attempt to use Office apps to migrate malicious code into other This rule applies to Word, Excel, and PowerPoint. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps injecting code into other processes (no exceptions) SCCM name: Block Office applications from injecting code into other processes @@ -165,6 +173,8 @@ Malware written in JavaScript or VBS often acts as a downloader to fetch and lau >[!IMPORTANT] >File and folder exclusions don't apply to this attack surface reduction rule. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: js/vbs executing payload downloaded from Internet (no exceptions) SCCM name: Block JavaScript or VBScript from launching downloaded executable content @@ -175,6 +185,8 @@ GUID: D3E037E1-3EB8-44C8-A917-57927947596D Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. This rule detects suspicious properties within an obfuscated script. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Obfuscated js/vbs/ps/macro code SCCM name: Block execution of potentially obfuscated scripts. @@ -185,6 +197,8 @@ GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Office VBA provides the ability to use Win32 API calls, which malicious code can abuse. Most organizations don't use this functionality, but might still rely on using other macro capabilities. This rule allows you to prevent using Win32 APIs in VBA macros, which reduces the attack surface. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Win32 imports from Office macro code SCCM name: Block Win32 API calls from Office macros @@ -205,6 +219,8 @@ This rule blocks the following file types from launching unless they either meet > >You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. SCCM name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria @@ -218,6 +234,8 @@ This rule provides an extra layer of protection against ransomware. It scans exe >[!NOTE] >You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Advanced ransomware protection SCCM name: Use advanced protection against ransomware @@ -230,6 +248,8 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i >[!NOTE] >In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. + +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 Intune name: Flag credential stealing from the Windows local security authority subsystem @@ -247,6 +267,8 @@ This rule blocks processes through PsExec and WMI commands from running, to prev >[!WARNING] >Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [System Center Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Process creation from PSExec and WMI commands SCCM name: Not applicable @@ -260,6 +282,8 @@ With this rule, admins can prevent unsigned or untrusted executable files from r - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Untrusted and unsigned processes that run from USB SCCM name: Block untrusted and unsigned processes that run from USB @@ -273,6 +297,8 @@ This rule prevents Outlook from creating child processes. It protects against so >[!NOTE] >This rule applies to Outlook and Outlook.com only. +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 + Intune name: Process creation from Office communication products (beta) SCCM name: Not yet available @@ -283,6 +309,8 @@ GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869 Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. This rule prevents attacks like this by blocking Adobe Reader from creating additional processes. +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 + Intune name: Process creation from Adobe Reader (beta) SCCM name: Not applicable diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index 6e52ff5447..1acfffd14f 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -105,7 +105,7 @@ An allowed application or service only has write access to a controlled folder a 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**. -3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** +3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** 4. Click **Add an allowed app** and follow the prompts to add apps. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md index 72894a0a5d..e3fd820ba9 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -50,7 +50,7 @@ You can [export these settings as an XML file](import-export-exploit-protection- 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: @@ -100,7 +100,7 @@ CFG will be enabled for *miles.exe*. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md index 3cd5fee197..0f4d7ee1dc 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -26,7 +26,7 @@ This can cause devices or software to malfunction and in rare cases may result i If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. >[!NOTE] ->HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*. +>HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*. AMD CPUs do not have MBE. >[!TIP] > "The Secure Kernel relies on the Mode-Based Execution Control (MBEC) feature, if present in hardware, which enhances the SLAT with a user/kernel executable bit, or the hypervisor’s software emulation of this feature, called Restricted User Mode (RUM)." Mark Russinovich and Alex Ionescu. Windows Internals 7th Edition book @@ -177,11 +177,14 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: -` Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` +`Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` > [!NOTE] > The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. +> [!NOTE] +> Mode Based Execution Control property will only be listed as available starting with Windows 10 version 1709. + The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. #### AvailableSecurityProperties @@ -275,9 +278,9 @@ C. If you experience a critical error during boot or your system is unstable aft ## How to turn off HVCI on the Windows 10 Fall Creators Update -1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. -2. Restart the device. -3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. +1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. +2. Restart the device. +3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. ## HVCI deployment in virtual machines diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md index 46cce510fa..61220879a8 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -44,7 +44,7 @@ You can set mitigations in audit mode for specific programs either by using the 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md index c9851d72d1..676188aa12 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -70,6 +70,9 @@ When you have configured exploit protection to your desired state (including bot Change `filename` to any name or location of your choosing. +Example command +**Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml** + > [!IMPORTANT] > When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location. @@ -91,6 +94,10 @@ After importing, the settings will be instantly applied and can be reviewed in t Change `filename` to the location and name of the exploit protection XML file. +Example command +**Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml** + + >[!IMPORTANT] > >Ensure you import a configuration file that is created specifically for exploit protection. You cannot directly import an EMET configuration file, you must convert it first. @@ -151,6 +158,7 @@ You can use Group Policy to deploy the configuration you've created to multiple - C:\MitigationSettings\Config.XML - \\\Server\Share\Config.xml - https://localhost:8080/Config.xml + - C:\ExploitConfigfile.xml 8. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md index 1e2192cfb7..8163dafe10 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md @@ -24,5 +24,6 @@ manager: dansimp Memory integrity is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Memory integrity helps block many types of malware from running on computers that run Windows 10 and Windows Server 2016. - +> [!NOTE] +> For more information, see [Device protection in Windows Defender Security Center](https://support.microsoft.com/help/4096339/windows-10-device-protection-in-windows-defender-security-center). diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md index 6f2ca8462f..63963825e3 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md @@ -130,7 +130,7 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Remove-All-SystemMitigations ``` -2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: +2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: ```xml diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md index 89c98507fe..dc0bab469f 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md @@ -20,7 +20,7 @@ manager: dansimp **Applies to** -- Windows 10, version 1709 and later +- Windows 10, version 1809 and above **Audience** @@ -54,13 +54,13 @@ This can only be done in Group Policy. >[!IMPORTANT] >### Requirements > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +>You must have Windows 10, version 1903. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > Notifications**. +5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below the path would be **Windows components > Windows Defender Security Center > Notifications** 6. Open the **Hide non-critical notifications** setting and set it to **Enabled**. Click **OK**. @@ -76,13 +76,13 @@ This can only be done in Group Policy. >[!IMPORTANT] >### Requirements > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +>You must have Windows 10, version 1903. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > Notifications**. +5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below the path would be **Windows components > Windows Defender Security Center > Notifications** 6. Open the **Hide all notifications** setting and set it to **Enabled**. Click **OK**. diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 12253adde3..027d92a3b4 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -57,6 +57,8 @@ When Windows Defender SmartScreen warns or blocks an employee from a website, it ## Viewing Windows event logs for SmartScreen SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer. +> [!NOTE] +> For information on how to use the Event Viewer, see [Windows Event Viewer](https://docs.microsoft.com/host-integration-server/core/windows-event-viewer1). |EventID | Description | | :---: | :---: | diff --git a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md index e1cacdb8c6..1a5d115e8a 100644 --- a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md @@ -93,7 +93,7 @@ All other endpoints that do not meet the previously stated criteria are consider **To configure a GPO that defines your intranet address space** -1. Open the Group Policy Management snap-in (gpmc.msc) and edit the Default Domain Policy. +1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. 2. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md index 60e0c1e82c..fe043e036b 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md @@ -43,7 +43,7 @@ Microsoft recommends using [the rings methodology](https://docs.microsoft.com/wi |-------------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Account Lockout | Account Lockout Duration | 15 | The number of minutes a locked-out account remains locked out before automatically becoming unlocked. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. | | Account Lockout | Account Lockout Threshold | 10 | The number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. | -| Account Lockout | Reset account lockout conter after | 15 | The number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. | +| Account Lockout | Reset account lockout counter after | 15 | The number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. | | Password Policy | Enforce password history | 24 | The number of unique new passwords that must be associated with a user account before an old password can be reused. | | Password Policy | Minimum password length | 14 | The least number of characters that a password for a user account may contain. | | Password Policy | Password must meet complexity requirements | Enabled | Determines whether passwords must meet complexity requirements:
1) Not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Neither check is case sensitive.
The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is less than three characters long, this check is skipped. The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed to not be included in the password. Tokens that are less than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password.
2) Contain characters from three of the following categories:
- Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
- Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
- Base 10 digits (0 through 9)
-Non-alphanumeric characters (special characters):
(~!@#$%^&*_-+=`\|\\(){}[]:;"'<>,.?/)
Currency symbols such as the Euro or British Pound are not counted as special characters for this policy setting.
- Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages. | diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md index fd0c3af5a7..824b53c0f6 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md @@ -40,7 +40,7 @@ This new security configuration framework, which we affectionately nickname the The security configuration framework divides configuration into Productivity Devices and Privileged Access Workstations. This document will focus on Productivity Devices (Levels 1, 2, and 3). -Microsoft’s current guidance on [Privileged Access Workstations](http://aka.ms/privsec) are part of the [Securing Privileged Access roadmap](http://aka.ms/privsec). +Microsoft’s current guidance on [Privileged Access Workstations](https://aka.ms/privsec) are part of the [Securing Privileged Access roadmap](https://aka.ms/privsec). Microsoft recommends reviewing and categorizing your devices, and then configuring them using the prescriptive guidance for that level. Level 1 should be considered the minimum baseline for an enterprise device, and Microsoft recommends increasing the protection based on both threat environment and risk appetite. diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index f71dfffeea..8c38cd61c8 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -73,9 +73,9 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 9. Enter a title and description to let us know what’s in the request. -10. Scroll to the bottom of the page, and make sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. +10. Scroll to the bottom of the page, and make sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. -11. Click **Create pull request** again to actually submit your edits. +11. Click **Create pull request** again to actually submit your edits. 12. If you aren't a Microsoft employee, you need to [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before updating or adding to any Microsoft repositories. A bot running in GitHub checks whether you've signed the CLA - if not, you'll be prompted, in the pull request, to sign it. diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 6c9a323ecd..43bca2f54c 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -5,6 +5,7 @@ ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 keywords: ["What's new in Windows 10", "Windows 10"] ms.prod: w10 author: greg-lindsay +manager: laurawi ms.localizationpriority: high ms.topic: article --- diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index c89b8110a0..d90f6985d2 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay +manager: laurawi ms.localizationpriority: low ms.topic: article --- @@ -46,4 +47,4 @@ For detailed information about Windows 10 servicing, see [Overview of Windows as ## See Also [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. \ No newline at end of file +[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 61b20e6870..bd6b7f1df1 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay +manager: laurawi ms.localizationpriority: high ms.topic: article ---