From 2bcb2c924de2e0669e0a404556cfae782b618da9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 30 May 2023 10:10:22 -0700 Subject: [PATCH 001/151] vbscript deprecation MAXADO-7954828 --- windows/whats-new/deprecated-features-resources.md | 6 +++++- windows/whats-new/deprecated-features.md | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index 330293213d..d059f17d61 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -21,11 +21,15 @@ appliesto: This article provides additional resources about [deprecated features for Windows client](deprecated-features.md) that may be needed by IT professionals. The following information is provided to help IT professionals plan for the removal of deprecated features: +## VBScript + +VBScript will be available as a [feature on demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before being fully retired in future Windows releases. Initially, the VBScript feature on demand will be preinstalled to allow for uninterrupted use while you prepare for the retirement of VBScript. + ## Microsoft Support Diagnostic Tool resources The [Microsoft Support Diagnostic Tool (MSDT)](/windows-server/administration/windows-commands/msdt) gathers diagnostic data for analysis by support professionals. MSDT is the engine used to run legacy Windows built-in troubleshooters. There are currently 28 built-in troubleshooters for MSDT. Half of the built-in troubleshooters have already been [redirected](#redirected-msdt-troubleshooters) to the Get Help platform, while the other half will be [retired](#retired-msdt-troubleshooters). -If you're using MSDT to run [custom troubleshooting packages](/previous-versions/windows/desktop/wintt/package-schema), it will be available as a [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before the tool is fully retired in 2025. This change will allow you to continue to use MSDT to run custom troubleshooting packages while transitioning to a new platform. [Contact Microsoft support](https://support.microsoft.com/contactus) for Windows if you require additional assistance. +If you're using MSDT to run [custom troubleshooting packages](/previous-versions/windows/desktop/wintt/package-schema), it will be available as a [feature on demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before the tool is fully retired in 2025. This change will allow you to continue to use MSDT to run custom troubleshooting packages while transitioning to a new platform. [Contact Microsoft support](https://support.microsoft.com/contactus) for Windows if you require additional assistance. ### Redirected MSDT troubleshooters diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 073c3bf2f2..ae2d404644 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,6 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | +| VBScript | VBScript is deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript) | **TBD** | | Microsoft Support Diagnostic Tool (MSDT) | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 | | Universal Windows Platform (UWP) Applications for 32-bit Arm | This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content is not applicable. If you are not sure which type of processor you have, check **Settings** > **System** > **About**.

Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 | | Update Compliance | [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service has been replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022| From 6fa3848a73ae96adcb4ee74a21074d809349e728 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 30 May 2023 10:16:58 -0700 Subject: [PATCH 002/151] vbscript deprecation MAXADO-7954828 --- windows/whats-new/deprecated-features-resources.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index d059f17d61..6383501d7e 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -29,11 +29,11 @@ VBScript will be available as a [feature on demand](/windows-hardware/manufactur The [Microsoft Support Diagnostic Tool (MSDT)](/windows-server/administration/windows-commands/msdt) gathers diagnostic data for analysis by support professionals. MSDT is the engine used to run legacy Windows built-in troubleshooters. There are currently 28 built-in troubleshooters for MSDT. Half of the built-in troubleshooters have already been [redirected](#redirected-msdt-troubleshooters) to the Get Help platform, while the other half will be [retired](#retired-msdt-troubleshooters). -If you're using MSDT to run [custom troubleshooting packages](/previous-versions/windows/desktop/wintt/package-schema), it will be available as a [feature on demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before the tool is fully retired in 2025. This change will allow you to continue to use MSDT to run custom troubleshooting packages while transitioning to a new platform. [Contact Microsoft support](https://support.microsoft.com/contactus) for Windows if you require additional assistance. +If you're using MSDT to run [custom troubleshooting packages](/previous-versions/windows/desktop/wintt/package-schema), it will be available as a [feature on demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) before the tool is fully retired in 2025. This change allows you to continue to use MSDT to run custom troubleshooting packages while transitioning to a new platform. [Contact Microsoft support](https://support.microsoft.com/contactus) for Windows if you require more assistance. ### Redirected MSDT troubleshooters -The following troubleshooters will automatically be redirected when you access them from **Start** > **Settings** > **System** > **Troubleshoot**: +The following troubleshooters are automatically redirected when you access them from **Start** > **Settings** > **System** > **Troubleshoot**: - Background Intelligent Transfer Service (BITS) - Bluetooth From 79effbe3a7d95dd7299acb06ba258e8e4ca8a21d Mon Sep 17 00:00:00 2001 From: educabanillas <142420277+educabanillas@users.noreply.github.com> Date: Wed, 20 Sep 2023 13:03:44 +0200 Subject: [PATCH 003/151] Update dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Wrong description of procedure. All DCOM permission are retired --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 81cfb68761..449f99f377 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it to Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. - *User-defined input* of the SDDL representation of the groups and privileges From 17ba5a339c2f417729a1958dc75a6b9b61d7ee83 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Tue, 26 Sep 2023 10:06:20 -0700 Subject: [PATCH 004/151] Updates to Win11 endpoints (enterprise) --- .../privacy/manage-windows-11-endpoints.md | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index ae9fabcf1a..0f6f954edc 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -7,7 +7,7 @@ ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown manager: laurawi -ms.date: 06/23/2023 +ms.date: 10/02/2023 ms.topic: reference --- @@ -54,6 +54,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps can't be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net| |Certificates|||[Learn how to turn off traffic to all of the following endpoint(s) for certificates.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| ||Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or isn't trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.

If automatic updates are turned off, applications and websites may stop working because they didn't receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. |TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| +|||HTTP|ocsp.digicert.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s) for Cortana and Live Tiles.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you'll block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| |||HTTPS|business.bing.com| @@ -66,6 +67,12 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||HTTP|dual-s-ring.msedge.net| |||HTTP|creativecdn.com| |||HTTP|edgeassetservice.azureedge.net| +|||HTTP|r.bing.com| +|||HTTPS|a-ring-fallback.msedge.net| +|||HTTPS|fp-afd-nocache-ccp.azureedge.net| +|||TLSv1.2|prod-azurecdn-akamai-iris.azureedge.net| +|||TLSv1.2|widgetcdn.azureedge.net| +|||TLSv1.2|widgetservice.azurefd.net| |Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s) for device authentication.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| ||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device won't be authenticated.|HTTPS|login.live.com*| |Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s) for device metadata.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| @@ -89,6 +96,13 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||HTTPS|weathermapdata.blob.core.windows.net| |Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s) for Microsoft account.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| ||The following endpoint is used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users can't sign in with Microsoft accounts. |TLSv1.2/HTTPS/HTTP|login.live.com| +|Microsoft Defender Antivirus|||[Learn how to turn off traffic to all of the following endpoint(s) for Microsoft Defender Antivirus.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +||The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device won't use Cloud-based Protection.|TLSv1.2/HTTPS|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications won't appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS/HTTP|checkappexec.microsoft.com| +|||TLSv1.2/HTTP|ping-edge.smartscreen.microsoft.com| +|||HTTP|data-edge.smartscreen.microsoft.com| +|||TLSv1.2|nav-edge.smartscreen.microsoft.com| |Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s) for Microsoft Edge.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| |||TLSv1.2/HTTP|edge.microsoft.com| |||TLSv1.2/HTTP|windows.msn.com| @@ -113,7 +127,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec ||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the internet, and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*| |||HTTP|ipv6.msftconnecttest.com| |Office|||[Learn how to turn off traffic to all of the following endpoint(s) for Office.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| -||The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.|HTTPS|www.office.com| +||The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.|HTTPS|www.office.com| |||HTTPS|blobs.officehome.msocdn.com| |||HTTPS|officehomeblobs.blob.core.windows.net| |||HTTPS|self.events.data.microsoft.com| @@ -121,6 +135,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||HTTP|officeclient.microsoft.com| |||HTTP|ecs.nel.measure.office.net| |||HTTPS/HTTP|telecommandstorageprod.blob.core.windows.net| +|||TLSv1.2|odc.officeapps.live.com| |OneDrive|||[Learn how to turn off traffic to all of the following endpoint(s) for OneDrive.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| ||The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.|TLSv1.2/HTTPS/HTTP|g.live.com| |||HTTP|onedrive.live.com| @@ -136,10 +151,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec ||The following endpoints are used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| |||HTTP|teams.live.com| |||TLSv1.2/HTTP|teams.events.data.microsoft.com| -|Microsoft Defender Antivirus|||[Learn how to turn off traffic to all of the following endpoint(s) for Microsoft Defender Antivirus.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| -||The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device won't use Cloud-based Protection.|HTTPS/TLSv1.2|wdcp.microsoft.com| -||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications won't appear.|HTTPS|*smartscreen-prod.microsoft.com| -|||HTTPS/HTTP|checkappexec.microsoft.com| +|||TLSv1.2|statics.teams.cdn.live.net| |Windows Spotlight|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Spotlight.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| ||The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips won't be downloaded. |TLSv1.2/HTTPS/HTTP|arc.msn.com| |||HTTPS|ris.api.iris.microsoft.com| @@ -150,6 +162,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||HTTP|srtb.msn.com| |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| +|||TLSv1.2|staticview.msn.com| |Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| @@ -160,9 +173,10 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec ||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint, and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|||[Learn how to turn off traffic to all of the following endpoint(s) for Xbox Live.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| -||The following endpoint is used for Xbox Live.|HTTPS|dlassets-ssl.xboxlive.com| +||The following endpoints are used for Xbox Live.|HTTPS|dlassets-ssl.xboxlive.com| +|||TLSv1.2|da.xboxservices.com| ## Related links - [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) -- [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) +- [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) From ff015289d1b54fae317a37d09c5f2f0fb04520de Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Tue, 26 Sep 2023 10:18:48 -0700 Subject: [PATCH 005/151] Fix protocol --- windows/privacy/manage-windows-11-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 0f6f954edc..4a0d826dfa 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -151,7 +151,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec ||The following endpoints are used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| |||HTTP|teams.live.com| |||TLSv1.2/HTTP|teams.events.data.microsoft.com| -|||TLSv1.2|statics.teams.cdn.live.net| +|||HTTP|statics.teams.cdn.live.net| |Windows Spotlight|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Spotlight.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| ||The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips won't be downloaded. |TLSv1.2/HTTPS/HTTP|arc.msn.com| |||HTTPS|ris.api.iris.microsoft.com| From ebc22ff43e6a978d3a3ac2f43b4e546a78fe7b50 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Fri, 29 Sep 2023 15:38:51 -0700 Subject: [PATCH 006/151] Learn Editor: Update best-practices-configuring.md --- .../best-practices-configuring.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index a61bf25eec..6b3171e2a1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -208,3 +208,34 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound ## Document your changes When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. + +## Configure Windows Firewall rules with WDAG tagging policies + +Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: + +**Step 1: Deploy WDAC AppId Tagging Policies** + +A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   + +Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  + +**Step 2: Configure Firewall Rules using PolicyAppId Tags**  + +- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. +You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. + +OR + +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  + +> [!NOTE] +> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  +> +> - Windows 10, versions 20H1 and above  + +> - Windows 11  + +> - Windows Server 2022 and above  + +> + From b5ca81edd4f369cf9295aaf0852e87c9e5236675 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:20:22 -0700 Subject: [PATCH 008/151] Update best-practices-configuring.md removed notes for editions --- .../windows-firewall/best-practices-configuring.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 6b3171e2a1..2f4aaaafc8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -228,14 +228,4 @@ OR - **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  -> [!NOTE] -> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  -> -> - Windows 10, versions 20H1 and above  - -> - Windows 11  - -> - Windows Server 2022 and above  - -> From 477d5ea2f7769124f0413f46fcbe90fb01a88563 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:29:38 -0700 Subject: [PATCH 009/151] Update best-practices-configuring.md url correction --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 2f4aaaafc8..cc0305632e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  From 090e7ae13bf9aff5fa085c7070f5cf91672bddc6 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:30:15 -0700 Subject: [PATCH 010/151] Update best-practices-configuring.md --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index cc0305632e..0eab04c64d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -209,7 +209,7 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. -## Configure Windows Firewall rules with WDAG tagging policies +## Configure Windows Firewall rules with WDAC tagging policies Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: From 5f9c49204cac04c88f968dba0e18bf032dcc69be Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 15:21:39 -0700 Subject: [PATCH 011/151] Add more endpoints --- windows/privacy/manage-windows-11-endpoints.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 4a0d826dfa..904fc1d8e9 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -7,7 +7,7 @@ ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown manager: laurawi -ms.date: 10/02/2023 +ms.date: 10/06/2023 ms.topic: reference --- @@ -78,6 +78,9 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s) for device metadata.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| ||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata won't be updated for the device.|HTTP|dmd.metaservices.microsoft.com| |Diagnostic Data| ||[Learn how to turn off traffic to all of the following endpoint(s) for diagnostic data.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2|functional.events.data.microsoft.com| +|||HTTP|browser.events.data.msn.com| +|||TLSv1.2/HTTP|www.microsoft.com| ||The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, won't be sent back to Microsoft.|TLSv1.2/HTTP|self.events.data.microsoft.com| |||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| ||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information won't be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| @@ -164,6 +167,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| |Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device won't be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| From 8007e34104d6039ccb6ed08a8b14bca69da15660 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 16:28:05 -0700 Subject: [PATCH 012/151] Updates to Windows 11 Pro table --- ...ws-11-endpoints-non-enterprise-editions.md | 103 ++++++++++++++---- 1 file changed, 82 insertions(+), 21 deletions(-) diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 35536d7efd..721a66781f 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -7,7 +7,7 @@ ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown manager: laurawi -ms.date: 12/17/2020 +ms.date: 10/05/2023 ms.topic: reference --- # Windows 11 connection endpoints for non-Enterprise editions @@ -21,11 +21,11 @@ In addition to the endpoints listed for [Windows 11 Enterprise](manage-windows-1 The following methodology was used to derive the network endpoints: 1. Set up the latest version of Windows 11 on a test virtual machine using the default settings. -2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +2. Leave the device(s) running idle for a week ("idle" means a user isn't interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +5. The test virtual machine(s) was logged into using a local account, and wasn't joined to a domain or Microsoft Entra ID. +6. All traffic was captured in our lab using an IPV4 network. Therefore, no IPV6 traffic is reported here. 7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. 8. These tests were conducted for one week. If you capture traffic for longer, you may have different results. @@ -49,7 +49,7 @@ The following methodology was used to derive the network endpoints: |Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| |Device Directory Service|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices.|HTTPS/HTTP|cs.dds.microsoft.com| |Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| -|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, won't be sent back to Microsoft.|TLSv1.2/HTTP|v10.events.data.microsoft.com| ||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| |Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| |Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| @@ -62,7 +62,7 @@ The following methodology was used to derive the network endpoints: |||HTTPS/HTTP|ecn.dev.virtualearth.net| |||HTTPS/HTTP|ssl.bing.com| |Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| -|Microsoft Edge| This network traffic is related to the Microsoft Edge browser. The Microsoft Edge browser requires these endpoint to contact external websites.|HTTPS/HTTP|edge.activity.windows.com
edge.microsoft.com| +|Microsoft Edge| This network traffic is related to the Microsoft Edge browser. The Microsoft Edge browser requires these endpoints to contact external websites.|HTTPS/HTTP|edge.activity.windows.com
edge.microsoft.com| |Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| |Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| ||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| @@ -119,53 +119,114 @@ The following methodology was used to derive the network endpoints: | **Area** | **Description** | **Protocol** | **Destination** | | --- | --- | --- | ---| | Activity Feed Service |The following endpoints are used by Activity Feed Service, which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|||HTTP|assets.activity.windows.com| |Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| ||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| ||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| |Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|||HTTP|ocsp.digicert.com| |Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||HTTPS|business.bing.com| +|||HTTP|c.bing.com| +|||HTTP|edgeassetservice.azureedge.net| +|||HTTP|fp.msedge.net| +|||HTTP|fp-vs.azureedge.net| +|||TLSv1.2|ln-ring.msedge.net| +|||TLSv1.2|prod-azurecdn-akamai-iris.azureedge.net| +|||HTTP|r.bing.com| +|||TLSv1.2/HTTP|s-ring.msedge.net| +|||HTTP|t-ring.msedge.net| +|||HTTP|t-ring-fdv2.msedge.net| +|||TLSv1.2|tse1.mm.bing.net| +|||TLSv1.2|widgetcdn.azureedge.net| +|||TLSv1.2|widgetservice.azurefd.net| |Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| |Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| -|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. |TLSv1.2/HTTP|v10.events.data.microsoft.com| +|Diagnostic data||HTTP|browser.events.data.msn.com| +|||TLSv1.2|functional.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, won't be sent back to Microsoft. |TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTP|self.events.data.microsoft.com| ||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|||TLSv1.2/HTTP|watson.events.data.microsoft.com| |Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| -|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing.|TLSv1.2/HTTPS/HTTP|*licensing.mp.microsoft.com| +|Location|The following endpoint is used for location data. If you turn off traffic for this endpoint, apps can't use location data.|TLSv1.2|inference.location.live.net| |Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|||HTTP|ecn-us.dev.virtualearth.net| |Microsoft Account|The following endpoints are used for Microsoft accounts to sign in. |TLSv1.2/HTTPS/HTTP|*login.live.com| |Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates. |HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|||TLSv1.2/HTTP|edge.microsoft.com| +|||HTTP|edge.nelreports.net| +|||TLSv1.2/HTTP|windows.msn.com| |Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +|||HTTP|img-s-msn-com.akamaized.net| ||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| ||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| ||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| |||HTTPS|storesdk.dsx.mp.microsoft.com| ||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +||The following endpoints are needed to load the content in the Microsoft Store app.|HTTP|storeedgefd.dsx.mp.microsoft.com| +|Microsoft To Do|The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.officeppe.com| +|||HTTP|staging.to-do.microsoft.com| +|||TLSv1.2/HTTP|to-do.microsoft.com| |Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| -|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||HTTP|ipv6.msftconnecttest.com| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS|blobs.officehome.msocdn.com| +|||TLSv1.2/HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2/HTTP|ecs.nel.measure.office.net| +|||TLSv1.2/HTTP|ocws.officeapps.live.com| +|||TLSv1.2/HTTP|odc.officeapps.live.com| |||TLSv1.2/HTTPS|office.com| -|||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| -|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| -|||HTTP/HTTPS|*.blob.core.windows.net| -|||TLSv1.2|self.events.data.microsoft.com| -|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| |||TLSv1.2/HTTPS/HTTP|officeclient.microsoft.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|||HTTP|roaming.officeapps.live.com| +|||TLSv1.2|self.events.data.microsoft.com| |||HTTPS/HTTP|substrate.office.com| -|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| -|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTP|tfl.nel.measure.office.net| +|OneDrive|The following endpoints are related to OneDrive.|HTTP|ams03pap005.storage.live.com| +|||HTTP|api.onedrive.com| +|||HTTPS|g.live.com| |||HTTPS/TLSv1.2|logincdn.msauth.net| -|||HTTPS/HTTP|windows.policies.live.net| -|||HTTPS/HTTP|*storage.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTP|onedrive.live.com| +|||HTTP|sat02pap005.storage.live.com| |||HTTPS/HTTP|*settings.live.net| +|||HTTP|skyapi.live.net| +|||HTTP|skydrivesync.policies.live.net| +|||HTTPS/HTTP|*storage.live.com| +|||HTTPS/HTTP|windows.policies.live.net| |Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| |||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| |Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| |||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|||HTTP|edge.skype.com| +|||HTTP|experimental-api.asm.skype.com| +|||HTTP|trouter-azsc-ukwe-0-b.trouter.skype.com| +|||HTTP|us-api.asm.skype.com| |Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| -|Microsoft Defender Antivirus|The following endpoints are used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com
wdcpalt.microsoft.com| +|||TLSv1.2/HTTP|teams.events.data.microsoft.com| +|||HTTP|teams.live.com| +|||HTTP|statics.teams.cdn.live.net| +|||HTTP|statics.teams.cdn.office.net| +|Microsoft Defender Antivirus|The following endpoints are used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +|||TLSv1.2/HTTPS|wdcpalt.microsoft.com| |||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| ||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| |||TLSv1.2/HTTP|checkappexec.microsoft.com| -|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*
ris.api.iris.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTP|api.msn.com| +|||TLSv1.2/HTTPS/HTTP|arc.msn.com| +|||TLSv1.2/HTTP|assets.msn.com| +|||HTTP|c.msn.com| +|||TLSv1.2/HTTP|fd.api.iris.microsoft.com| +|||HTTP|ntp.msn.com| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|||HTTP|srtb.msn.com| +|||TLSv1.2/HTTP|www.msn.com| +|Windows Update||TLSv1.2|definitionupdates.microsoft.com| |Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||TLSv1.2/HTTP|emdl.ws.microsoft.com| |||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| @@ -195,7 +256,7 @@ The following methodology was used to derive the network endpoints: |||TLSv1.2|odinvzc.azureedge.net| |||TLSv1.2|b-ring.msedge.net| |Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| -|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, won't be sent back to Microsoft.|TLSv1.2/HTTP|v10.events.data.microsoft.com| ||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| |Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| |Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| From 4d9837265ddbda861c61abe5376d6469e2b86dee Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 16:31:44 -0700 Subject: [PATCH 013/151] Update reference to AAD --- windows/privacy/manage-windows-11-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 904fc1d8e9..a56f1423b3 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -34,7 +34,7 @@ The following methodology was used to derive these network endpoints: 2. Leave the device(s) running idle for a week ("idle" means a user isn't interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine(s) was logged into using a local account, and wasn't joined to a domain or Azure Active Directory. +5. The test virtual machine(s) was logged into using a local account, and wasn't joined to a domain or Microsoft Entra ID. 6. All traffic was captured in our lab using an IPV4 network. Therefore, no IPV6 traffic is reported here. 7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. 8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. From b8959dd5983523569028cbf7b6b764858e7d7dc2 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 17:17:37 -0700 Subject: [PATCH 014/151] Various fixes --- ...ws-11-endpoints-non-enterprise-editions.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 721a66781f..c0911c2997 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -76,7 +76,7 @@ The following methodology was used to derive the network endpoints: |||TLSv1.2/HTTPS|office.com| |||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| |||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| -|||HTTP/HTTPS|*.blob.core.windows.net| +|||HTTPS/HTTP|*.blob.core.windows.net| |||TLSv1.2|self.events.data.microsoft.com| |||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| |||HTTP|roaming.officeapps.live.com| @@ -107,7 +107,7 @@ The following methodology was used to derive the network endpoints: ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| |||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| -||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS/HTTP|adl.windows.com| ||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|The following endpoints are used for Xbox Live.|TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| |||TLSv1.2/HTTPS|da.xboxservices.com| @@ -156,6 +156,11 @@ The following methodology was used to derive the network endpoints: |Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| |||HTTP|ecn-us.dev.virtualearth.net| |Microsoft Account|The following endpoints are used for Microsoft accounts to sign in. |TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Defender Antivirus|The following endpoints are used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +|||TLSv1.2/HTTPS|wdcpalt.microsoft.com| +|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| |Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates. |HTTPS/HTTP|msedge.api.cdp.microsoft.com| |||TLSv1.2/HTTP|edge.microsoft.com| |||HTTP|edge.nelreports.net| @@ -167,14 +172,14 @@ The following methodology was used to derive the network endpoints: ||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| |||HTTPS|storesdk.dsx.mp.microsoft.com| ||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| -||The following endpoints are needed to load the content in the Microsoft Store app.|HTTP|storeedgefd.dsx.mp.microsoft.com| +||The following endpoint is needed to load the content in the Microsoft Store app.|HTTP|storeedgefd.dsx.mp.microsoft.com| |Microsoft To Do|The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.officeppe.com| |||HTTP|staging.to-do.microsoft.com| |||TLSv1.2/HTTP|to-do.microsoft.com| |Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| |||HTTP|ipv6.msftconnecttest.com| |Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS|blobs.officehome.msocdn.com| -|||TLSv1.2/HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2/HTTPS/HTTP|*.blob.core.windows.net| |||TLSv1.2/HTTP|ecs.nel.measure.office.net| |||TLSv1.2/HTTP|ocws.officeapps.live.com| |||TLSv1.2/HTTP|odc.officeapps.live.com| @@ -212,11 +217,6 @@ The following methodology was used to derive the network endpoints: |||HTTP|teams.live.com| |||HTTP|statics.teams.cdn.live.net| |||HTTP|statics.teams.cdn.office.net| -|Microsoft Defender Antivirus|The following endpoints are used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| -|||TLSv1.2/HTTPS|wdcpalt.microsoft.com| -|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| -||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| -|||TLSv1.2/HTTP|checkappexec.microsoft.com| |Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTP|api.msn.com| |||TLSv1.2/HTTPS/HTTP|arc.msn.com| |||TLSv1.2/HTTP|assets.msn.com| @@ -227,13 +227,13 @@ The following methodology was used to derive the network endpoints: |||HTTP|srtb.msn.com| |||TLSv1.2/HTTP|www.msn.com| |Windows Update||TLSv1.2|definitionupdates.microsoft.com| -|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +||The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||TLSv1.2/HTTP|emdl.ws.microsoft.com| |||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| |||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| -||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS/HTTP|adl.windows.com| ||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|The following endpoints are used for Xbox Live.|TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| |||TLSv1.2/HTTPS|da.xboxservices.com| @@ -294,7 +294,7 @@ The following methodology was used to derive the network endpoints: ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| |||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| -||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS/HTTP|adl.windows.com| ||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|The following endpoints are used for Xbox Live.|TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| |||TLSv1.2/HTTPS|da.xboxservices.com| From 887733f62268959353bc567e34b30dcca12cf71a Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 17:17:56 -0700 Subject: [PATCH 015/151] Update ms.date --- windows/privacy/windows-11-endpoints-non-enterprise-editions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index c0911c2997..83e52054be 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -7,7 +7,7 @@ ms.localizationpriority: high author: DHB-MSFT ms.author: danbrown manager: laurawi -ms.date: 10/05/2023 +ms.date: 10/06/2023 ms.topic: reference --- # Windows 11 connection endpoints for non-Enterprise editions From 1e26596ab3d88be156e54e6c4139fbbeb74e5101 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Thu, 5 Oct 2023 17:27:01 -0700 Subject: [PATCH 016/151] Fix is/are issues --- ...ws-11-endpoints-non-enterprise-editions.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 83e52054be..c6aa96d54d 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -120,11 +120,11 @@ The following methodology was used to derive the network endpoints: | --- | --- | --- | ---| | Activity Feed Service |The following endpoints are used by Activity Feed Service, which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| |||HTTP|assets.activity.windows.com| -|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +|Apps|The following endpoint is used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| ||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| -||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +||The following endpoint is used for Spotify Live Tile.|HTTPS/HTTP|spclient.wg.spotify.com| +|Certificates|The following endpoints are used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| |||HTTP|ocsp.digicert.com| |Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| |||HTTPS|business.bing.com| @@ -150,22 +150,22 @@ The following methodology was used to derive the network endpoints: |||TLSv1.2/HTTP|self.events.data.microsoft.com| ||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| |||TLSv1.2/HTTP|watson.events.data.microsoft.com| -|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Font Streaming|The following endpoints is used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| |Licensing|The following endpoint is used for online activation and some app licensing.|TLSv1.2/HTTPS/HTTP|*licensing.mp.microsoft.com| |Location|The following endpoint is used for location data. If you turn off traffic for this endpoint, apps can't use location data.|TLSv1.2|inference.location.live.net| |Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| |||HTTP|ecn-us.dev.virtualearth.net| -|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in. |TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Account|The following endpoint is used for Microsoft accounts to sign in. |TLSv1.2/HTTPS/HTTP|*login.live.com| |Microsoft Defender Antivirus|The following endpoints are used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| |||TLSv1.2/HTTPS|wdcpalt.microsoft.com| -|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| -||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|HTTPS/HTTP|*.smartscreen-prod.microsoft.com| +|||TLSv1.2|*.smartscreen.microsoft.com| |||TLSv1.2/HTTP|checkappexec.microsoft.com| -|Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates. |HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft Edge|The following endpoints are used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates. |HTTPS/HTTP|msedge.api.cdp.microsoft.com| |||TLSv1.2/HTTP|edge.microsoft.com| |||HTTP|edge.nelreports.net| |||TLSv1.2/HTTP|windows.msn.com| -|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +|Microsoft Store|The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| |||HTTP|img-s-msn-com.akamaized.net| ||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| ||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| @@ -204,15 +204,15 @@ The following methodology was used to derive the network endpoints: |||HTTP|skydrivesync.policies.live.net| |||HTTPS/HTTP|*storage.live.com| |||HTTPS/HTTP|windows.policies.live.net| -|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|Settings|The following endpoints are used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| |||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| -|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|Skype|The following endpoints are used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| |||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| |||HTTP|edge.skype.com| |||HTTP|experimental-api.asm.skype.com| |||HTTP|trouter-azsc-ukwe-0-b.trouter.skype.com| |||HTTP|us-api.asm.skype.com| -|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Teams|The following endpoints are used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| |||TLSv1.2/HTTP|teams.events.data.microsoft.com| |||HTTP|teams.live.com| |||HTTP|statics.teams.cdn.live.net| @@ -227,12 +227,12 @@ The following methodology was used to derive the network endpoints: |||HTTP|srtb.msn.com| |||TLSv1.2/HTTP|www.msn.com| |Windows Update||TLSv1.2|definitionupdates.microsoft.com| -||The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||TLSv1.2/HTTP|emdl.ws.microsoft.com| |||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| |||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| -||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint enables connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| ||The following endpoint is used for compatibility database updates for Windows.|HTTPS/HTTP|adl.windows.com| ||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|The following endpoints are used for Xbox Live.|TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| From 31032b6cc302024d52b130f1a7bf1571ded162ea Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Fri, 6 Oct 2023 15:30:06 +0200 Subject: [PATCH 017/151] Update configure-the-windows-firewall-log.md Adding information on how to handle log file creation failures. This is a quite common issue with an easy solution. --- .../configure-the-windows-firewall-log.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 2912122082..87cb6b97d1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -41,5 +41,34 @@ To complete these procedures, you must be a member of the Domain Administrators 6. Click **OK** twice. +### Troubleshooting if the log file is not created or written to + +Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. + +Verify if mpssvc has FullControl on the folder and the files. +Open an elevated PowerShell and use these commands. Make sure to use the correct path. + +``` +$LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" +(Get-ACL -Path $LogPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize +``` +The output should show NT SERVICE\mpssvc having FullControl: +``` +IdentityReference FileSystemRights AccessControlType IsInherited InheritanceFlags +----------------- ---------------- ----------------- ----------- ---------------- +NT AUTHORITY\SYSTEM FullControl Allow False ObjectInherit +BUILTIN\Administrators FullControl Allow False ObjectInherit +NT SERVICE\mpssvc FullControl Allow False ObjectInherit +``` +If not, add FullControl permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. +``` +$LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" +$ACL = get-acl -Path $LogPath +$ACL.SetAccessRuleProtection($true, $false) +$RULE = New-Object System.Security.AccessControl.FileSystemAccessRule ("NT SERVICE\mpssvc","FullControl","ContainerInherit,ObjectInherit","None","Allow") +$ACL.AddAccessRule($RULE) +``` +Restart the Computer to restart the Windows Defender Firewall Service. + ### Troubleshooting Slow Log Ingestion If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. From 4db58d32e6981205ffa7c4bd04df49c181e3e468 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Fri, 6 Oct 2023 10:33:50 -0700 Subject: [PATCH 018/151] Remove ppe entry --- .../privacy/windows-11-endpoints-non-enterprise-editions.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index c6aa96d54d..483e61d221 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -173,8 +173,7 @@ The following methodology was used to derive the network endpoints: |||HTTPS|storesdk.dsx.mp.microsoft.com| ||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| ||The following endpoint is needed to load the content in the Microsoft Store app.|HTTP|storeedgefd.dsx.mp.microsoft.com| -|Microsoft To Do|The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.officeppe.com| -|||HTTP|staging.to-do.microsoft.com| +|Microsoft To Do|The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.microsoft.com| |||TLSv1.2/HTTP|to-do.microsoft.com| |Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| |||HTTP|ipv6.msftconnecttest.com| From d3b62511c42cdfdb2dbdd3b1f87b0c1647a09d02 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Fri, 6 Oct 2023 10:35:17 -0700 Subject: [PATCH 019/151] Remove ppe entry --- windows/privacy/manage-windows-11-endpoints.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index a56f1423b3..79bba0d70f 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -123,8 +123,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||HTTP|share.microsoft.com| ||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| |Microsoft To Do|||[Learn how to turn off traffic to all of the following endpoint(s) for Microsoft To Do.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| -||The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.officeppe.com| -|||HTTP|staging.to-do.microsoft.com| +||The following endpoints are used for the Microsoft To Do app.|HTTP|staging.to-do.microsoft.com| |||TLSv1.2/HTTP|to-do.microsoft.com| |Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s) for Network Connection Status Indicator (NCSI).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| ||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the internet, and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*| From aafa943dfc2e07eeafbeb3c1721250d6d6e791df Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 12:33:43 +0200 Subject: [PATCH 020/151] Update configure-the-windows-firewall-log.md Added a paragraph related to the folder creation issue. --- .../configure-the-windows-firewall-log.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 87cb6b97d1..5d7fd690df 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -43,7 +43,12 @@ To complete these procedures, you must be a member of the Domain Administrators ### Troubleshooting if the log file is not created or written to -Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. +Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. +If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. + +``` +New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall +``` Verify if mpssvc has FullControl on the folder and the files. Open an elevated PowerShell and use these commands. Make sure to use the correct path. @@ -70,5 +75,7 @@ $ACL.AddAccessRule($RULE) ``` Restart the Computer to restart the Windows Defender Firewall Service. + + ### Troubleshooting Slow Log Ingestion If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. From 87718f63599ae10f1509fe306283e2b31645943f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 9 Oct 2023 09:32:20 -0400 Subject: [PATCH 021/151] WHFB requirements table update --- .../hello-for-business/hello-identity-verification.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 510a0584ba..537fc88652 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -1,5 +1,5 @@ --- -ms.date: 07/05/2023 +ms.date: 10/09/2023 title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.topic: overview @@ -37,7 +37,7 @@ The table shows the minimum requirements for each deployment. For key trust in a | **Certificate Authority**| Not required |Any supported Windows Server versions | Any supported Windows Server versions | Any supported Windows Server versions | | **AD FS Version** | Not required | Not required | Any supported Windows Server versions | Any supported Windows Server versions | | **MFA Requirement** | Azure MFA, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | -| **Azure AD Connect** | Not required | Required | Required | Required | +| **Azure AD Connect** | Not required. It's recommended to use Microsoft Entra Connect cloud sync | Required | Required | Required | | **Azure AD License** | Azure AD Premium, optional | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional. Intune license required | ## On-premises Deployments From 2cf3cc7e1d9977df0fd4fdb13c782be88051f6fd Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:34:13 +0200 Subject: [PATCH 022/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 5d7fd690df..88935dbb98 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -41,7 +41,7 @@ To complete these procedures, you must be a member of the Domain Administrators 6. Click **OK** twice. -### Troubleshooting if the log file is not created or written to +### Troubleshooting if the log file is not created or modified Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. From f5f96e85787645e9ac79c2761595f49971e99248 Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:34:27 +0200 Subject: [PATCH 023/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 88935dbb98..7f6679dd97 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -46,7 +46,7 @@ To complete these procedures, you must be a member of the Domain Administrators Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. -``` +```PowerShell New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall ``` From 78b2e60ccae970c42eae1e1e8bfbe4fd6cdec8b1 Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:34:47 +0200 Subject: [PATCH 024/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 7f6679dd97..d875961d63 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -50,7 +50,7 @@ If firewall logging is configured via Group Policy only, it also can happen that New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall ``` -Verify if mpssvc has FullControl on the folder and the files. +Verify if MpsSvc has *FullControl* on the folder and the files. Open an elevated PowerShell and use these commands. Make sure to use the correct path. ``` From 164539542fd4585a42ef1bf8955903e1d367ed2c Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:35:04 +0200 Subject: [PATCH 025/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index d875961d63..0ade81bb0a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -51,7 +51,7 @@ New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall ``` Verify if MpsSvc has *FullControl* on the folder and the files. -Open an elevated PowerShell and use these commands. Make sure to use the correct path. +From an elevated PowerShell session, use the following commands, ensuring to use the correct path: ``` $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" From b578e93ceedb6582dbba9f0a0fbf3cc99d9153c4 Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:35:11 +0200 Subject: [PATCH 026/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 0ade81bb0a..1f55d3b115 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -53,7 +53,7 @@ New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall Verify if MpsSvc has *FullControl* on the folder and the files. From an elevated PowerShell session, use the following commands, ensuring to use the correct path: -``` +```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" (Get-ACL -Path $LogPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize ``` From ad72d997c3fd64ed604b1d8bfb51fd697703edbd Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:35:23 +0200 Subject: [PATCH 027/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 1f55d3b115..7e133b5be6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -58,7 +58,7 @@ $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" (Get-ACL -Path $LogPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize ``` The output should show NT SERVICE\mpssvc having FullControl: -``` +```PowerShell IdentityReference FileSystemRights AccessControlType IsInherited InheritanceFlags ----------------- ---------------- ----------------- ----------- ---------------- NT AUTHORITY\SYSTEM FullControl Allow False ObjectInherit From 84b9178eaf6fbbbf3d941e5aa1c18e3358b8f2d4 Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:35:32 +0200 Subject: [PATCH 028/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 7e133b5be6..08afe5621e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -66,7 +66,7 @@ BUILTIN\Administrators FullControl Allow False ObjectI NT SERVICE\mpssvc FullControl Allow False ObjectInherit ``` If not, add FullControl permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. -``` +```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" $ACL = get-acl -Path $LogPath $ACL.SetAccessRuleProtection($true, $false) From 96fa42474b5aede18365240f7fca7e50c6c59f9f Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:35:48 +0200 Subject: [PATCH 029/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 08afe5621e..02ace74c40 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -57,7 +57,7 @@ From an elevated PowerShell session, use the following commands, ensuring to use $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" (Get-ACL -Path $LogPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize ``` -The output should show NT SERVICE\mpssvc having FullControl: +The output should show `NT SERVICE\mpssvc` having *FullControl*: ```PowerShell IdentityReference FileSystemRights AccessControlType IsInherited InheritanceFlags ----------------- ---------------- ----------------- ----------- ---------------- From 7709fcf3b57727addbabc0236dc7772c965f2658 Mon Sep 17 00:00:00 2001 From: msarcletti <56821677+msarcletti@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:36:01 +0200 Subject: [PATCH 030/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 02ace74c40..9abc0d4784 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -73,7 +73,7 @@ $ACL.SetAccessRuleProtection($true, $false) $RULE = New-Object System.Security.AccessControl.FileSystemAccessRule ("NT SERVICE\mpssvc","FullControl","ContainerInherit,ObjectInherit","None","Allow") $ACL.AddAccessRule($RULE) ``` -Restart the Computer to restart the Windows Defender Firewall Service. +Restart the device to restart the Windows Defender Firewall Service. From 3d516fb0e3f35da7c2461e6ff7bf37fbf178caf8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 9 Oct 2023 09:51:35 -0400 Subject: [PATCH 031/151] WHFB requirements table update --- .../hello-for-business/hello-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 537fc88652..663d6662dc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -37,7 +37,7 @@ The table shows the minimum requirements for each deployment. For key trust in a | **Certificate Authority**| Not required |Any supported Windows Server versions | Any supported Windows Server versions | Any supported Windows Server versions | | **AD FS Version** | Not required | Not required | Any supported Windows Server versions | Any supported Windows Server versions | | **MFA Requirement** | Azure MFA, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | -| **Azure AD Connect** | Not required. It's recommended to use Microsoft Entra Connect cloud sync | Required | Required | Required | +| **Azure AD Connect** | Not required. It's recommended to use [Microsoft Entra Connect cloud sync](/azure/active-directory/hybrid/cloud-sync/what-is-cloud-sync) | Required | Required | Required | | **Azure AD License** | Azure AD Premium, optional | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional. Intune license required | ## On-premises Deployments From a1e5ab3d70a032aa8f5f992c04a0dcd20e156169 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 9 Oct 2023 10:01:55 -0400 Subject: [PATCH 032/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md --- .../windows-firewall/configure-the-windows-firewall-log.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 9abc0d4784..bb5da1d87c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -43,7 +43,12 @@ To complete these procedures, you must be a member of the Domain Administrators ### Troubleshooting if the log file is not created or modified -Sometimes the log files are not created or no events are written the log files. This can be related to missing permissions for the Windows Defender Firewall Service (mpssvc) on the folder or the logfiles themselves. It can happen if you want to store the log files in a different folder or the permissions were removed or have not been set automatically. +Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition may occur include: + +- missing permissions for the Windows Defender Firewall Service (MpsSvc) on the folder or on the log files +- you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically +- if firewall logging is configured via Group Policy only, it can happen that the log folder isn't created in the default location `%windir%\System32\LogFiles\firewall` +- if a custom path to a non-existent folder is configured via Group Policy. In this case, you must create the folder manually or via script, and add the permissions for MpsSvc If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. ```PowerShell From 8c46a4a0681bfaad5994095a66910d1f27a99835 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 9 Oct 2023 10:08:13 -0400 Subject: [PATCH 033/151] Update configure-the-windows-firewall-log.md --- .../configure-the-windows-firewall-log.md | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index bb5da1d87c..b6d0f091f4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -41,14 +41,17 @@ To complete these procedures, you must be a member of the Domain Administrators 6. Click **OK** twice. -### Troubleshooting if the log file is not created or modified +### Troubleshoot if the log file is not created or modified Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition may occur include: - missing permissions for the Windows Defender Firewall Service (MpsSvc) on the folder or on the log files - you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically -- if firewall logging is configured via Group Policy only, it can happen that the log folder isn't created in the default location `%windir%\System32\LogFiles\firewall` -- if a custom path to a non-existent folder is configured via Group Policy. In this case, you must create the folder manually or via script, and add the permissions for MpsSvc +- if firewall logging is configured via policy settings, it can happen that + - the log folder in the default location `%windir%\System32\LogFiles\firewall` doesn't exist + - the log folder in a custom path doesn't exist + In both cases, you must create the folder manually or via script, and add the permissions for MpsSvc + If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. ```PowerShell @@ -62,7 +65,9 @@ From an elevated PowerShell session, use the following commands, ensuring to use $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" (Get-ACL -Path $LogPath).Access | Format-Table IdentityReference,FileSystemRights,AccessControlType,IsInherited,InheritanceFlags -AutoSize ``` + The output should show `NT SERVICE\mpssvc` having *FullControl*: + ```PowerShell IdentityReference FileSystemRights AccessControlType IsInherited InheritanceFlags ----------------- ---------------- ----------------- ----------- ---------------- @@ -70,7 +75,9 @@ NT AUTHORITY\SYSTEM FullControl Allow False ObjectI BUILTIN\Administrators FullControl Allow False ObjectInherit NT SERVICE\mpssvc FullControl Allow False ObjectInherit ``` -If not, add FullControl permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. + +If not, add *FullControl* permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. + ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" $ACL = get-acl -Path $LogPath @@ -78,9 +85,9 @@ $ACL.SetAccessRuleProtection($true, $false) $RULE = New-Object System.Security.AccessControl.FileSystemAccessRule ("NT SERVICE\mpssvc","FullControl","ContainerInherit,ObjectInherit","None","Allow") $ACL.AddAccessRule($RULE) ``` + Restart the device to restart the Windows Defender Firewall Service. +### Troubleshoot Slow Log Ingestion - -### Troubleshooting Slow Log Ingestion If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. From 1ecd193386af9e7d5ceade788ebdf4393bbed5c0 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Mon, 9 Oct 2023 10:23:34 -0500 Subject: [PATCH 034/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index b6d0f091f4..daa952247d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -52,7 +52,7 @@ Sometimes the Windows Firewall log files aren't created, or the events aren't wr - the log folder in a custom path doesn't exist In both cases, you must create the folder manually or via script, and add the permissions for MpsSvc -If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existant folder is configered via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. +If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existent folder is configured via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. ```PowerShell New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall From 9131ec75f49abafee75aaba363ff8dad2ddee5db Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Mon, 9 Oct 2023 10:26:13 -0500 Subject: [PATCH 035/151] Update windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md --- .../windows-firewall/configure-the-windows-firewall-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index daa952247d..49182f30f0 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -43,7 +43,7 @@ To complete these procedures, you must be a member of the Domain Administrators ### Troubleshoot if the log file is not created or modified -Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition may occur include: +Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition might occur include: - missing permissions for the Windows Defender Firewall Service (MpsSvc) on the folder or on the log files - you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically From d1a29a220b00f0bfe67720917946ed9d0cfd765b Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Mon, 9 Oct 2023 10:39:07 -0500 Subject: [PATCH 036/151] Update configure-the-windows-firewall-log.md --- .../configure-the-windows-firewall-log.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 49182f30f0..e60bc7b3ec 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -29,17 +29,18 @@ To complete these procedures, you must be a member of the Domain Administrators 3. The default path for the log is **%windir%\\system32\\logfiles\\firewall\\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location. - >**Important:**  The location you specify must have permissions assigned that permit the Windows Defender Firewall service to write to the log file. + > [!IMPORTANT] + > The location you specify must have permissions assigned that permit the Windows Defender Firewall service to write to the log file. - 4. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. + 5. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. - 5. No logging occurs until you set one of following two options: + 6. No logging occurs until you set one of following two options: - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes**. - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes**. - 6. Click **OK** twice. + 7. Click **OK** twice. ### Troubleshoot if the log file is not created or modified From 42e3d2c8bbc582514b34748b123f1980e5e09d9a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 08:40:45 -0700 Subject: [PATCH 037/151] update date --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index d3ef319ee9..9ad7dcd065 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript) | September 2023 | +| VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript) | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| From 7ffebc3e06e335b7c4eddf54404df161ebd1c1ac Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 08:41:27 -0700 Subject: [PATCH 038/151] update date --- windows/whats-new/deprecated-features-resources.md | 2 +- windows/whats-new/deprecated-features.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index 9919114fdb..6b07079c0f 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -1,7 +1,7 @@ --- title: Resources for deprecated features in the Windows client description: Resources and details for deprecated features in the Windows client. -ms.date: 09/23/2023 +ms.date: 10/09/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 9ad7dcd065..b1d6876954 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 09/23/2023 +ms.date: 10/09/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium From cf4bf0ae8f69caf5a884d55658be710493c85c65 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 08:46:36 -0700 Subject: [PATCH 039/151] edit --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index b1d6876954..881e004c0c 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript) | October 2023 | +| VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| From aea218d4688a779bbc2954524e98484788417b50 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 11:59:25 -0700 Subject: [PATCH 040/151] comdeadline-change-6837290 --- windows/deployment/update/waas-restart.md | 2 +- .../deployment/update/waas-wufb-csp-mdm.md | 7 ++-- .../update/waas-wufb-group-policy.md | 2 +- .../update/wufb-compliancedeadlines.md | 40 +++++++++++++++---- 4 files changed, 38 insertions(+), 13 deletions(-) diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 007852b8af..18b0aa011f 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -14,7 +14,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 12/31/2017 +ms.date: 10/10/2023 --- # Manage device restarts after updates diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index 3d79d66cd5..e65bab8900 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 02/28/2023 +ms.date: 10/10/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business @@ -39,7 +39,7 @@ You can control when updates are applied, for example by deferring when an updat Both feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device. -To enable Microsoft Updates, use [Update/AllwMUUpdateService](/windows/client-management/mdm/policy-csp-update#update-allowmuupdateservice). +To enable Microsoft Updates, use [Update/AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update#update-allowmuupdateservice). Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to be updated on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use Update/[ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#update-excludewudriversinqualityupdate). @@ -136,7 +136,8 @@ We recommend that you use set specific deadlines for feature and quality updates - [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates) - [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates) - [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot) These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardless of active hours. diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 7c431a1818..372a36d6df 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -17,7 +17,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 08/22/2023 +ms.date: 10/10/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index e29c2d0a8e..c0090ec092 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -12,36 +12,60 @@ manager: aaroncz appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 05/12/2023 +ms.date: 10/10/2023 --- # Enforcing compliance deadlines for updates Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions. -With a current version, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and later: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings: +With a current version, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and later: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as separate settings: - Update/ConfigureDeadlineForFeatureUpdates - Update/ConfigureDeadlineForQualityUpdates - Update/ConfigureDeadlineGracePeriod +- Update/ConfigureDeadlineGracePeriodForFeatureUpdates (Windows 11, version 22H2 or later) - Update/ConfigureDeadlineNoAutoReboot -## Policy setting overview + +## Policy setting overview for clients running Windows 11, version 22H2 and later + +|Policy| Description | +|-|-| +| Specify deadlines for automatic updates and restarts | This policy lets you specify the number of days before quality and feature updates are installed on devices automatically, and a grace period, after which required restarts occur automatically. This policy includes an option to opt out of automatic restarts until the end of the grace period is reached. | + +### Suggested configurations for clients running Windows 11, version 22H2 and later + +| Policy | Location | Quality updates deadline in days | Quality updates grace period in days | Feature updates deadline in days | Feature updates grace period in days | +|-|-|-|-|-|-| +| Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 2 | 2 | 2 | + +When **Specify deadlines for automatic updates and restarts** is set: + +The deadline calculation for both quality and feature updates is based off the time the client's update scan initially discovered the update. Previously, the deadline was based off the release date of the update for quality updates and the reboot pending date for feature updates. The change for deadline calculation was made to improve the predictability of restart. + +The grace period for both quality and feature updates starts its countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, users are able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) + +> [!NOTE] +> When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored. + +## Policy setting overview for clients running Windows 11, version 21H2 and earlier |Policy|Description | |-|-| | (Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | This policy includes a deadline and a configurable grace period with the option to opt out of automatic restarts until the deadline is reached. This is the recommended policy for Windows 10, version 1709 and later.| -## Suggested configurations +### Suggested configurations for clients running Windows 11, version 21H2 and earlier |Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| |-|-|-|-|-| -|(Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 2 | 2 | 5 | +|(Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 2 | 2 | 5 | When **Specify deadlines for automatic updates and restarts** is set (Windows 10, version 1709 and later): -For feature updates, the deadline and grace period start their countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, the device will try to update outside of active hours. Once the *effective deadline* is reached, the device will try to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) +For feature updates, the deadline and grace period start their countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, the device tries to update outside of active hours. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) -For quality updates, the deadline countdown starts from the time the update is *offered* (not downloaded or installed). The grace period countdown starts from the time of the pending restart. The device will try to download and install the update at a time based on your other download and installation policies (the default is to automatically download and install in in the background). When the pending restart time is reached, the device will notify the user and try to update outside of active hours. Once the effective deadline is reached, the device will try to restart during active hours. +For quality updates, the deadline countdown starts from the time the update is *offered* (not downloaded or installed). The grace period countdown starts from the time of the pending restart. The device tries to download and install the update at a time based on your other download and installation policies (the default is to automatically download and install in the background). When the pending restart time is reached, the device notifies the user and tries to update outside of active hours. Once the effective deadline is reached, the device tries to restart during active hours. > [!NOTE] -> When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored. +> - When using the newer policy that contains **Feature updates grace period in days**, this setting is ignored by clients that are running Windows 11 version 21H2 and earlier. The grace period for quality updates is used for both quality updates and feature updates for these clients. +> - When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored. From d94e5ba99cd4174a1bf21ebba430c0e29c800fa9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 12:04:02 -0700 Subject: [PATCH 041/151] comdeadline-change-6837290 --- windows/deployment/update/wufb-compliancedeadlines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index c0090ec092..af934a8942 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -43,7 +43,7 @@ When **Specify deadlines for automatic updates and restarts** is set: The deadline calculation for both quality and feature updates is based off the time the client's update scan initially discovered the update. Previously, the deadline was based off the release date of the update for quality updates and the reboot pending date for feature updates. The change for deadline calculation was made to improve the predictability of restart. -The grace period for both quality and feature updates starts its countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, users are able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) +The grace period for both quality and feature updates starts its countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, users are able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) Grace periods are useful for users who may be coming back from vacation, or other extended time away from their device, to ensure a forced reboot doesn't occur immediately after they return. > [!NOTE] > When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored. From 0fe2925eb915cac702a02af7ca7ba178f2ba0197 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 12:29:28 -0700 Subject: [PATCH 042/151] comdeadline-change-6837290 --- windows/deployment/update/wufb-compliancedeadlines.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index af934a8942..f2c57cfa7d 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -20,11 +20,11 @@ Deploying feature or quality updates for many organizations is only part of the With a current version, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and later: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as separate settings: -- Update/ConfigureDeadlineForFeatureUpdates -- Update/ConfigureDeadlineForQualityUpdates -- Update/ConfigureDeadlineGracePeriod -- Update/ConfigureDeadlineGracePeriodForFeatureUpdates (Windows 11, version 22H2 or later) -- Update/ConfigureDeadlineNoAutoReboot +- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates) (Windows 11, version 22H2 or later) +- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot) ## Policy setting overview for clients running Windows 11, version 22H2 and later From 58d335fa74af306f3ff754e11d2c57327bc71b29 Mon Sep 17 00:00:00 2001 From: Deepak-EDU <140197022+Deepak-EDU@users.noreply.github.com> Date: Mon, 9 Oct 2023 14:59:31 -0700 Subject: [PATCH 043/151] Update windows-11-se-overview.md --- education/windows/windows-11-se-overview.md | 49 ++++++++++++++------- 1 file changed, 32 insertions(+), 17 deletions(-) diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index e484296ed5..85683ac20e 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -86,10 +86,13 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Absolute Software Endpoint Agent` | 7.20.0.1 | `Win32` | `Absolute Software Corporation` | | `AirSecure` | 8.0.0 | `Win32` | `AIR` | | `Alertus Desktop` | 5.4.48.0 | `Win32` | `Alertus technologies` | +| `AristotleK12 Borderless Classroom ` | 3.0.11. | `Win32` | `Sergeant Laboratories` | +| `AristotleK12 Analytics ` | 10.0.6 | `Win32` | `Sergeant Laboratories` | +| `AristotleK12 Network filter` | 3.1.10 | `Win32` | `Sergeant Laboratories` | | `Brave Browser` | 106.0.5249.119 | `Win32` | `Brave` | | `Bulb Digital Portfolio` | 0.0.7.0 | `Store` | `Bulb` | -| `CA Secure Browser` | 14.0.0 | `Win32` | `Cambium Development` | -| `Cisco Umbrella` | 3.0.343.0 | `Win32` | `Cisco` | +| `CA Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | +| `Cisco Umbrella` | 3.0.466.0 | `Win32` | `Cisco` | | `CKAuthenticator` | 3.6+ | `Win32` | `ContentKeeper` | | `Class Policy` | 116.0.0 | `Win32` | `Class Policy` | | `Classroom.cloud` | 1.40.0004 | `Win32` | `NetSupport` | @@ -97,7 +100,8 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `CoGat Secure Browser` | 11.0.0.19 | `Win32` | `Riverside Insights` | | `ColorVeil` | 4.0.0.175 | `Win32` | `East-Tec` | | `ContentKeeper Cloud` | 9.01.45 | `Win32` | `ContentKeeper Technologies` | -| `DigiExam` | 14.0.6 | `Win32` | `Digiexam` | +| `DigiExam` | 14.1.0 | `Win32` | `Digiexam` | +| `Digital Secure testing browser` | 15.0.0 | `Win32` | `Digiexam` | | `Dragon Professional Individual` | 15.00.100 | `Win32` | `Nuance Communications` | | `DRC INSIGHT Online Assessments` | 13.0.0.0 | `Store` | `Data recognition Corporation` | | `Duo from Cisco` | 3.0.0 | `Win32` | `Cisco` | @@ -106,6 +110,8 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `EasyReader` | 10.0.4.498 | `Win32` | `Dolphin Computer Access` | | `Easysense 2` | 1.32.0001 | `Win32` | `Data Harvest` | | `Epson iProjection` | 3.31 | `Win32` | `Epson` | +| `ESET Endpoint Security` | 10.1.2046.0 | `Win32` | `ESET` | +| `ESET Remote Administrator Agent` | 10.0.1126.0 | `Win32` | `ESET` | | `eTests` | 4.0.25 | `Win32` | `CASAS` | | `Exam Writepad` | 23.2.4.2338 | `Win32` | `Sheldnet` | | `FirstVoices Keyboard` | 15.0.270 | `Win32` | `SIL International` | @@ -117,22 +123,26 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `GuideConnect` | 1.24 | `Win32` | `Dolphin Computer Access` | | `Illuminate Lockdown Browser` | 2.0.5 | `Win32` | `Illuminate Education` | | `Immunet` | 7.5.8.21178 | `Win32` | `Immunet` | -| `Impero Backdrop Client` | 5.0.87 | `Win32` | `Impero Software` | +| `Impero Backdrop Client` | 5.0.151 | `Win32` | `Impero Software` | | `IMT Lazarus` | 2.86.0 | `Win32` | `IMTLazarus` | | `Inspiration 10` | 10.11 | `Win32` | `TechEdology Ltd` | | `JAWS for Windows` | 2022.2112.24 | `Win32` | `Freedom Scientific` | | `Kite Student Portal` | 9.0.0.0 | `Win32` | `Dynamic Learning Maps` | -| `Keyman` | 16.0.138 | `Win32` | `SIL International` | +| `Keyman` | 16.0.141 | `Win32` | `SIL International` | | `Kortext` | 2.3.433.0 | `Store` | `Kortext` | | `Kurzweil 3000 Assistive Learning` | 20.13.0000 | `Win32` | `Kurzweil Educational Systems` | | `LanSchool Classic` | 9.1.0.46 | `Win32` | `Stoneware, Inc.` | | `LanSchool Air` | 2.0.13312 | `Win32` | `Stoneware, Inc.` | +| `Lexibar` | 3.07.02 | `Win32` | `Lexibar` | +| `LGfL HomeProtect` | 8.3.44.11 | `Win32` | `LGFL` | | `Lightspeed Smart Agent` | 1.9.1 | `Win32` | `Lightspeed Systems` | | `Lightspeed Filter Agent` | 2.3.4 | `Win32` | `Lightspeed Systems` | -| `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | -| `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | -| `Mozilla Firefox` | 105.0.0 | `Win32` | `Mozilla` | -| `Mobile Plans` | 5.1911.3171.0 | `Store` | `Microsoft Corporation` | +| `Lightspeed Digital` | 3.12.3.11 | `Win32` | `Lightspeed Systems` | +| `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | +| `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | +| `Mozilla Firefox` | 116.0.2 | `Win32` | `Mozilla` | +| `Mobile Plans` | 5.1911.3171.0 | `Store` | `Microsoft Corporation` | +| `Musescore` | 4.1.1.232071203 | `Win32` | `Musescore` | | `NAPLAN` | 5.2.2 | `Win32` | `NAP` | | `Netref Student` | 23.1.0 | `Win32` | `NetRef` | | `NetSupport DNA` | 4.80.0000 | `Win32` | `NetSupport` | @@ -140,21 +150,23 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `NetSupport Notify` | 5.10.1.223 | `Win32` | `NetSupport` | | `NetSupport School` | 14.00.0012 | `Win32` | `NetSupport` | | `NextUp Talker` | 1.0.49 | `Win32` | `NextUp Technologies` | -| `NonVisual Desktop Access` | 2021.3.1 | `Win32` | `NV Access` | +| `Netsweeper Workstation Agent` | 4.50.54.54 | `Win32` | `Netsweeper` | +| `NonVisual Desktop Access` | 2023.1. | `Win32` | `NV Access` | | `NWEA Secure Testing Browser` | 5.4.387.0 | `Win32` | `NWEA` | | `PC Talker Neo` | 2209 | `Win32` | `Kochi System Development` | | `PC Talker Neo Plus` | 2209 | `Win32` | `Kochi System Development` | | `PaperCut` | 22.0.6 | `Win32` | `PaperCut Software International Pty Ltd` | -| `Pearson TestNav` | 1.11.3 | `Store` | `Pearson` | -| `Project Monarch Outlook` | 1.2022.2250001 | `Store` | `Microsoft` | +| `Pearson TestNav` | 1.11.3 | `Store` | `Pearson` | +| `Project Monarch Outlook` | 1.2023.831.400 | `Store` | `Microsoft` | | `Questar Secure Browser` | 5.0.1.456 | `Win32` | `Questar, Inc` | -| `ReadAndWriteForWindows` | 12.0.74 | `Win32` | `Texthelp Ltd.` | -| `Remote Desktop client (MSRDC)` | 1.2.4240.0 | `Win32` | `Microsoft` | +| `ReadAndWriteForWindows` | 12.0.78 | `Win32` | `Texthelp Ltd.` | +| `Remote Desktop client (MSRDC)` | 1.2.4487.0 | `Win32` | `Microsoft` | | `Remote Help` | 4.0.1.13 | `Win32` | `Microsoft` | | `Respondus Lockdown Browser` | 2.0.9.03 | `Win32` | `Respondus` | | `Safe Exam Browser` | 3.5.0.544 | `Win32` | `Safe Exam Browser` | -|`SchoolYear` | 3.4.21 | `Win32` |`SchoolYear` | +|`SchoolYear` | 3.5.4 | `Win32` |`SchoolYear` | |`School Manager` | 3.6.8.1109 | `Win32` |`School Manager` | +|`Scratch` | 3.0 | `Win32` |`MIT` | | `Senso.Cloud` | 2021.11.15.0 | `Win32` | `Senso.Cloud` | | `Skoolnext` | 2.19 | `Win32` | `Skool.net` | | `Smoothwall Monitor` | 2.9.2 | `Win32` | `Smoothwall Ltd` | @@ -162,11 +174,14 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `SuperNova Magnifier & Speech` | 21.03 | `Win32` | `Dolphin Computer Access` | |`TX Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | | `VitalSourceBookShelf` | 10.2.26.0 | `Win32` | `VitalSource Technologies Inc` | +|`WA Secure Browser` | 16.0.0 | `Win32` | `Cambium Development` | | `Winbird` | 19 | `Win32` | `Winbird Co., Ltd.` | | `WordQ` | 5.4.29 | `Win32` | `WordQ` | +| `Windows SEB` | 3.4.0 | `Win32` | `Illinois Stateboard of Education` | +| `Windows Notepad` | 12.0.78 | `Store` | `Microsoft Corporation` | | `Zoom` | 5.12.8 (10232) | `Win32` | `Zoom` | -| `ZoomText Fusion` | 2023.2303.77.400 | `Win32` | `Freedom Scientific` | -| `ZoomText Magnifier/Reader` | 2023.2303.33.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Fusion` | 2023.2307.7.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Magnifier/Reader` | 2023.2307.29.400 | `Win32` | `Freedom Scientific` | ## Add your own applications From 640f0896cf75a3d171cbcaec427ea0aa48279b73 Mon Sep 17 00:00:00 2001 From: Thom McKiernan Date: Tue, 10 Oct 2023 12:59:27 +0100 Subject: [PATCH 044/151] Update install-vamt.md removed outdated references to Windows 10. The information is relevant to Windows 11 and Windows Server too --- windows/deployment/volume-activation/install-vamt.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index c204b95d16..a8d6e07078 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -1,6 +1,6 @@ --- -title: Install VAMT (Windows 10) -description: Learn how to install Volume Activation Management Tool (VAMT) as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. +title: Install VAMT +description: Learn how to install Volume Activation Management Tool (VAMT) as part of the Windows Assessment and Deployment Kit (ADK) for Windows. ms.reviewer: nganguly manager: aaroncz ms.author: frankroj @@ -18,7 +18,7 @@ This article describes how to install the Volume Activation Management Tool (VAM ## Installing VAMT -You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. +You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows. >[!IMPORTANT] >VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products' license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For best results when using Active Directory-based activation, we recommend running VAMT while logged on as a domain administrator. @@ -30,7 +30,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for - [Windows Server with Desktop Experience](/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied -- Latest version of the [Windows 10 ADK](/windows-hardware/get-started/adk-install) +- Latest version of the [Windows ADK](/windows-hardware/get-started/adk-install) - Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) version, the latest is recommended @@ -52,7 +52,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for ### Install VAMT using the ADK -1. Download the latest version of [Windows 10 ADK](/windows-hardware/get-started/adk-install). +1. Download the latest version of [Windows ADK](/windows-hardware/get-started/adk-install). If an older version is already installed, it's recommended to uninstall the older ADK and install the latest version. Existing VAMT data is maintained in the VAMT database. From 23c3eba866398281aa6226cbcad1409de174b6bf Mon Sep 17 00:00:00 2001 From: Thom McKiernan Date: Tue, 10 Oct 2023 13:14:06 +0100 Subject: [PATCH 045/151] Update install-vamt.md SQL download link went to a dead page that then got redirected to an SQL 2019 page with no download links. I've updated this to be the correct link for the latest SQL Express download. --- windows/deployment/volume-activation/install-vamt.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index a8d6e07078..bc53386011 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -32,13 +32,13 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for - Latest version of the [Windows ADK](/windows-hardware/get-started/adk-install) -- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) version, the latest is recommended +- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-downloads) version, the latest is recommended - Alternatively, any supported **full** SQL instance ### Install SQL Server Express / alternatively use any full SQL instance -1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package. +1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-downloads) package. 2. Select **Basic**. @@ -68,7 +68,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for ### Configure VAMT to connect to SQL Server Express or full SQL Server -1. Open **Volume Active Management Tool 3.1** from the Start menu. +1. Open **Volume Active Management Tool** from the Start menu. 2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. From e3dd5ee609a39266a01e2a7ef2ec5bb3a096e811 Mon Sep 17 00:00:00 2001 From: "JerryAbo [MSFT]" <94194023+jerryabo@users.noreply.github.com> Date: Tue, 10 Oct 2023 20:34:25 -0500 Subject: [PATCH 046/151] Update enroll-a-windows-10-device-automatically-using-group-policy.md Add dependency for auto HAADJ directly in GPO requirements so it is more easily discoverable as a HAADJ missing this info blocks MDM enrollment from succeeding. --- ...roll-a-windows-10-device-automatically-using-group-policy.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 031f810c1b..62fce24e34 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -19,9 +19,11 @@ The enrollment into Intune is triggered by a group policy created on your local - The Active Directory joined device must be running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). - The enterprise has configured a Mobile Device Management (MDM) service. - The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad). +- Service connection point (SCP) configuration. For more information see [configuring the SCP using Microsoft Entra Connect](/azure/active-directory/devices/how-to-hybrid-join). For environments not publishing SCP data to AD, see [Microsoft Entra hybrid join targeted deployment](/azure/active-directory/devices/hybrid-join-control#targeted-deployment-of-microsoft-entra-hybrid-join-on-windows-current-devices). - The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents fail enrollment with `error 0x80180026`). - The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. For more information, see [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan). + > [!TIP] > For more information, see the following topics: > From 9d729d68d2e5ab4fbd12e2b2584813138a6525ef Mon Sep 17 00:00:00 2001 From: Dan Mabee <40476441+damabe@users.noreply.github.com> Date: Wed, 11 Oct 2023 00:27:13 -0700 Subject: [PATCH 047/151] Policheck update --- store-for-business/microsoft-store-for-business-overview.md | 4 ++-- windows/configuration/wcd/wcd-browser.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index 51d26aea04..84a347f046 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -244,7 +244,6 @@ Store for Business and Education is currently available in these markets. - Liechtenstein - Lithuania - Luxembourg -- Macedonia - Madagascar - Malawi - Malaysia @@ -268,6 +267,7 @@ Store for Business and Education is currently available in these markets. - New Zealand - Nicaragua - Nigeria +- North Macedonia - Norway - Oman - Pakistan @@ -310,7 +310,7 @@ Store for Business and Education is currently available in these markets. - Tonga - Trinidad and Tobago - Tunisia -- Turkey +- Türkiye - Turks and Caicos Islands - Uganda - United Arab Emirates diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md index 97e8ca8ceb..3168b7df93 100644 --- a/windows/configuration/wcd/wcd-browser.md +++ b/windows/configuration/wcd/wcd-browser.md @@ -85,7 +85,7 @@ Use *Default* to specify a name that matches one of the search providers you ent Some countries/regions require specific, default search providers. The following table lists the applicable countries/regions and information for configuring the necessary search provider. >[!NOTE] ->For Russia + Commonwealth of Independent States (CIS), the independent states consist of Russia, Ukraine, Georgia, The Republic of Azerbaijan, Republic Of Belarus, The Republic of Kazakhstan, The Kyrgyz Republic, The Republic of Moldova, The Republic of Tajikistan, The Republic of Armenia, Turkmenistan, The Republic of Uzbekistan, and Turkey. +>For Russia + Commonwealth of Independent States (CIS), the independent states consist of Russia, Ukraine, Georgia, The Republic of Azerbaijan, Republic Of Belarus, The Republic of Kazakhstan, The Kyrgyz Republic, The Republic of Moldova, The Republic of Tajikistan, The Republic of Armenia, Turkmenistan, The Republic of Uzbekistan, and Türkiye. From ef86d7c09d78db31fb2436c8ed8d0f43fe373a41 Mon Sep 17 00:00:00 2001 From: Anders Ahl <58516456+GenerAhl@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:37:24 +0200 Subject: [PATCH 048/151] Update hello-feature-pin-reset.md Corrected a typo on the page. --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index ab35e717f2..1c72822304 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -70,7 +70,7 @@ To register the applications, follow these steps: :::column span="3"::: 3. Review the permissions requested by the *Microsoft Pin Reset Service Production* application and select **Accept** to confirm consent to both applications to access your organization. >[!NOTE] - >After accepance, the redirect page will show a blank page. This is a known behavior. + >After acceptance, the redirect page will show a blank page. This is a known behavior. :::column-end::: :::column span="1"::: :::image type="content" alt-text="Screenshot showing the PIN reset service permissions final page." source="images/pinreset/pin-reset-service-prompt-2.png" lightbox="images/pinreset/pin-reset-service-prompt-2.png" border="true"::: From aa029fda5ecd7baf85ac769e9d9ae9a7a1bd4eb1 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 11 Oct 2023 17:42:16 +0530 Subject: [PATCH 049/151] Update mdm-overview.md corrected grammatical errors and made some words bold --- windows/client-management/mdm-overview.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index ceca839aaa..da0013abc4 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -31,7 +31,7 @@ Microsoft provides MDM security baselines that function like the Microsoft group The MDM security baseline includes policies that cover the following areas: -- Microsoft inbox security technologies (not deprecated) such as BitLocker, Windows Defender SmartScreen, Exploit Guard, Microsoft Defender Antivirus, and Firewall +- Microsoft inbox security technologies (not deprecated) such as **BitLocker, Windows Defender SmartScreen, Exploit Guard, Microsoft Defender Antivirus,** and **Firewall** - Restricting remote access to devices - Setting credential requirements for passwords and PINs - Restricting use of legacy technology @@ -66,6 +66,6 @@ No. Only one MDM is allowed. | Entry | Description | | --------------- | -------------------- | -| What is dmwappushsvc? | It's a Windows service that ships in Windows operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -| What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry. | -| How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service causes your management to fail. | +| What is dmwappushsvc? | It's a Windows service that ships in the Windows operating system as a part of the Windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +| What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and is involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry. | +| How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and is required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service causes your management to fail. | From f09a9a126fdfb3d7b224e85d64b684f4df91995f Mon Sep 17 00:00:00 2001 From: Stacyrch140 <102548089+Stacyrch140@users.noreply.github.com> Date: Wed, 11 Oct 2023 11:49:20 -0400 Subject: [PATCH 050/151] pencil edit Line 109 - fixed comma spacing --- store-for-business/microsoft-store-for-business-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index 84a347f046..53f420d9f9 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -106,7 +106,7 @@ Also, if your organization plans to use a management tool, you'll need to config ## Get apps and content -Once signed in to the Microsoft Store, you can browse and search for all products in the Store for Business and Education catalog. Some apps are free,and some apps charge a price. We're continuing to add more paid apps to the Store for Business and Education. Check back if you don't see the app that you're looking for. Currently, you can pay for apps with a credit card, and some items can be paid for with an invoice. We'll be adding more payment options over time. +Once signed in to the Microsoft Store, you can browse and search for all products in the Store for Business and Education catalog. Some apps are free, and some apps charge a price. We're continuing to add more paid apps to the Store for Business and Education. Check back if you don't see the app that you're looking for. Currently, you can pay for apps with a credit card, and some items can be paid for with an invoice. We'll be adding more payment options over time. **App types** - These app types are supported in the Store for Business and Education: @@ -386,4 +386,4 @@ Developers in your organization, or ISVs can create content specific to your org Once the app is in inventory, admins can choose how to distribute the app. ISVs creating apps through the dev center can make their apps available in Store for Business and Education. ISVs can opt-in their apps to make them available for offline licensing. Apps purchased in Store for Business and Education will work only on Windows 10. -For more information on line-of-business apps, see [Working with Line-of-Business apps](working-with-line-of-business-apps.md). \ No newline at end of file +For more information on line-of-business apps, see [Working with Line-of-Business apps](working-with-line-of-business-apps.md). From 2efc734abefc19c4f3ab74def62d955ff9ec5fb8 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:19:31 -0700 Subject: [PATCH 051/151] Update docfx.json "contributors to exclude" --- windows/privacy/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json index 44e5b9392e..c5f4d6d1e6 100644 --- a/windows/privacy/docfx.json +++ b/windows/privacy/docfx.json @@ -57,7 +57,10 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "v-stchambers", + "v-stsavell", + "American-Dipper" ] }, "searchScope": ["Windows 10"] From efe70f38b9624dd4e7ab814ecbc60a81be83bb65 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:20:27 -0700 Subject: [PATCH 052/151] Update docfx.json "contributors to exclude" --- windows/security/docfx.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 817a43769a..788dd39424 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -65,7 +65,10 @@ "dstrome", "v-dihans", "garycentric", - "beccarobins" + "beccarobins", + "v-stchambers", + "v-stsavell", + "American-Dipper" ], "searchScope": [ "Windows 10" @@ -235,4 +238,4 @@ "dest": "security", "markdownEngineName": "markdig" } -} \ No newline at end of file +} From 8b173499564707d9eeae8bbbbe99c9867f70a7f7 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:21:14 -0700 Subject: [PATCH 053/151] Update docfx.json "contributors to exclude" --- windows/whats-new/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index 036ef0bfa2..0c5f721e90 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -59,7 +59,10 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "v-stchambers", + "v-stsavell", + "American-Dipper" ], "searchScope": ["Windows 10"] }, From e70d73ef309d2dbb01a450c0475fb475f073240d Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:22:11 -0700 Subject: [PATCH 054/151] Update docfx.json "contributors to exclude" --- store-for-business/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index f0006e84b3..3546f350c2 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -67,7 +67,10 @@ "v-dihans", "garycentric", "v-stsavell", - "beccarobins" + "beccarobins", + "v-stchambers", + "v-stsavell", + "American-Dipper" ] }, "fileMetadata": {}, From 2e8c69308431af8bff132307c4e29b29f900f917 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:22:41 -0700 Subject: [PATCH 055/151] Update docfx.json "contributors to exclude" --- windows/deployment/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index d718ec36aa..a076f8b3fd 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -58,7 +58,10 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "v-stchambers", + "v-stsavell", + "American-Dipper" ], "searchScope": ["Windows 10"] }, From 7e9eaea160c43de4efd74f675ed11840b6a7a5e4 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:23:40 -0700 Subject: [PATCH 056/151] Update docfx.json --- windows/configuration/docfx.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 0ab80c34f4..240d5e29c9 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -61,6 +61,9 @@ "tiburd", "garycentric", "beccarobins" + "v-stchambers", + "v-stsavell", + "American-Dipper" ], "searchScope": ["Windows 10"] }, From 9acf3f44c62569b8bc0027f893deb7b4571492da Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:31:42 -0700 Subject: [PATCH 057/151] Update docfx.json "contributors to exclude" --- browsers/internet-explorer/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index ef83e85701..c62ca17200 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -48,7 +48,10 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "Stacyrch140", + "v-stsavell", + "American-Dipper" ] }, "externalReference": [], From d3582b734e24884636e86fc4809a0c03a61d5bb6 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:32:55 -0700 Subject: [PATCH 058/151] Update docfx.json "contributors to exclude" --- windows/application-management/docfx.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index b8d3bddc46..8b50896c5a 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -60,7 +60,10 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "Stacyrch140", + "v-stsavell", + "American-Dipper" ], "searchScope": ["Windows 10"] }, From da1d313db78d51b2fac13b088a13f46c45ce0c46 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:35:29 -0700 Subject: [PATCH 059/151] Update docfx.json --- education/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/docfx.json b/education/docfx.json index a9579639a6..8b2f9b3edf 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -66,7 +66,7 @@ "garycentric", "v-stsavell", "beccarobins", - "v-stchambers" + "Stacyrch140" ] }, "fileMetadata": { From 91c0f28dfc1ad38d90ad86c8a192b274a8f910a7 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:36:33 -0700 Subject: [PATCH 060/151] Update docfx.json --- windows/privacy/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json index c5f4d6d1e6..35522da4b4 100644 --- a/windows/privacy/docfx.json +++ b/windows/privacy/docfx.json @@ -58,7 +58,7 @@ "tiburd", "garycentric", "beccarobins", - "v-stchambers", + "Stacyrch140", "v-stsavell", "American-Dipper" ] From 5e6c2034f6acee1233f88b6860de089f00d1a584 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:37:06 -0700 Subject: [PATCH 061/151] Update docfx.json --- windows/security/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 788dd39424..040348819b 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -66,7 +66,7 @@ "v-dihans", "garycentric", "beccarobins", - "v-stchambers", + "Stacyrch140", "v-stsavell", "American-Dipper" ], From 294ddeb85ad2a7dbb3311b3a81605a0868f8af6b Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:38:10 -0700 Subject: [PATCH 062/151] Update docfx.json --- windows/whats-new/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index 0c5f721e90..ec64e498bc 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -60,7 +60,7 @@ "tiburd", "garycentric", "beccarobins", - "v-stchambers", + "Stacyrch140", "v-stsavell", "American-Dipper" ], From e3376c333f6e332488b76cd342563bb1af25422d Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:39:00 -0700 Subject: [PATCH 063/151] Update docfx.json --- windows/deployment/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index a076f8b3fd..c9f6a5f653 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -59,7 +59,7 @@ "tiburd", "garycentric", "beccarobins", - "v-stchambers", + "Stacyrch140", "v-stsavell", "American-Dipper" ], From 380a4e798f1e47e1d20f0988cd93bfe488c75096 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:39:21 -0700 Subject: [PATCH 064/151] Update docfx.json --- store-for-business/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 3546f350c2..ba3d25fe32 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -68,7 +68,7 @@ "garycentric", "v-stsavell", "beccarobins", - "v-stchambers", + "Stacyrch140", "v-stsavell", "American-Dipper" ] From 6014833e6562b2a523c7db9586255e1efcd468ff Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:41:25 -0700 Subject: [PATCH 065/151] Update docfx.json --- windows/configuration/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 240d5e29c9..04fb8e95d9 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -60,7 +60,7 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", "v-stchambers", "v-stsavell", "American-Dipper" From ac951fcbdc940aa4513476e37ae79df953a220ed Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:51:49 -0700 Subject: [PATCH 066/151] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 0eab04c64d..37c7bd40cd 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -213,7 +213,7 @@ When creating an inbound or outbound rule, you should specify details about the Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: -**Step 1: Deploy WDAC AppId Tagging Policies** +### Step 1: Deploy WDAC AppId Tagging Policies A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   From 3819fb16e3dcd5666c337098380a971a8c8fda46 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:06 -0700 Subject: [PATCH 067/151] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 37c7bd40cd..9db1183c80 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -219,7 +219,7 @@ A Windows Defender Application Control (WDAC) policy needs to be deployed which Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  -**Step 2: Configure Firewall Rules using PolicyAppId Tags**  +### Step 2: Configure Firewall Rules using PolicyAppId Tags - **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. From 03f7d28f345d252eba145843d31783c67efa7bfe Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:36 -0700 Subject: [PATCH 068/151] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 9db1183c80..45c223f957 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `–PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  From b6407d66affae8ebaf1f086cd715b7f41c1044ea Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 11 Oct 2023 11:47:16 -0700 Subject: [PATCH 069/151] Eye twitch --- ...roups-windows-feature-update-summary-dashboard.md | 12 ++++++------ ...roups-windows-quality-update-summary-dashboard.md | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md index 37d261d766..7ff0cc7a61 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md @@ -17,19 +17,19 @@ ms.collection: # Windows feature update summary dashboard -The summary dashboard provides a broader view of the current Windows OS update status for all devices registered with Windows Autopatch. +The Summary dashboard provides a broader view of the current Windows OS update status for all devices registered with Windows Autopatch. -The first part of the summary dashboard provides you with an all-devices trend report where you can follow the deployment trends within your organization. You can view if updates were successfully installed, failing, in progress, not ready or have their Windows feature update paused. +The first part of the Summary dashboard provides you with an all-devices trend report where you can follow the deployment trends within your organization. You can view if updates were successfully installed, failing, in progress, not ready or have their Windows feature update paused. -**To view a generated summary dashboard for your Windows feature update deployments:** +**To view a generated Summary dashboard for your Windows feature update deployments:** 1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 1. Select **Reports** from the left navigation menu. -1. Under the **Windows Autopatch** section, select **Windows feature updates (preview)**. +1. Under the **Windows Autopatch** section, select **Windows feature updates**. ## Report information -The following information is available in the summary dashboard: +The following information is available in the Summary dashboard: | Column name | Description | | ----- | ----- | @@ -48,5 +48,5 @@ The following options are available: | Option | Description | | ----- | ----- | -| Refresh | The option to **Refresh** the summary dashboard is available at the top of the page. This process will ensure that the summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | +| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process will ensure that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | | Summary links | Each column represents the summary of included devices. Select the hyperlinked number to produce a filtered report in a new browser tab. | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md index 154e93fb08..e744f0c407 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md @@ -1,7 +1,7 @@ --- title: Windows quality update summary dashboard description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch with Autopatch groups -ms.date: 07/25/2023 +ms.date: 10/04/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to @@ -17,7 +17,7 @@ ms.collection: # Windows quality update summary dashboard -The summary dashboard provides a summary view of the current update status for all devices enrolled into Windows Autopatch. +The Summary dashboard provides a summary view of the current update status for all devices enrolled into Windows Autopatch. **To view the current update status for all your enrolled devices:** @@ -29,7 +29,7 @@ The summary dashboard provides a summary view of the current update status for a ## Report information -The following information is available in the summary dashboard: +The following information is available in the Summary dashboard: | Column name | Description | | ----- | ----- | @@ -47,5 +47,5 @@ The following options are available: | Option | Description | | ----- | ----- | -| Refresh | The option to **Refresh** the summary dashboard is available at the top of the page. This process will ensure that the summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | +| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process ensures that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | | Summary links | Each column represents the summary of included devices. Select the hyperlinked number to produce a filtered report in a new browser tab. | From 604609b3e612ea505a9fbf9b585233e1eb7d9fbe Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 11 Oct 2023 11:55:26 -0700 Subject: [PATCH 070/151] Date --- ...autopatch-groups-windows-feature-update-summary-dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md index 7ff0cc7a61..e8390b1c35 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md @@ -1,7 +1,7 @@ --- title: Windows feature update summary dashboard description: Provides a broader view of the current Windows OS upgrade status for all devices registered with Windows Autopatch. -ms.date: 07/25/2023 +ms.date: 10/11/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to From 8bbfe640ac2c19037af50ba996a3a0b72cd58e1b Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 11 Oct 2023 12:22:08 -0700 Subject: [PATCH 071/151] Tweak --- ...autopatch-groups-windows-feature-update-summary-dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md index e8390b1c35..6f8527fdc9 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-summary-dashboard.md @@ -48,5 +48,5 @@ The following options are available: | Option | Description | | ----- | ----- | -| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process will ensure that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | +| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process ensures that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | | Summary links | Each column represents the summary of included devices. Select the hyperlinked number to produce a filtered report in a new browser tab. | From e2bb8c3019a599886311172d36d66e4f51afc444 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 11 Oct 2023 18:03:58 -0400 Subject: [PATCH 072/151] Minor edits Making agreed on changes with submitter --- .../volume-activation/install-vamt.md | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index bc53386011..25337951c9 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.prod: windows-client author: frankroj ms.localizationpriority: medium -ms.date: 11/07/2022 +ms.date: 10/11/2023 ms.topic: article ms.technology: itpro-fundamentals --- @@ -21,32 +21,34 @@ This article describes how to install the Volume Activation Management Tool (VAM You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows. >[!IMPORTANT] ->VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products' license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For best results when using Active Directory-based activation, we recommend running VAMT while logged on as a domain administrator. +> +> VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products' license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you don't have administrator privileges, start VAMT with elevated privileges. For best results when using Active Directory-based activation, we recommend running VAMT while logged on as a domain administrator. >[!NOTE] ->The VAMT Microsoft Management Console snap-in ships as an x86 package. +> +> The VAMT Microsoft Management Console snap-in ships as an x86 package. ### Requirements -- [Windows Server with Desktop Experience](/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied +- [Windows Server with Desktop Experience](/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied. -- Latest version of the [Windows ADK](/windows-hardware/get-started/adk-install) +- Latest version of the [Windows ADK](/windows-hardware/get-started/adk-install). -- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-downloads) version, the latest is recommended +- Any supported [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-downloads) version. The latest is recommended. -- Alternatively, any supported **full** SQL instance +- Alternatively, any supported **full** SQL instance. ### Install SQL Server Express / alternatively use any full SQL instance -1. Download and open the [SQL Server Express](https://www.microsoft.com/sql-server/sql-server-downloads) package. +1. Download and open the [SQL Server Express](https://aka.ms/sqlexpress) package. -2. Select **Basic**. +1. Select **Basic**. -3. Accept the license terms. +1. Accept the license terms. -4. Enter an install location or use the default path, and then select **Install**. +1. Enter an install location or use the default path, and then select **Install**. -5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. +1. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. ![In this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) @@ -56,21 +58,21 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for If an older version is already installed, it's recommended to uninstall the older ADK and install the latest version. Existing VAMT data is maintained in the VAMT database. -2. Enter an install location or use the default path, and then select **Next**. +1. Enter an install location or use the default path, and then select **Next**. -3. Select a privacy setting, and then select **Next**. +1. Select a privacy setting, and then select **Next**. -4. Accept the license terms. +1. Accept the license terms. -5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. If desired, you can select additional features to install as well. +1. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. If desired, you can select additional features to install as well. -6. On the completion page, select **Close**. +1. On the completion page, select **Close**. ### Configure VAMT to connect to SQL Server Express or full SQL Server -1. Open **Volume Active Management Tool** from the Start menu. +1. In the Start Menu under, **Windows Kits**, **Volume Active Management Tool 3.1**. -2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. +1. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. ![Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) @@ -82,4 +84,4 @@ To uninstall VAMT using the **Programs and Features** Control Panel: 1. Open **Control Panel** and select **Programs and Features**. -2. Select **Assessment and Deployment Kit** from the list of installed programs and select **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. +1. Select **Assessment and Deployment Kit** from the list of installed programs and select **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. From dc36f65254603fd2df5ad975528f96cec206f5d1 Mon Sep 17 00:00:00 2001 From: Aditi Srivastava <133841950+aditisrivastava07@users.noreply.github.com> Date: Thu, 12 Oct 2023 14:05:47 +0530 Subject: [PATCH 073/151] Corrected alt text of images. --- windows/deployment/volume-activation/install-vamt.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 25337951c9..ec3ea1a746 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -50,7 +50,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 1. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) + ![Screenshot that shows that in this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) ### Install VAMT using the ADK @@ -74,7 +74,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 1. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. - ![Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) + ![Screenshot that shows that the Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) For remote SQL Server, use `servername.yourdomain.com`. From feb5c8500aaec5718d7fcdba97c36d66673483f7 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Thu, 12 Oct 2023 12:06:38 -0400 Subject: [PATCH 074/151] VAMT Refresh --- ...ivate-using-key-management-service-vamt.md | 153 +++++++++++------- 1 file changed, 91 insertions(+), 62 deletions(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 3401c97658..5ec5e4ebcb 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -8,128 +8,145 @@ author: frankroj manager: aaroncz ms.author: frankroj ms.localizationpriority: medium -ms.date: 11/07/2022 +ms.date: 10/04/2023 ms.topic: how-to ms.collection: - highpri - tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 + - ✅ Windows Server 2022 + - ✅ Windows Server 2019 + - ✅ Windows Server 2016 --- # Activate using Key Management Service -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - > [!TIP] -> Are you looking for information on retail activation? +> +> For information on retail activation, see the following articles: > > - [Activate Windows](https://support.microsoft.com/help/12440/) > - [Product activation for Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) -There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: +Volume activation can be performed via Key Management Service (KMS). KMS can be hosted either on a client version of Windows or on Windows Server. -- Host KMS on a computer running Windows 10 -- Host KMS on a computer running Windows Server 2012 R2 -- Host KMS on a computer running an earlier version of Windows +## Key Management Service in a client version of Windows -Check out [Windows 10 Volume Activation Tips](/archive/blogs/askcore/windows-10-volume-activation-tips). +Installing a KMS host key on a computer running a client version of Windows allows the following scenarios against this KMS host: -## Key Management Service in Windows 10 +- Activation of other computers running the same client version of Windows. +- Activation of other computers running earlier client versions of Windows. -Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. +Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if the organization uses volume activation for clients and MAK-based activation for a smaller number of servers. -Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. -To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft activation services. +To enable KMS functionality, a KMS key is installed on a KMS host. The host is then activated over the Internet or by phone using Microsoft activation services. -### Configure KMS in Windows 10 +### Configure KMS in a client version of Windows -To activate, use the `slmgr.vbs` command. Open an elevated command prompt and run one of the following commands: +KMS can be activated on client versions of Windows by using the `slmgr.vbs`. To activate KMS on a client version of Windows, follow these steps: -- To install the KMS key, run the command `slmgr.vbs /ipk `. +1. Open an elevated Command Prompt window. -- To activate online, run the command `slmgr.vbs /ato`. +1. In the elevated Command Prompt window, run the following command to install the KMS key: -- To activate by telephone, follow these steps: + ```cmd + cscript.exe slmgr.vbs /ipk + ``` - 1. Run `slmgr.vbs /dti` and confirm the installation ID. +1. Once the KMS key has been installed, it needs to be activated using one of the following methods: - 2. Call [Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers) and follow the voice prompts to enter the installation ID that you obtained in step 1 on your telephone. + - To activate online, in the elevated Command Prompt window, run the following command: - 3. Follow the voice prompts and write down the responded 48-digit confirmation ID for OS activation. + ```cmd + cscript.exe slmgr.vbs /ato + ``` - 4. Run `slmgr.vbs /atp \`. + - To activate by telephone, follow these steps: -For more information, see the information for Windows 7 in [Deploy KMS Activation](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn502531(v=ws.11)). + 1. In the elevated Command Prompt window, run the following command: -## Key Management Service in Windows Server 2012 R2 + ```cmd + cscript.exe slmgr.vbs /dti + ``` -Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. + This should display the installation ID. -> [!NOTE] + 1. Call the [Microsoft Volume License Key assisted support telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers). Follow the voice prompts and when prompted, enter the installation ID obtained in the previous step. + + 1. Continue following the voice prompts. When prompted, write down the 48-digit confirmation ID for OS activation given by the prompts. + + 1. In the elevated Command Prompt window, run the following command: + + ```cmd + cscript.exe slmgr.vbs /atp \ + ``` + +## Key Management Service in Windows Server + +Installing a KMS host key on a computer running Windows Server allows you to activate computers running the same or earlier versions of Windows Server. Additionally, it also allows activation of client versions of Windows. + +> [!IMPORTANT] +> > You cannot install a client KMS key into the KMS in Windows Server. -This scenario is commonly used in larger organizations that don't find the overhead of using a server a burden. +### Configure KMS in Windows Server -> [!NOTE] -> If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [Error 0xC004F015 when you activate Windows 10 Enterprise on a Windows Server 2012 R2 KMS host](/troubleshoot/windows-server/deployment/error-0xc004f015-activate-windows-10). +1. Sign in to a Windows Server server with an account that has local administrative credentials. -### Configure KMS in Windows Server 2012 R2 +1. Open **Server Manager**. -1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. +1. Under the **Manage** menu in **Server Manager**, select **Add Roles and Features**. This opens the **Add Roles and Features Wizard**. -2. Launch Server Manager. +1. In the **Add Roles and Features Wizard**: -3. Add the Volume Activation Services role, as shown in Figure 4. + 1. In the **Before you begin** page, select the **Next >** button. - ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) + 1. In the **Select installation type**/**Installation Type** page, select **Role-based or feature-based installation**, and then select the **Next >** button. - **Figure 4**. Adding the Volume Activation Services role in Server Manager + 1. In the **Select destination server**/**Server Selection** page, make sure **Select a server from the server pool** is selected. Under **Server Pool**, select the server on which to install KMS, and then select the **Next >** button. -4. When the role installation is complete, select the link to launch the Volume Activation Tools (Figure 5). + 1. In the **Select server roles**/**Server Roles** page, under **Roles**, select **Volume Activation Services**, and then select the **Next >** button. - ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) + 1. In the **Add features that are required for Volume Activation Services?** window that appears, select the **Add Features** button, and then select the **Next >** button. - **Figure 5**. Launching the Volume Activation Tools + 1. In the **Select features**/**Features** page, select the **Next >** button. -5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). This computer can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. + 1. In the **Volume Activation Services** page, select the **Next >** button. - ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) + 1. In the **Confirm installation selections**/**Confirmation** page, select the **Install** button. - **Figure 6**. Configuring the computer as a KMS host + 1. Installation may take a few minutes to complete. Once the role installation completes, select the **Close** button. -6. Install your KMS host key by typing it in the text box, and then select **Commit** (Figure 7). +1. Go to the **Start Menu** > **Windows Administrative Tools** and select **Volume Activation Tools**. The **Volume Activation Tools** window appears. - ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) +1. In the **Volume Activation Tools** window: - **Figure 7**. Installing your KMS host key + 1. In the **Introduction to Volume Activation Tools**/**Introduction** page, select the **Next >** button. -7. If asked to confirm replacement of an existing key, select **Yes**. -8. After the product key is installed, you must activate it. Select **Next** (Figure 8). + 1. In the **Select Volume Activation Method**/**Activation Type** page, select the **Key Management Service (KMS)** option, and specify the computer that acts as the KMS host. This computer can be the server on which the KMS role was installed, or another server/client computer. After the server/computer has been specified, select the **Next >** button. - ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) + 1. In the **Manage KMS Host**/**Product Key Management** page, enter in the KMS host key in the text box under **Install your KMS host key**, and then select the **Commit** button. - **Figure 8**. Activating the software + 1. If asked to confirm replacement of an existing key, select **Yes**. - The KMS key can be activated online or by phone. See Figure 9. + 1. After the product key is installed, in the **Product Key Installation Succeeded**/**Product Key Management** page, make sure **Activate Product** is selected, and then select **Next >** button to begin the activation process. - ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) + 1. In the **Activate Product**/**Product Key Management** page, make sure that the product shows correctly under the **Select product** menu, and then select the desired activation method. The available methods are: - **Figure 9**. Choosing to activate online + - **Active online** - If selecting this option, select the **Commit** button to finish activating the product online. -Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. + - **Active by phone** - If selecting this option, select the **Show me other ways to activate** drop-down menu, and then select **Use the automated phone system**. Follow the instructions to activate the product by phone. + +Once the KMS host is configured, it begins to listen for activation requests. However, it doesn't activate clients successfully until the activation threshold is met. ## Verifying the configuration of Key Management Service -KMS volume activation can be verified from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. +KMS volume activation can be verified from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests are processed. The verification process described here increments the activation count each time a client computer contacts the KMS host. If the activation threshold hasn't been reached, the verification generates an error message instead of a confirmation message. > [!NOTE] +> > If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. To verify that KMS volume activation works, complete the following steps: @@ -159,4 +176,16 @@ For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KM ## Related articles -- [Volume Activation for Windows 10](volume-activation-windows-10.md) +- [Volume Activation for Windows 10](volume-activation-windows-10.md). +- [Deploy KMS Activation](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn502531) +- [Error 0xC004F015 when you activate Windows 10 Enterprise on a Windows Server 2012 R2 KMS host](/troubleshoot/windows-server/deployment/error-0xc004f015-activate-windows-10). +- [Windows Volume Activation Tips](/archive/blogs/askcore/windows-10-volume-activation-tips). + + + ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) + ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) + ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) + ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) + ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) + ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) + From af6a9b7835371b608438718955316d3b8261d11e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 12 Oct 2023 10:26:52 -0700 Subject: [PATCH 075/151] aad-timeline-dep-8396095 --- windows/whats-new/deprecated-features.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 881e004c0c..415e3db4d8 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,6 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | +| Timeline for Azure AD accounts | Cross-device syncing of Azure AD user activity history will stop starting in March 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The Timeline user experience was retired in Windows 11, although it remains in Windows 10. The Timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | @@ -52,7 +53,7 @@ The features in this article are no longer being actively developed, and might b | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | | Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | -| Microsoft BitLocker Administration and Monitoring (MBAM)| [Microsoft BitLocker Administration and Monitoring (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/), part of the [Microsoft Desktop Optimization Pack (MDOP)](/lifecycle/announcements/mdop-extended) is no longer being developed. | September, 2019 | +| Microsoft BitLocker Administration and Monitoring (MBAM)| [Microsoft BitLocker Administration and Monitoring (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/), part of the [Microsoft Desktop Optimization Pack (MDOP)](/lifecycle/announcements/mdop-extended) is no longer being developed. | September 2019 | | Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | | My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | | Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
 
The recommended replacement for PSR is [Azure App Service](/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web.
 
PSR was removed in Windows 11.| 1909 | From dc133faff0f8274fbf835b51eb6f0b693fb9765e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 12 Oct 2023 10:30:30 -0700 Subject: [PATCH 076/151] aad-timeline-dep-8396095 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 415e3db4d8..a5dc0afb27 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Timeline for Azure AD accounts | Cross-device syncing of Azure AD user activity history will stop starting in March 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The Timeline user experience was retired in Windows 11, although it remains in Windows 10. The Timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | +| Timeline for Azure AD accounts | Cross-device syncing of Azure AD user activity history will stop starting in March 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | From 3a539b833c34744e07fc801b1f682994de208510 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Thu, 12 Oct 2023 18:32:42 -0400 Subject: [PATCH 077/151] VAMT Refresh 2 --- .../volumeactivationforwindows81-04.jpg | Bin 92707 -> 0 bytes .../volumeactivationforwindows81-05.jpg | Bin 75307 -> 0 bytes .../volumeactivationforwindows81-06.jpg | Bin 68397 -> 0 bytes .../volumeactivationforwindows81-07.jpg | Bin 55729 -> 0 bytes .../volumeactivationforwindows81-08.jpg | Bin 53822 -> 0 bytes .../volumeactivationforwindows81-09.jpg | Bin 60987 -> 0 bytes ...ivate-using-key-management-service-vamt.md | 77 ++++++++++-------- 7 files changed, 42 insertions(+), 35 deletions(-) delete mode 100644 windows/deployment/images/volumeactivationforwindows81-04.jpg delete mode 100644 windows/deployment/images/volumeactivationforwindows81-05.jpg delete mode 100644 windows/deployment/images/volumeactivationforwindows81-06.jpg delete mode 100644 windows/deployment/images/volumeactivationforwindows81-07.jpg delete mode 100644 windows/deployment/images/volumeactivationforwindows81-08.jpg delete mode 100644 windows/deployment/images/volumeactivationforwindows81-09.jpg diff --git a/windows/deployment/images/volumeactivationforwindows81-04.jpg b/windows/deployment/images/volumeactivationforwindows81-04.jpg deleted file mode 100644 index d5b572f1aad41d034c3edefa9dfbe64420049bca..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 92707 zcmeFYWmH^Cw=Uc`1PP66fX3ZjLP%r5rGcOU8mAlgkPslaySo$Io#4_ya3{D+fB+$c zHxs64HR~3S64?dZf>{>mnqc2%!13@0mkiV>d4K@#lsDdc#u7S=Wj-p&?U-m2Q>-gf4qP|#B;S_w}v zPnaXj!qt@46J`&05%ZJ;{Q)la@cg@&8$|m@6<0e+(6isY((0+G(>`}_wxAW{;^#Ey z;pL?j65`?&5EK&P<)G!`;pOAzdH50H`=W=ki;^q|<75$CD$H)0lgVV(e?rQ4E33s9YI|A6k#oXD((bdKQPWv0t z)Xc%nRTA_d>7PS@IsOCo|2S9wQc*?aKduUc{hok7U|n1_E&eI*{}I?l+sn~{ThqeD z!Ohv+;-NbI@5YW|&z&tyT^*dY9USccK8xzs4z3O^)((!e&$WbTS#)jSPzMhe)<5d2 zsE8@TU0hA!<`#-zNzelVmyHcnjE_&`xs0%kfT*l6n3q?U{~4bE_!*Cgkc<#m;5o0T z(BIpF9n9Te7I4?Uw}t+*t>9m_{Y?d!<3rD23uha53#gp41B~{MA&c4kwJdypiTAg* z(7%?2|1aBeKM2G9dtv`&q5od=z@Fca|Df$d<{!kjfIqO^`GMBIP62p-kQD&!eo!Bz zU(0|%0P;T)%EJ>1>cejoR5aAz2@M_XkA#knfq{vEfsTds=n)nc&c7!l6ciLRR5UDf zbSzwKENtAzcn|6E<3B3>?GMhMxqol>kKC_r01y+Y6j=`i2?#(2BB210e)R!X9(4Rc z5+tO5sy`Y!Dh4tNCKA>|AqwE%ULifmjE;eZi4Q0vMcAUYiZ z1}`Boh)4(X8Q;`&f?y(vJE?}LlV&Y_e4X|T#H~SChC#r!UiV$iB)=9Jd2HNsMj^9+ z-fgC&-1B@{W^-`hdn_OT2?Yri6%!W)8664rp?@R*5Sfnm83D=z66(9y+?q*{rq)M3 z8E5}ELLxL`L3ENYW_k1i8|Sq>Q}Lwy&&^#n127mce=PxUP##7HL;(Vx0@m&@OkvoZ z#WfTv$5?G=`&3& zJ)-fIrT{bH;rEBOBn$gH^=)EHG^xVZUyq-%_2hA~3GLV6$3XGpC#A95Ajh&>$5u=} zp`#HNscjn(A%IvC7mLKQP)i3~3Gq34fFiP%JIPW{c-Jn|z*l;Q*NKnUY9*JMYo5@3 zYJSVJ=Ck;H>Od_eo$^y;$A$J&@4+_cHGQ8L;V$Kb&r^LP)=NTjZ(vjBi{LZ88~dz2 z&tRF?yW=Bu?n zz)fnbOWeJV>2XG^&|NJkOOfZNI6zDxAvZ6%x*+^w}L(cI6Z-Xw^Cgze~yzX0A3xu7;<=)NxZA{t!Go=3~ zR*AhrNVQv6<=x^Pv_JrPt46c+Q7gbZhrBWJ5;G}$q%4gqgZB?Iph^7#bnxFPHf3_9 zSE;2MAW@T$TAdWcNLQj-R0gcYfcA^ttzNR^ebEF@8o{0PbD)7FY4lRzs|Pm+4xubxBaQn%Y?zd0N|4~$?RLhe^u*0 z!QUNM_$>-?+27YsN*G39&3zS6#d1`nyeeFeyiWnw0PwA1Ua`$(zCVz5ilWIy`<`mDbfo->0U< zG_mzU2y3rdwL66kPl&{y#A_$GaSFCROoAzIDO7<-x#z= zYT(f66j$jVgzN56z_wOGC0Sd{z5H?Y;(5Edk~M3S{3G070Pm-FsfqVfo5W3;2hsJd zPCSMp1}3)S=+SL%L!a!{fRgwv3hBsTBVtn7Ymx29Wrkbe<|Ebnj)4`##{;E8=#Tz| z&cKsX>aKq-67d_;KV@$gt!+f%jIVlFq+Z&z=DUV!10=OtIh8z+@9dCxr$XZcl-vXP zDfxe!WB0$=!rJWH2Qxl=V_5mySU<4ke@ycKXLgy&fkvi&tx0#eH4}zkfcr9W?4Rz)LN4%qT7X0}6H>bQz@`Qrm*mqHqlb<4 zefMqB`GZnQvSqhitB%4w)cPyZWfq23s~2PFUgB#Ej7Yp!m!!CO4*^0*gPc4vmsvMv zp71nVv!}N@+zm&$?5d_(jflxL7#*U0ejx_qw}C8vO}t-p>X>teEg6+IZs?6Vu}f1W z$Ss9f`*VS=uk9jt4LVQF@C;JLk?`&H;m>{7`gW*(@CJxx>;UI#Jibny6|5@Ptt2-1 zGJDu9+lN9BaDBkocek@*VDWt6W92N$&OL{=@@&QRYa4REaYVMC;7g;&Rc z33Z6TzUmZJO=|rokiB5{>ovuBvjpN0Iu}cTl;wawJ!cTc&VDvhA(I89Cq1%IXf{QP9_#HzZfs(!=p6cw>2`(W_Y|F4oC!|m0@TiQX zEV40>C8K{KtqT5nGCOry!ovOK>!S_rhyJ6`HX750}@{y|vs+ zvC1n>1*aKIZRvcDgl(=v!~m33UH@wec zkZ4RR3W3%Cz#PYn8+IdlkJSK%fTy)5WbROLwz5ye#@=VOx>ikm{sr*-1^5x*bWJn; z*7}=Rv_nMuFP7={NNHi`bjD(N4b%eTKe6Et%pCkVyPlf+6D0o&AbdAZ z-O`$)Ip99;bv8=r6Xvp==e1` zxl?dm@7xn!k!PKUi@rxKKPWf8Obm%Gk3;Lw;as_|K_Vgf7~c9{TV9&D$MxVCbhI&# zmlY`|V^YiVS!V_hMG-O_!9-UNy+LG`Oqu1&>956ovd+oP0b~tn^Llpy8!rulppprp z5g!Fx!i8!Y%Q2+FzF`F_gG>oAQ@}k;K%UUQ%DC8z_oCm%;LpqQ8R2U!LQJYd2Wf}E z1lDM(A8q~HtrVMu4Gcc6)jeOV9d9cogq7IZe@+-iT`(JIXe4uQCmq*EO(fS%=_foN z9h6l*YVm5h)yQ(?`+i%U5HL?PXu_8KR++3ZiL`P)yKVagid)jFpHUdEyqm0IxrsWN z3nw83Yq}_Iifsqp!RGBAk6ecv){-wwu}d3PGrha@3q039(JKKP_!I^aDi?G~onz)1 z=P_vkmDuMWaHPRrYxHh{nXxc*IOLCUW+OoTq~+J}6iX`>~;*bT9Tqxa>Y<8@Vt zKfi~x87k2uX#`VG=w!MPh^4%( z=JzrG#BQ5~mEbWSffc1Y;fR%plRSe$I68z^6?D*-6u>@F(o%|>U$@2rheb1uExw3_Fy|WYlq>oxUO3hbFoj4b40P_;*-^CXW6$IwafH$ zjjM8BIVBRMj?%S9p;nfr37d)ua*ppgqsU0_$0RiF5wm(0P>T>?3c5xH{RxOQ&_^9L zrIWy1lgmo|>+;Rpu|=KaxYlWP!10ThB-CGT=+&yS&YQK$7plD*l5AIA%NoFvk=Bj_ zLTQtQbiAg6POVOO!7&J9&BJy-jwf<)K-1S$oG!u=@3QEQF}ZmV=k=Hh-3qB-FD=LQ zX0)W;)wbb3$DZTMv=;)tO&1iCJXMWnk z{=Ha?V?3E2YgbV4++0CH(+gN2G_yqO#6TDp<#JJMg?={o*%_*s&{cLyxp-v(1eT@+ z54`rMd;*sqS><=^#?1Io%XEcc2;l6nB9lJcFyJi6z0l zoQz`=)=Z!=@X=p$5(|ReAkH73#KiBihmUP)t38TjDJD=U1czeuUeM9gUW`>=N%v#$ zh3jfgQ)-n_-rhG^G~WpQ0-UYI>v5iDR$*Pj2kn;?>dE{zZ>~<7w4R8R1q{8oW%(%} z+U61vo6T)z!7&(7jiWlipJ)+YJ{x-OxWUAj*O_(mz^LooE2R3hZ?ZGkND1|ak`+|xXc*VZJ^MjeSel> zcsp!MSYqc+kANQ!{KbzmfgkhSM^BF4_qYJMEl1v>M<1{ZC6}y;$erif!;A>m2OA|^ z-a}S=N?0~vxK~2FFG?42;FNm2(wXlq?5uXLOFE8T(9yTf7!s@XI~oy6rL5t-c^$~$ z8;cl;P&gjp=QGcVr8rz__Imp`>Wsjp_G3(xlNqcVqpo^!@r2{LDO%%k$#Q4J_izk& z&^Z~dT#76(hlQm6!}?r@|j9;bEPFb zuN@9w$$ZPF#h^(|oN9$KVt@rX@AMuCY1Mv`NcI+Ucb=D|9^uqjdhIbpepW1Z zx^khIge-;-P_xDsU?BBc%!{VlAYChB7^B{<@u3flBB8aMTi0C+GS)fakKaD++Y4t8 z9TUi4W)aG3oZDI{Zk*bK>Rz!qC^PhahM%Ye2(d@#evFpYdPMV<$t)e6JDf8w-*B|F z+1s{+y{OnrG%h3~LNUu!h$j$A5j4FmAGOmxyoye?>jO-aj9_H9pih_3CeC55-~<>R zvb$b+xXZ5UB4C`0Rv=o)>ChUM=w!-Q;R8FgeUivtIBlS*?rZT?I>wHU1!>!Hd}I~(k)X@R-z(d!G$GHsuFa#Z4oL&aM}?#v z6-5N&y439H@)c06-Vh3DY-uo$$Tb)By2v?t6NtX=43D^s&m%q?Dx2vu>6qs!cR%KNMNvCD~PO zQVyy z9l_1QNn3S??UlKwQn`rIH$ShhzF)7YJ%Z-T<14fWl^!!M53k(3?pPVx>VuA- zxc8fcoQbB-Y12_<07nT-f!u6Gt9Ikudb%I(W);s9Ne(A9G}b3IEZXvlpCG;?_D?>F}xHzd;EE}#jnN7=J`GQi_!?H9dn~s~+xr&<9|4#H0 z)&B&Yu|)5nkfeR7jUwCHXt?WL$FbE|JBraU2|=oFTML^dOvzLCezd}+B&?x0zIV}Z z+w$zqoQSeC^1y|g9i{H*%1?Y@!|8OYVM1;iAjT49fe#<4X^Z_^{CD49JB$S1xkPOE z8Zv*CS(YS-rM{nU^$A{n8y7|M)ZNCY!;qI)ZPV;N@_(weBHIQd{CI+WIE<0ncPuT> zT4F~~N2yYmR+j6+jg_QK5Vy_o*z_OTH<=E%c)x#E4L&0FK(yt@`=gL|JXi zkLSAE{(-pfcrzznRdDQ+)cOQ6ywd4d$KN$lN-%hZMy%W5I_qNp;bfXcfDyCPzqxIE z?_6a&AQNXX);yeqG|=!(f9*G%Y@ad78~XNWimlh#zNc1)317ma7aC2F;?F#9R-!H> zY%Y9nTC&TudbpmNExtxq>)872EIxEzJbbgZ`=(S4v-v*U;tRRdO|!|V=d+Ch0^SP(2l+TnTa>$j`sfAkc1D|EM_Hp{;Eesw=2VNQl6 z4HE|onI-M$BU%A?YcNRi?t#yL7dBki^+o$k5*nht@4eyoT!LQ!h1i#qx+hgsKG*VI zPk8=d>^aewwhBd^w4sFiE&(jm@Ei3sZ9|{af4u)*=&Zjy#bs7frzx|$tH-S?FFF!8e2K|uS94=1KN*6SX*GS-E#j=8eXV^HNkrRlrZZ01xM341jC z@*=M+&nqI^>KDK*_N?UrW_tVX%;l+erJaFiSy}zui^8Ah4=}~OYTW0>x_DG>!#Bqd z%4jO3(s@I;$tWPTMC9n-9scqS8sI?-{7wc4TxKrcKO^c>gxE2aCYmr;AqF z!U?po*FX~hk`bT*rKac=LjRPy=TF5>T-<1CE&C>$RUi@8Y0eySAAR#u>OOW&KJpKF zuU>3zc)XA(SA1oj$ILn}rI_cWiaPSA9SOXZx?7nDsZ=!Z49(M8WNw&OAOPwnFCBKw zQ%gqI{2OOFaV^#lM%ADhWd-cJ1jMqs4YH6*iaW8tv*H2iffZH%uvFWBtf0UjJ44ku+zQX(PE_lpt25GGzH36IKLsWHmuX5XkH0 zu(ET*(Pg-|^DQX@Je&B5s>j8FiBx6T(^2cL`_Alg^QF^=cZ91_?2F?+jaV|pOI2JC z+O=l|Onzpo&DNYWNs7J>JQw+z-;d zO-B3(_yrg>|1Ik;K(tJ>%eTsipQ2xj5eg)WVCPT3!Cc9SKM^|{l<*SgDWk#tl&2x(V@;T*BIftRbaKlewVEoN?d>}d zuf+z8*8zF`%xTS(4tI-k33XV4Rv}48O$Sb5ME6~s@|(HW#ZUUL)4RRhZI3^`X_xph z@#vmtm%Gz&UuhverSsM?6k+nZ8T`8hTk_vZ#{{*e-inFx4o%P zD(&@xC-EEXtBt)~Pu=}2SH@$-zj6ltwVUw2|0aCE$m8d$$ESZG^xl6av{LEKLfGgO zw0*^TvO6=DZb}+fjXD!Dln4X@1tEr@a#+W0z3}VQ>g&}bk}11xql9Id_5DR|mS(nB zEM{dHm=G;t#A+R1cR~Pia|`9E>gxzoX8J2w@H>M^K_mVsB@DwtVkI|&X4}n`8HJaS zY4th&L)1q`i}4oQaiF3=whS$95i%07XfihiWo41t{E!;WREX>U?p%G|*IAb7;?lG^ ztjk$~%%4=#f(5KeVz4ixC}wq`tup&^?Yze&gX}>dk7>21C+`(lr>ZXb3W;9BeV5Ig zrRl%ovi;B3q5=K%&~0FDr5_-q7IyMzV4dq=)fBp{NtYR4Hi|jsB~bP)*ZHzcj4h-c zzkbAGf~Wu&!0~;V*cH2~0#U&d8z@&0Y{zo!36mn#_U6`8y!izXXrG75*mTT0NtH}dix##k!zWnj)Jl7#WhMQSHVj>6+#v^^&>^MEBq`r7Sw?{F#}?lf;^Ot?+20g z5ac`d3h#7B)EHfGTBv$JXv$DeGX<3CUJy3_qm@#6vH?xTKnr|NX+EiNKiSIaBk!H& zA40B?!_y4K^#-C}m)-Nwwn(156~peOY!gnBaC&9v8jBxpgrRBjO82d$GDx--@UA4O zbfz!+k)N?9soed$yL$A|XLhTwexZ8au1xog zExyrv&2=VZnW|>?YcS?+IKemq0k%1l08yd<`8I20M}WBNWXBJlMBLw8v8!DxAV-;%!*st0#K z1xq%QNHlA4dBf?;O-I}Tl`(khqSdKRIkz6$m(2RjPp~u6&{mGzInRR9U|`a=Vnl7G zMLk>~&S~y>BBmn1D>)$o!UuX{$<+OQ1-+zoY8KSb*oTvr^T?VZW@^&>6QxYn{+S*| zxoKOb9Xyhq(il;mo-p%S5_Uz*pdn>xp00+$okUf@TISqrGf0c!mz2eYGQN%vsYA!< z#ie=;+N;-Y-ZaRklQAWYXg&MUO|uH@!ny3YZ@Vup@bW)@xF7ymxR2-DFj4+=K$7me z9ap~fBKz+?>nJ{xrG2hJXx~rekSa*5LhL1)-kh$+riv4&^lg$)pufP5 zq^7!(MDB*8*7-7LDndEHvksrQ8~(I@MnsSpLY+UeI?e3@vkV*Aa&2nKCgHZhwpXkO z)xqOa_3HD2hq0kBgfK*vvVsoNxN)}6C==+DdGt)t3PT7Krk=WunND@OpPh?N@G+26 zfl;VX!6-HalIcoIPexc2jKIlFjm2v2fmqWvcuQ!Rkx}dKv`^ZDURt_D3Qcn~GJ#ad z*-D$kLPGOEWnbjouj>-R1PSTMB@~H(t4HQXIzr$3+v1twk!e@aa z(o{NBv?%V(ByGBy5z!%gRJ9)sS%)m&o8qMIkyRM-O`Dn=btBvcg{+c`r1vZW=CNdxZ{!pz>(>#?u#&W(c` zjSFsj3KGnv-RwnKZ8BGn`?7atSqsmCZYr%~pY)QO#xp>oB5Cr7_B?z0>1334K@S69 z)s&vC4p?+Ufmf(9`ZnWoi!>oH)Z<;qdn`v+k)HlBIsf7u12-A&7lS1_9!?)_P}2@a z55%1Xc*r8a_Rkh4^W)f>p+{^=h!?FCUaUoOuFiDrI5~Jg5LRcsF91AmQ4U+?_eQL$ zI?Gl)FU6|&YkiPsPWMWV07LTVPH(9+Ikh3!O+srP)`MJN08bc|bi6uQB!f;G zDXG)9z)SuO0t*hgobEobU=4#FE*`syX4ls=B-&W-E3yijf+&d}-pk_O>H}ZL=gFE-;bM>H<0#J>GF1FyzCt4~PW; zTB_T=P!d^=iVJ&_^CaP$F(`??R$j(zihb5#K5Iao(V-FE@~T(M&qLkYTYXuC5mnX* zb3%E(^DMMrbA6x1*FP`A4M8qSaP1Px(WB|k{RU``oi&?e(&4~+{V659ldLYN4cIXD z&3Zw9HZ%0y89Ei+e4y}<;w9#q+8lm?iR+?@n z_yGw;n>yXyV88Q<6sUKDGv`zzjp7;flw$GH!l76gn#=l$jje%Dc){p=8Q z4qkhH#WxfJA>_VDaY!AwH8$~hg|VB{iLQ6@8xhG|^5K^4&moG<`mmj#os@Ysc6fnF z?aH0V7()|PIDyORGNN(GqkCjE8g8V^^KbEj5;UpO@d&}arVs4%0b6TciZV=GGq8K+%@+M zx6L!u=ZO%{FsMaPggG`E%A2Jow5>=TD_}z5j`sIw*?}5!Z`N}T=p9c>n^-2n5iz@Z z#?Lba=;JkDPr&i4YaV`Sq(-Qd;}jHLY~cYM8df=`wN=29j^xq^1p$(lrH@fd`nkqS znOMu>&b{_aqD|%dmb#)(cFMzz&xi3(GVQes6;o-~+!#b6Lz*|r$}Vz}&7cz%vtrT? zE2omom2sK`v=S<0$unr4fORA#eb{OI>O_U}9K?Q@5`VEI+}Qn;!BefBDs~|j2b#}t z5&Dz86U|9*Mr2#5)@RhJpkpSlbE^E_d=(VMI)9-C8pK}I@Qvp zOTeDgRo&%ytBQG+Bj$1OcIy!%RlKpLz>bQRs*x7DjwPX~qgyb^XB)Jyv)Vhz%9y1% za(M%zneTAB^B>!|%4q8>o5@P(&0azs;1`VtL$+K7K+0<_Q4%ev@~|!`gi$BlcpL%t z;X(69!8Sx|R=Pm0+~YkP)T$`ivN-9fqIAxO%4bVW*uHmC#hg5>ps9+9x@e##-al@q zg|f(S+p;N+jVKN#E4L)1bOc^RRnhbAXyYi%h%y?}TkGQF)&6%+LkSiL)+E7rI^E^2 z=Yn6r;SOY!PII`#SXf9KJPaFoxy(eP;2N}SokZoKRIuO6Gm`hx!P9){Yy-V-;EI%+ z_J^fJ_Ciie0VD$C-W;(ODc|4lu4(K#De8j3D*UmM>!!S;QKYnSr{1010KtdLS%ZX# zz`EiHKWQ8QSt%R#P*HzolaTvfK_V*i)syk>VFlu?ho!)Lp-X?i94tOPjEB!!Hg1Qw zf_5dy(D+2qD@kbvn6S<{B{CH5l?r}rt&H|AU}}q9VMpUFBow_3hPSfHU*bVBYisCz z-@_?z@sz@@>~eCapW$>B4@Treq@W(F6;&&oRpW?Bi!AY}JHY9HPStYz9GMTK!AE;L zkQ0t6P?Q6I=`JZ2>!yS*IQOMCwUy02ZZqCXU>WBrx?VJh9tYFIXvDvS(lRiJq5ZQ3 zNPHY?Gf*1m8ObL4{1<+HbPdVA-JOlG)L184Yn~xJ^PgO&#xt2U9=HQ5Y@?ZXAjl6N z%xl;5$P{1-nL{4~Q!FTtMTD)Sec!hA=-6?vDbNKqA025$lnc|`prm-U&LW;gjd$BV z2Eb2BR6RFeuVJFeF;#ZSY(LTWg4=m#RK<_xb?!)2_=`Zy_BBnsu++dIhLj)*PQ&)* zAutvxrI5cJ^g|MDH+TybUPtjmQ(A6P1yxHkb%J zOPb)(PV2+6VS{CJ^avYn_T0pKU4G-+aFT0HJRv1dJ+yDp$8X>$RaNKsewdlgK>=Rz*NQc(#yH3Mb zkHY}IVeb{EI2$zT92&u)gq%knglFPn_5soffES^}jhQesS&$HJ09%H9ENPPvVr`Ef zOV4c1y@GF*B2bR^q1-B zh0refaVl&vm%Z#1T2GXsW)}Hbxj1fw)>q*0iU}LsuzCAAb{+#Vr-&6;y=mZ%=AL7s za-!~n3Q%Cwa&JK6Bj!eUN0pA<6~~S5xH{sxCB9#%=NJRB_R(jp>UO~J>;LYe`7fRi z{-qixdCPZ>)AOzt@slIolK}fez1O{F4DN|-yyng1N|HchIvO}4wmUVZ16PiCTSep8qJj2GAyfgiA|HKJV-*&- zV+;}GqubFmrcSlN;7yDJ95X%3Y_QgT*Gv9 z57uXS)==Z#8_K4DC8NcYuf-ZW+X&cQ$YL%lt{-_$Lrolu34>%_{A^n##Cg=e#|vJ4G- z4Rc}Lzh~WOsh?=Ctidk6XzX^SWGmgDam+BVG>Fe!koqFd%pr_UAx@Q?R?#D+TOv@o zNE;PZ)&|js`#xH4nbAfGpI%{y<7Xr~*&=nAPTOpwpc~V9zJr%Y?2TtW0d84|a&h_~ zy*t4RSdDbjzKCsA>jkTn)Uz*!xuYWVq~{7^&j$j^%?0x=2G(=@pm(wjHad{y&1+e- zGAZV=4$Alum7nX;PI%9G=iKaEV?Y5HNaTuu4IwsJ+&&9Y5L-En8+fd|{X#}gm6J>4 zT({nMnBtwRDIcm_NCT@=q=5R&BZZlYrs+5FCu_-tez4io#kxrHPo@p=SE6BWQ&_wtPrdSN|ZS!tj#-%-~k;H|6N5B~9+ z>$B^u*j?@$+ns`~A`AK-@q9ZpojGp>O%q#T_ zPDOyMpf=G=C{Q60RV$PY#I{YSj#l8uRhmN6E6hGq}(z z+;eui%64v-nrJW0)>(#Fn>jMeO&hplq+7!`h0HM5jWvVmcvzi8i`gC{7*kX7y=ppg ztl9L$sH5GE>-5+*?6i}ExqssgrbNxyZUiwn#*kQc($kEWneZ`jwhmjA06)Ob!F|0! z8U1b%edq3ZJ8R-t*{ii(8p(&tZ*F1VoZ*Wul7e=^^u>+kM5kclIjQQ(K@!TvWz9WG zAN$4k(m-J&<@i-tdK;7?Ws>6yOpq@k#3TZI?d6PcGVRE0uvsYE$l8NbQ|h`_EH}Jb z<8Nd-eKC|C1%942Mmd#+WkFn_y(X6s(}D(s=&G4I=lGwvwKkUHKeyu$%v8!(TIL|()DEkW(bq3TVZ zWnPwoOhX;(F+Fg***|Br(q*4P!MY@Txe}N1rD?ss2tH(K{RetaE%RALyiQ%*pvQC% zTXUpZEvaQKTc7SMuy|$WVMZBtAnUDPKIYP{=$%Y9DBz8GGT0$c5e2ReH`&P)j$(h` zSNSXf+#fsO^jC44*#$(EnM7!+vW`~aiE=oZcFBHi(8agcwSf$LPp#d3syZvUtu!Z!86=`@Wpi9$+k!j!$w5)cm1dOU)jlGIfNUzaM>pL zezsD&X}(Z)schI~I-XO)t>y@Sh`)OsxDhRK5!ETz%AC;of^9oyiuP0V{Cgc{d?#Hv z1n0A+nDT59W@qlMy#rX=VeZgO_RlAG3r8k7| zh;bovs%a*g^Q)8a!#hhjJCnhbwCTE{3%#_=%SXMaCE%RAlG0;txaun&)bt=O6z}SH z{lPb6-(@}(ToX*`N-L{8u^O(`StRKns!-Yk?P)wCSyO@NHW_x>OU7>s z5lCv9dC5$08GovmwHZPBQhEJ7dU`Ks>Sa?WOIVk4nsC$Z?H%>XH2rCed9qYc`_X9c z;znYRA@*39p($UpdU}G;+2QWMqEK83=Lz_RLBG0HvV9~vBLO7=_(+B>CYpu(P`?UE z)(~L{juRjYD5pkl2?a=Qg6+DgYO8BHufatnG?8rwpRL@)>|x0=<_!F+4%$2sB_?47dhdvJ6+PaYN*G!h^aD&-C{&AQ1A zE;4Q;I`*wny1{g9-xZDd5Stv?nK88F?0l88S)Y>c@^Gg-F4XLeyB$O$m-ucsj$Kug z+%w5ASwL@q2nd4sP*h@F!3=M#bj7S{HeaN++%%||JFeGR-YGHGxzPf6c)u@zLr zrh!P(pn!{BpO9mwZdX>Mtq{Fu;?fNX(|2dke)rW>@y;yqdi=DSHk*fq28VpNojwD_ zIU^ODRl&7mkeD_HH6|O-^ssv))7)9gvWkz}REqgui@H(d+sdS~VJ9a&u1A>Z)jr~D z#=9(G5i#H9YAy32w~0U&DGf~z>MqQPVOvEuCKfooT0|&j;@;1z_q7hGEWVU?Hm7yk zXggsLV^GLLE3;PWWm6Jg(K{3)dgSLCOes)F-*IiKE!d3VuFXk#{yC|?DT{x1x6e%4 z_oEby$bb>dcunfR{lZKrDMtdmx7RraD`#p&j6_>%4Fm=BgxIbHN#Gf z!|v?Tq4w%UdY4$hOv+u8eZjYMcfM1K0j%ULJ}Uyy1k0(81kZ;s4Wf58RPxGt+Oy9S zol_x!Otw>~4L2L45)_3;xd!}Ymh=mpWgo+h>DalZJ{(`kmpqnj`T`rR<0@WG5VB!Q zgKctF9$ln`eOPuDlRKbIE2Hy(R)$4oWN2>kr2zC5j*R9?QEnb$^J{Z>Lj`jBD1KJF zKQV(9eq}W9cAJS@ZuX9Bb+4FlH>@fqU63Z(ly?`8F_M#5544h`?XfH~3+$$UO_YjzIc2}60g+Dg23R?h^(({mEuembZzxtHE8nrWUz2Dxt4HeCJ6l+Y0}w5 zPS+=$wS=%{Y(NYVM*6XH(lxUfs)bsMDmNuwi!7N3CxqgGddg*HX$jw^ol2_9Q{{2# z*sfKvdI}mlEPEU3;QCBi-!%x0s^II67*26=e58Cb`Pw_> zsCugXi1mv0^j^b=85qs4)m@f;I+r#>UfLR~!P};# zDDz7iy>F`*cBOcGXvX{YPNnaHjY>wFv@)b3jU$`%Q^oO9IjmxnUGO6h6z327Lh)6L z0lZB{pL#LHeW^*Y5f%dd;eD5(tF)o*A6$S3qh;201QwXdNM|SNRG@X+xnw}1*47X} zfht1TaBX0jvoOq(>b~2FCZNkLeBGkJm<|aVaGO3lkZnmh8RtI;a~f7>rOUyQETBtbtd_M*;pbGQ#Gn$QM8=k!^e~eepyjTN6Uj74SlafEHRgZ@wQ^A zy^ChnSlq+s(Ra61m6^!;%+-GANHID#ETSi)N0SGUqd?tTxDC1qD6Yw~Nkd1is|iQh zL8fQ%|4yO21i;HDsuuhf(Pc-)MLD^}CtMYLn5nnZeyax8DVA?6VbQE$_y}nV=O26h z$>cq)iQKb1B2{;lIGLGgBkcD)Qz|kF^s#+y(i^pDM9<5Eu5mva2q;y+a~iWI4zjlL zRt&6Mjo|t|>};!T^bT>v#<`~*W(O~UndQ5VDKRd;>Ho!Sm_ z*bDYkwd5*+pGje4suf(E6uoTNQXkgurpVe>V?WsBw0EC`a8AoX2WVdkS{~^H1(u2o zE#eb0s2VfprLt{#B-eH;xDW^lJeSL?;M;7lOP}vUL#=^%EgMgqEL@|leJ)pls^(3d zHFDV5>%BMIzJ-uL3f{m*g}@7IB=!o{^pqBK;6&+9EgG)Mqab>gjt=!FH^81d%nP{k zCw>$=ftFCzFU<`~r|^KT=BA3BL->H{$=JY=yO0~2&S)c@#S>63G__V!9{njOmyj*I z3Mli8Pr10(lZ;Yq?7*MlzFf)CUFOq71vz$v$)}hY_?WbNV^gA2%>gxI)XKs5qA~bJU&|n22sn2<_yLLYQMmhO^-C0w-BU;e?^h zI`tm2&1FY9Q4_0zS2|Ztwq_qiXLv2T87f1Wuq&Surr?jwZI|V`*gj&(kk=k&h?&=> zj>AW*f0D!f!M~ml6@!@Og0C`NVTTwSZ+g}^^}fYi1Npw#YN)QHA)ITf9m)rXJY$jU z8(4G-@CqPRepk;cmz;>yHKK+{#tGuVJ;f*_5dY0evb=c+4vdV(&W`)ER`}VkWCGLbS*~&m=)JuC{{pN}irr zzO;}>$GCtpmLy4$OXW4RJLt$WYw69MR(v6VPFUC_L5RWL?(LE#1nUFDrg02s)8jKM zPNXBxq`|-e(?NpkkzzTna-LR6{qVIVwAcB^-N@ZMksRN`GsSS{mR^i3{;VQ&PhWi+ zk9_JM^=2lU3v%Cp#wr_c*?UMc8(1(L7ZEVDkpCT2YO~E^nJ-)w5&j(L#1P+yK`;&~ccTR3QUZmHXnAq#aoqhkoN+#fIQ7L-`xoPP1_g55Jqd)2AM7q1 z?8C8epD(K)gFFLj(mV?|6Ig*y813uviC!|upnL@4i}T%9h;|@AbDzl44$eg(&V?)n za1QN4yH_Ooc~n<#$>ek>OTG23sL_qaTlungYLFJLM?wN* z&95VoNY~A8)_f%olG=(fe`Ni>v?@t`C6si7BbVjq6y4jlSxjMKP1tk&Vgj z1)0JbN@gWX94VT{tjIwue-AW6h%P;h%KH0$Myc zo5n30cXYN3Ejy=B$yjPRp#40~tc#thwwE~UHY3x%OJzVhg1j$7;0XO4awM1jGS@Vr z{(^#Ua(>T*YrN%Ut9)N-*>^z9^Y0AAG+VIw z$fU#j>b_@uFHxPkPqfyuMYuBLg0K0xU9+l@ ztL#S72;w8NEmkN}i4rBXV0D>gsO594*mKAD{S8z{gQ7AkkM9jyr{-%8HNLy~zI@bC zi-oZ`)K#T1qnSTGoh}PS&K0+Ys3DV`gQx36Hc`Pyu2~&Pw9o3nBhD1#g*EY+$}`id zjZ^ewnbLJ)_4dXQMIQx{AHu{AEJxvSl5K)loDt5!+IZogwr<8nj#P%2wd1uIVZK#x zXVq7h$WdzNz>u#m2MLD!ZD9^KrBH)1WPqnEABoHJ7}*-tsBg)44;;hh=P%418sLEj5!hU^#tEi&XK z&6i-m0bN#CEnlKMF8Bi_?u0$N#>(<&yMBtq#=x!*h%~bF|q2@UW)KiPCIG z%{cS7e6n}$Uy>A%rh>3Q`jv3Qtz*a-XTy+FL~pd6{`y)|v$iX?R3{o;8{4;`YvvP$w56T5?OzMb{4!H$#e)t~-GAGawe8rT?$RY({Dd_uoD_>r8F@PLxZ z2lf)x@J%{Sl5sGX+5%ivw9et{O z(Yy|{3CgEh_ zB?wGwyvyCW{%%qT{!&pTw&vUFh?zHjaxuGUnDpd0Gc3$`Thv3ug zkn`khrT@Tax2GOcVzD}1Cm${9ZhtDV?5MRmfNYqm4sXw^T1~exjZ*d+IRI17$wl8d z%nYHoF1qN69Yw%NU0%tbC!pa-B*bUKiM2?M>d);{&Ui@^MD{wVG!y%_B@ zc&&OtO!YQEZfgNCecp&mVpPT^@=$B!zECycKwzDty7JB*%n+IY&f6n!6g#eeBa4=! z`vOn-GixD>eMM@7kxUbfvZ*4;UjQOXC7UR+Dc}g|j$*=J=Usify0*g~`mM}$VUM-7 zdTA_|LcQfCTvz@@^BWB#DU(-{u&k>kNqyS9z(YQ_8$dP}1lc#iNOiYCN75g|rImPLjZBbP&%?U| zA))kNb){V|(^{y`FgaffKjt`bv_efwywhk!(;q%RCYIN36D8(1cY0W64@war2 z0tevxauS^pdOGNo?#H1?H4&n|kcIW}63nHONd=LZ0p<;FgJBmPC@9xx1`~qIL69D2 z%8gDMam~?M`H=~?Ku-TH9^Ghz=|dAC+}aD%@)nveTGJOmjfvDh_QZu*M~e)l>qQY}0VqW^Cf_y6*$&3g8HpS5wq|89Xp z8G|3=_KjEpL`2)>WY5y$sT*zDkW3KTg6Jq{O^9$ZtwDxQ9P6y)iZOOF&KsInLySbW zGGwUU<+1qGXR4XJ57cNpl%8uCS>PWHnyLyPq?rpv_GZK1BdSeq%p%^RcP($B#9wiB zs&vLa{eU6h_LPalYbV5P%^v-oKnnlT^a9C9i$OIIhSTcC*w7ShWsDI1bOokexxn5! zC>=<@6|PVA)V*kQ_E)LKyV!b|@q@>G7UJmGa=&2#v`J^-$T3RV+ggL)U6*)uCSJ}Ew`?_+6)Se3LHk;?s``trpqx|7zm;RSMTjvqst3FuvGJX z%nKr3?U8wP9+=9QO%V)>TER3whi&ggU@scpWVla@?t z&7rLWd^d3%(P-RiI~@Ye3B(NN90U}i6Qf}Xfd(w;!g(TFh<`+S&pXl@-EH)huQm&M z-|`-!=-L;9$ z^db6TyO*W#Zs1-Qy`occ#p@er#W2~za5VK*gGaB>TdQ7L;x!a7L}$J~!h~v+Q%BQ# zfq85JXz~iae?US^hQ5pHtCP}xYrMKhM3ijTY;`wpzRxI~4KY6Gvi&Ar%bT{4XyBHl zaIWGN><1PKiIOGrV6_Y)$0!#F@%3OHQkIibeX_K$5O6Xh3a2?rHshT>V1L}fhQt4W z{XY&&7*BW}C+1Y;@=x)mQc;GQSLfXD;&d3KjYR@*9p~ z+phlsPk2h3i$xbmY1GoY=)Yl_VH^8--|pr3+u5G#GGW1NrB%KExwz8*_q_#El{%9A zR$e6#$ce64^D<3+vjGjaQEy%03igJ~{q2_tcfPuqV(x3iO(?}d7H3;&t5H`0wDGg?CB98ufu!9&M7BGF zM}XT&PC!|I&Fc-(U%;(JuuWq#Cb_{zK{>E;1GT%hexC((8&N_#b*~G;RXB;UYSV`NMbaKy0KL=G#%af8$L1r&x6OB{ zV`rA?m6o2Fg6BiK0!sqz=3>Mn62r2X8Pw}^J6)rClRZwc5wj<1`T7^+25^iU)Aa<~ zEoEo3U=*k69umBTMm)+l-G1>VvuAVs;}dUrKe4*!V`UEZghvZmp-0AzqY5E0+});) zji>#`R{h^SM4(;H_P+q`m-n(RePWlNoc{vsj;Y>ve7gKp;g6D2<#94~9k1{)UhWUc zhT#sis)VE1tFJE}uWoL{*nX&s;NQ_dAD_UL_c5&B#x$GcN;ejJ=RrezOZ~b#-BtrU zPRG?ZKt43ptXD@}3+_NSd_Fh5^QI&)?#Rb)(Z&9;wK$ZWk(Wx4U@7w^V%}fZ)fZwv z<{sL;HthmU9N_FRrvYPAbsV;2%N23jI!n4n z1x}G-co}oj7ufGS%9fl^j)gHBvIMGrXuCki!|knx525FnsGg#gvB`LlU|x7ReG=dW z1kxl8l0Gx)!aook{ALK@2}e8DuQ9KZK8agQCHF8GQ*0Eqad1oRs9I4-m^@p0w%I z!c|hA1d_|u`kvDI>6bR+FUANWqK>qey$$%NLUp;fT-n*MPJxwp)%Z4_CJ=kna+O+b zEKu@3MlP`5t}F+2K~`Y|kI)?nHPM&GH5+ZVdj3O39{PMjJ>`kqa8%>2RV&S$a7$UP z_qzRu^I9F;@cb1`|NZonYRlX_4+>9&G3XwJrpEVp|Q#4>IVguHqe{Gb)tk~AmxNMssH{8Udn zC!=nIUMU2+R*+9cPXI5a;6Vr==QI50CM5E*nhf;#(i+Ctc$yGmRZnA4Vo1j+HWk%fVR_98}1TgV>lVzp&dgP^= z72Y{m)%Q4D<23J0HS(^dvj8WO&}gC9Dn1J`%syv0M;pA8wVfh9miMO8H63q+tIt`R zQzh!NRw3qRwZ`zQ&l$j*SNPucnL^6qqb)l>P1=a$r0Y+K4c>aydSVX};@$NpDiCUe zrDct^!Mj6P1%35rz5iU+TrbIG-9B{BED@+(F9!C;ztsO#yZ3Gv>;o&X2#yZNc8-!-bdmx$o6v z;`+n0E=jZG=D0B4)x7=Wa&EalOZ)5nr?v1kNBvQn9pdLbPDhkoE4!wMNZ@uYtS#HS zaKeztQNTi}9@zX^syFFOH!ntdN8t1Vug0hB{oQd&?@Y7-E`=nJ&QUhjrOsA?zBAMb z{#hM|0FoYh4;p>o#O?bM(bi=w^KJsBzctg-Qo|vPT<73s5pEOHwiXg}iW2jVN*e*>L>ZmZ|Z-voT!TBUI zoFCI_PT<6j?=;QuDj*H)<|C=*0#0;Bb^BeGoxi|3jnbxrG|$;VtsZO!JG*-Qzny%L z`ROH592L^4tEsBt%cpt`ZHny_NooTg_Fa?vg4r7=5-3w|7^&QhwaQFfXl7J>g?k{V zPueO$C{3=@r@mPqt6M1&a8o8=1z!z7gf|X9R;iZLHF??G&_I5M?5&PN7n@0GT7-ML zMr!mGJ&MZ4%29Ta6pRKtYa+|3R<9M`wf+UfQ7@J>2rFOe{uvLm+~?{ved30Wn)-je zGb2dpy8U$4%fu3R@)xiYs(6JCYX{+1d;fxdLE^-WsCd-Pq{gG(V=oCeCxHF=?s%LXzbg52HmwVa7UE+$r3 zb*8OY5!DPm-WLQXJ1V~SktSz_cmm~*CEUkyfw0@IE=|J8y)ZLl3&a;E@=sWGnRdoJ zVn2w;wNjVuv5$+4ukJhkEa2(lRg=ZlCAbJka}{AQE@-n3BfW>-7Fuq2VDb|R+AU3{ zX*>JJ7MQhyqQ_bXjB!NjFImMmd}vAo+R#NVs)B2h*kw&4Th3;TY*{r4_wiz0%2oRGQF!IxMaaJ2>Z|uSetF8(aHzGq6SBy z%#2NG%ooDkclCI6BjnueU1g{u891$u@A25EiOSJVlLA9Cy^_h}2{-v}c7twCmVin` zVof$Cf#R{gRtM9(RY?4^196n>PEIeSz+?D%WIC#2F!bmajY~jR<{Mu5pJ4ofu#@(WXU6%MCA*}fP7ny zP;RzD!Hz-i*F}6R^2u_d9}UH@wRWPpUYaEtjJUN{njA?hY%I-mjNiHmqzfOX8ZxCV zRxq*^1?+iWCUM^JwnFd1fk7|1>KX35vXv`FBx;{{En`cw^@nQgo3UDoMBN`6(@wUB z0wd`2{rC+pKv%ZH3x)KYCTv*>?-K_UV$=ebGqn|3>fs%7WJ!_^r?g~8or+GIdd}$= z3pFlIhRW@UHt&CX>eX&3dQJMCVI_G^8-mdw$ppk08W0RVqo4z!tQ~J2^GD2Y_N0Jk z5a?0ZH>yVQHf3cFxfZcTM6hij+bK*QbGlDK2IW&lxbRzZAh&FE9$l%4cw3pPl+tiT zCWuI7gkU>2bx-&Wg@qwVB}UmSyV^Yelno>u^jb19?~;GNP--*R9Txgk!BDOxT0)A$ zR~)H|C{`SbcrkmIWuk{U;o34w6>lY%s@I>^(9Hsk``n#|h)&&v1W#sfUIwPBbM82? z9lnBy9VHdL!??>MDyA6D-OQmG!oQ4>6^W|Dz3dfmVD(jhT+o!sBEMV{lZ4Q>9 zH$mTJ@|X&`Qn77el}3?yGiBr+)2I4>0Vdg0-s_oO`es0aNNjerDhDQRxugttSvySX zHezUqQxT_|Dj(sU`)p`ocRU+TFG+%@MjUry0!?=2CIrMcPi#~vay|E`wDv(c^Lx>f zW-A%_JqwybPqv68?4inI5S=%N5dQ#e0qkkwJTN*OF~9e+v8hZCdsi>P&;Ls<(&{(V zmiG=Cm7;90C$92jtNxXnVxziO^nUS%f`r>)#b1cYZ7oT@u;ql)f637#=5*hq$c}be zDbXcy<)XcVz`wNc8B#M>|3})m2JyQ!fy+zkKPW9Axf;aDhqXEzmBN_8!Azdj@*gMV zX_``TUYIt<(i)7L^!pc@!a;tR5D2|Ai)#FNbMtJ)X0{D_4GBo;1RD%jt>IW*-e*0D zU39k1aDrfuxMEYGg@DvJ3kg2CHmGE7Wuz{h@rgymT6FAFtXIftB&rq`rMz4K6;rE~ z&HD01l`rw%2#U0~*nq;2TC2W#@Jb$=+8-BG>X1YaQ}hjILAfN#KYx|y6jpn$0K|U1 zA5NAzDWb-P7GC&srD20RW*90vvDb}3p@L>&bgZxqP%uz#nxMG z0wOnIP{;MDEsuzD{*iL{Rv_@DV7#sTn%agZ#Y{-H#dom!lZ{S#j?VXLaKqdB8+1Hz zJGA#(6oEd1Sd8&Kkjavb_QocUgVm|}5A9W{thtZFZoAoYS_;ZB+d%~(ZmneC=LB5H zJXF(D^{x0iGVsOr`kibjB2&zhpTDvm?M@+O&#`};W6&Z*`MsT;f4ipYS$0UMvVQF$q{yVxqieSa{>eY0`t--KnBi{f4g7a(`Hfkx>hu5u5jW zfF)Yv2o%7LPmfKSs^TRPuDa5XIkrNmbB_qPtIgo`7ZD{rpjjHx8M=1Q)Rx*e!2tq~ zOEbgS8_vvJFAAh~b(mzMhMH`N994t7CKHh#P3*Pt(1sRp@=jro2Y+I@9C!8A?3yu_>xi^k}2uzJcr3XjR{{| zOI?`V;I?*VqP`MF;BTp~ZDR+A;fQMJ`(>(*yt$0eQx~GeV}`lTeI_!aO*|VWs-x*N zB>*h?Htic#HgrB|vJgbPhDM_~;#l7O{4vd51vi}v=|EHsY0-P$JB%lb^vCI6M6(tt z&Ojd|>q+BjAUY#m=L*YsAf3kjoh%%?bY^unPT?fm&nPIiHL>K8?B6@wD&LxACg|zafC#SLlJ~&smX*k`nO23RJh#OXneXWEmWOr>x zJ|mWLxLX=ls>^L@P6OaktO^j!&hx|tx54I!lMJa_N-xA2o+xo!Jc8$N*pPp zj#Jp{i=Dv+=SdEukr}m3_nG-2f9=ak?{PX2x#RAVV97H_C}Z)Zd*1 zw4YQZ$(Ag-VzZv|#ZsVA#-Sq#p_N&%Zy_Sk5`us){ePws&mF!KZ#_4X$6LMiRDW3V zjL%?uUDh^N*Iq_0$>13}Aar6;gT0;JZa(&g7N&??wU23Ql0vU{8l9Q_)ohZX2Q5f8 z*@=53@)VTQ7^+%X-6`L6ib*NC{2CGU(_}g@ZL>9XTZ=voY|CVg zAI)EPbn;cb#jjepl)bpj&PNFLolZyv5-ocgK6brLdwl@6VkjG_(?#01!fWE=@N3m1 zFzHuW;zQzH6d%o$&3NgvSn9!F_+KrbPKSyI`rvG@8B-SIBWlhNd-sBt0>-(zEX(l( zATlMmrPFIz6buLpth_L_bbjz#J1fe>qYau4av{@IemeCVA6}QO-!pfM#vrD|{QmaT z1#Ws!di7v$(`5tu1^2jc|E)RQ@#)a;GVmX(9L{&zB6A!ST>U4Ek7@lhmyE;alLL#( zI1<{WsD&7Pjj6mzKfQO+@JGjREe2`tINbj*T~l%MCsen;&rbymjW$ahaxFX?T2Si zZP?f2v_wg+Q2Q0)(ZHT>M${3`Kxv6Fj)`USUnA7eUve66Ni#EKga;ULEf#O1Z<`lt zZnS*^n%-{mK39ydKjnM{d$M=^Yk>KNfd+p8{DKi<+Tu6V|N50_vU%h2AKR_}6m*My z!+ekQleo}_#ivd6XXC9vr(1_#^BdG0D)-|7|C*0{kv9-IEyyWpmkemIbTwB8GUEI(5JUzmi{ zlNxRDhp&Q6hDAEgs@E-o*fzoHeh!XjmP+x@mK){N-p2_yxV3GrlO^}nyX||wgvPiy zd4zT~Ut_mPUwkqTkn!D+0Mcb+Qs&@9|zCq zDw@pEG8@N;m*3H9Is?9%jYM22&4=0DgL!iNs5`*!3tTrD}m@2v2o`(_on;q zR7WfjNZZj16zYtsn0U^MmwYWF7~2yQLc?z!nJ^6=3?(0=Rz}(8oi&hk)PrnaDe8VHA<8_U^+@vmPnq@fqM}4;pYfA87=hi2lGliPY*m_|5`7 z?z2On8c;xd$*BH9gujW)C%Jue)M~7ZW0;p6F+Is$mI-WnSJ4TiDWnUXJt~hff|cj= zwpqFFxu4A{%qsvAyTyR8S!9D89*4f9p_m(XMM{iieESRgG_ix#c9PLwp((Pb>N06( z%a`@lw2>`qQ+U8~7#AuSyd5DVIc?G5*evP(OrdNChe)= z(&vMO@@84W435EOJ3~gpME2+k+9)PMLQqJb9IpEV`rYiMEF2!9ve<_ba4)&A{fWJ(H-h6c8sE6Lbr?l=-rq`}WmhvoDXr(KJOo6lF z1ufpc!@s2wki-j|HIox$e0m&L=J)7O#2e{x1<5u|gTcNvSVg{7d+n}C>Qul=Oj4rj zsx82$MrIokf(Fagfrea(?;ffsAd$q8J;J$?CQ@_1v+~Mlr|kaG@A!o@H81uT_%nzl!$%(s69r<%E zmP;t=>o%&m|C(w{NRcV0;;o;#2w(?`kd+wzXP_#dY!Eftwx*JJ%k-F8eGpmQzgk!< z$2KNME3ogtG5b3-FqQxnnSsbQ0R*pjet7G@Z`HLaL@MF#I|2Sz!6FBs@%SKeCsb2(%W; z8=5}Nk47uYzc(%EYTnyc4|5THJ8zx6C*u(8i&_9Q*!KEGQ4vp1}1gL3kL` z6xYb#KszHyv?wNWQi=2w$3OEXCo=)fs1>Pj z3|4r-NI;gHev)bpFRyiYc~+rasiS+Gu%s>q&6UBb!L@CtMGQKW?A^o5Y3#vU4y%R0 zVAa+$0k6)Vi_Waes(PKsGPti=2@jKy^(%qmaZ;kd8?VVSoj zG;{BjJ>NK`7{L(xyv^W8UbQU~aKcKT4Z>Jl_ZNs+@AyrG!fQF4%p03}LnIYj>gMlU ziLo4E!D}0J##|l2jr*#I5B3uq?i*q1ioSgb`}b9fLZ7PzwhDtpj@%Irds$bYB~H4? zez{Uj{M(RV#Hz_Wcu0{zij?Hqz+3N;3U(N{zyWP)ra4y~^5h=HHQoB~9Rbuiu;5iDnS6!d3%5QXQ%vpaG zT$9IZ{E>jl)%aAxxw?MzbFj}K`X&p8hnq@H53{j}{dSFYW7TmQYGf4#(%oV%Oeboa ztD@b#H5N9IQylTB{bX^rz66nDM5X~lzt<6oDWE1 zU65y06t6#AD6&RytA%KZ^@46LQ>Mbb<;5 z(7`|ER#dg)tf1qP-wQ3D1^wU!w{Vp$)O<#1Cgr4cjtU+7Kudo!I&030&Q2GXhm3wq zgZr$+NnS=Iax;S5FZ$*k5e4<3Y@8EYj2X`l6- zPvA;xqoYqSyYZFzHF;-as~8J;(!dB1b~7OPa{=%q^KEDW9Vr^E7B4;yyZ!^j@|ghi z9eXA~#*u!{kY7!SZmxY@^_S1!qJG*uF$p?kGkR?JWid-#H1joFFzsi=oO(7ca?O8e zNE1wkc0zpx{{kLqeOptp@;q5WOh|8dc?Cy?<=it)u~Z|4;E6y-K5Vqvu7dG( zAZoukU@S3?k%@?88$XgTjUAGG&79lpH1j=GkW2j$ePk9{$1YvuvhkKkGbJXpjj~sURU73^xjEn@1DOtZ zf#rdLpB7$DtL8b((|OW)M=pDe|4JhvS$21(d4N z8^q38G;d~Y%X%M`2Z!64BAnUlVwqA_Zy;z1-ISb{ZI^_EAWclZ@!<_<%6HjriwN?} z$XhogBZx()XhVahQ*wuMtDCT2eXs|XG*Y2~7Edidg}FU{4McIn<&4zO!uzLsu-2-e z73nh1)>pKEij%@_G3H8c^f85UHK-iD!{dtv>S@`4!sg0&K*rWLYnz>0Z{2d z@2iLQ?QaaJ*?8gffPS;Ylw~m)Su<$U)&vt;Ovi0*u-88sH~%8JYsKY0<-2vo>-_~( zRUUs0{LTGvb!dF~d|=7f{=qc<)l>POTG8vKbJ)M54rBE#7*hBB#dLFRQ~9TZ2sJ&Q zDnbovY|h8B&nplY2e-H$#bf@<4GcxjlCLkRZH+iJZ#XevSL$`4Iuj8hhEJ-Q0tn72 zfBJTzixs7dnLc~^V=MtRw)e~Sv4||#tH7Mf16l&0-m6p|Xrh^&0o>8Qdr5E6*^n*j zM}j5?iHog{Q~k9cq6xulWwKS}#X1FH-hIf)S9k=v=(9gc@&-jSoI#g53KfZR(F*Ef)U zz3p<6m=M2uy#6~g`n3{p(szI!Fwi#B%y|x_AKdh{(ng8--imRwuFETX?P1>-sUYgQ zdBdm6c_lLvM(5lSHBH^5C9UeqY0COiK+nP@ym7TVH+8y9K<1f1v=TOG7wNe>*LbR_ zFqSUaAnzO<9c6hUc<-xZ+U>a~=tjd1!Wb$N`MNM;AiV%+$&1SAg=H$d1~R>SGd>tR zT&#Cm30r(s&ah|koYL@oiXa_?$;WGre^?|on*lY5kJvx_k;hj)AS$B~iCVAngU@Xb|~bEsgRSNAC8;iJut5q+vG9rbY3zc4P+ z{?J8MwKnx!AGpx%WoT(AtpR1&l_fHDlWdjpJ!0+5axmI)?_uBKcNWSX5KN;<^jNG& zM9QWmwxM_Iy*qL3-gM7>{JAnSl(*6Ln3%?<<&<;m<&MU#C}DFrWN>=KD&ft3eUWUe zI|4e`PS2JdZA4va{D(_4jXYw_l$-)s^V-`ESaaZPBVt)~9dDCuE{ZB+U%+j31m=GA za)81;=9l4RGsdqCua7=UNQe^mKEZG-C#khU+XjDb1V%%#tEy-d2Lky(Bd=keOhM18V z^9m?^KskaMn6ZM9|Im-Ls8g5oC(7Pkf$TJG9*0bY8hoZ4ALhA9R@|f+VH)zovqK2s zob+s^O3aI<75T$H#@W%jYQ1qHqBR|{por;H(zp(%8EfoMw`(8#DkB-jMOuT^=8q|N z2B54`7(O^cpQA?|dI$+U4=C+28Dk>bxC}Ay2IW!h*NMuhThWF zH;G2-{jchQQ8bGCM-}5@Z`s>XOU&}{-~%|Gi#oQ8t-{wmNVF@wqQD;%fU6TNXa62Y z13dx;(-lQG*wIHiiA4^_((T51sB?d4Pj+PaKV17VT3aGhZI-pU1?Hw2zD%PpTe(50 zrk%hB61hs#%Vwy>r}4OvhBfzl#&LMpCSIY&NJpUkX`asRLkk|gqI1?O-lv@C(HBFq z2WK-n9?((Lrr6qc{o)9ZBKt~vNj|Z~wf;45QQ*fF)h~n{n5$@p)ud@U1aN9}H-?8o zRgob}n(~LO`i^h2_VDGbbgV9CiUyhs;Q3Q+nviGRfe0b5;`nR9krt|YLB;a%6uNc-xiDiZd4)Ewx$&{!{x~U>*NR zuPoU{gyY5yn^U??S}I(7xOO#a-A4rEBj|A^{@j6T>O~w4| zaYPV(WpT#9Nt;#ohjN1JaYNz{X5YNVT-wHuvka7trw^%Vi7+`1PbL!ze~yYfAdnRR@N^q z8iM~1v#V8h6>WU>@!R2Mojh|xDEhR?iqC6l1)xqz@H0Z}6b2n^c{k0KsHimI@mMJhK zE#0HI!a}c=`@myCFK0zAzSTmE@as;7Ay^0FZr%4UeYfZ=JVegor_W32c-AnL*Tz05Xun^- zz?farPd3a^ser@AI0T|FC{SMmWVKB&t6O=5WMlzUyg!QAC9kr*G%*7o4vd%)Pc?0+sLE`uV~YX>{+!ttMbpY5W~8W%kpZ%W zv-94R#wOb{Mz*m<_i?1DkXA=hl>_Ndk<<0fD|hJcg_*)tp@=lb4b*jG?B(_b|M3k0 zZ=JZ+i5P`_3*MCrB&x_goZrPd&@E}p1!2v}bLG*!gWZ&|$PmQWy{SKmPU&o!NvqjE zljOx0H|hn6WxNsFsdi${&&5%(yEbG8fht>8E8Mw}>w>iTzGLOFulX4E3dx9{#VwU9 zl{XaWl+*YA0+6?5)hIX|0ll7YSDH?T2b7&n(#``{$ZZ=WMth<C0CLs7d_N(@JCLb2|8 z!qRR2ajRbHi)HGfGTh(Q?;Mzcs8-~~^ti=Se-di2`p_I|{{rw8{sJ_?ZC`aynrfe= zIoaBU=aWj4+Z~+h*tIA$uMXIH^*`4}94cTZIZPG|fpHwCRT}b1_e|wjcFhp+y^Gai z?zJI!JB@OSaa7GhTOWwLFOTMMohAlQtYNW}hvpEE*|P&7c3JC5W%ZG?S%KB0juF1_ zS;ib~HOuqy;eJ&1=m^1J0v2t<;i~VEW9}R^7&LNiS+u5=ZGOsT%>t9F&X$iE?Mf=b z;2VcrG)v5c9>eb`*{+I|1oV8GyW^eFLww`ujpKt};S0232;Mo*D~?IVKWilBOd+(ZCDh)Gv+%4YeSGGoW>H8c?a& zB9wP*6#jf+_^;|JDQkKa6_MLif6yVC`Q~v3hksdVvY)$k4pCx@S0k0N7DdDC z@^!bVi6?$qyG@J&lE^wJG4}&3wn+tM1U@+NC*#e961(i|y6?>m&6?Z%>Qa z!0oHyP5AE3`F$M@-E989Ix_th72!FSxcX`7vT*%y_p}^=cdY*FLyLFWFMonRxw#}i z@_hq%1y6qddI~&~iTqLaM|@pW`;R!rGg>+sOARFDG%d!C@~orW7La}U$}zR|yGG~3RG41q zb#pd_4u1O%SI5opGD4}U&}Wpcz#e*bnv#RM8@gOYN|OF6+@v~?E-sd6bL|~(sa)K+ zZJMFgy}e~)4E0+z%*053S1;N_4&9U(T`z4#*$OBsS~=}mj%6$ zVsf@Y_Ug@80Z+JX zi!6+%0PQ*=0`r*%l%#ho?5{ei9x85F)tOgao>gAC9iQ*jOU}bfeI=5}*T2WWB_v4) z1o1CvF+g^+uttRc#RI;e)Lx09v8C_46^dL|9RqF_tqI)w5M4JY3*&EizsYRuqNTSl zQK5**g~k&8h}DKZ%f^LX zd41f_=BI;iP?nX%P0Qg0slg53SPY>j${g-PbTZ7?s)*lwB9Q&JETm*fB-dX>@xFu& z__HnCeQ;cV%wh-VatQHjo^f z#J?Cx!V!8W`D&hNrjTFln%v}U>^VE!Q)Y=~JV{X?nIklYp%KNwt_tSd=OKv39`Gxr z&Mj>EcZ9a6!}3g>8HmfS=v>PC&0+9!RUq?0E15wee#g?sZ88jRheFrw6r>yjELr6Z zKrgi(@oK62TP)8^*Q~VFzMvPg3Uwvw)#kn3dAW>0q1fmd^j{0Q zGP0LY!b$MHT0a=@vu^&ij8ojpc|%ZDB`h%%iHuBmgqbKv>8q9C z6zud`|KVb_d2uKhmSrHysoCv6n!#?_tjlxKq!oIW0koY99pU0W$+CySIH8$+Vsj~0|gqd(+ucP%Uhea{nZ<1xM1w$}LK-%tl%qJmVhR#iaGhxp0xF=2)R>ZEl zm>hkM*W9wommmO=3j1n?AU{s3oyw$~7QFpPsH*V!j3WwajhkTcQExTV0Jn#gvG4f^ zjI+sh3%{RELb()JVGe;k*TwK}W!eSv&^V^9Vzcs*y#y{OBvZU={$=YKmBswyh_Odd zp_K4jj*VHd&B?)<%165RV#|obgPxYc`ll4B%f^Gdz-Ed}FDT>eFOukyM&XK8&(zl> z+}ou@&Y0B7#3KTEFy?Aj6E^Uzj!8Jgz;>AL7r^N~G zE-fy>B{;?1odhTj#oA&mrG4McckOY;ID4;iep-LRoO8_i8S{DW`?}~%64=^}6MIxqm&d9q zQHqLQtmNS?`P#tPkvf7{*}7p=1$u-yi+$VEDF1HH z*~LxJpkZ(8O8m^QBVb}Mkr7wV)M`8vg6sXJEdz)xl32nyboHc6Il|GHBbUwuVuQYr z)v|CiqH`AIAF~Ufv%*D1KrL_#z*@%8o!G35gvTdPO^XP{4O86w7vPHd-1FfV=>Z?l zAGWoi=j}luyoL8D_qZRChL$B+7g{I**J`)5t?8EfIA2X=H`~;bmpqMG-PkM6;h7(F~AKRMNFA6gY@W;{e6>Cp&*YayGLu{NSX3)J7ciW?jZ5g#q$tr{0 zdSd)Vaf0_fkjsu=(zIA>VGN+<&in(?Q63F`YNs^P2D0%n2NpJx;oG=A{88ojFocCJ zzEfWo$C)!O50S_3p#*jKiWAi9ocl=wcTE*p zR*&RtKTd*W{g?I{e9WpxEeu+u>&`sCooya1!%Xbv;%d5QtoPT72W7J1)-BuHL-p4E z&|xRBoxxWtw^^V7&(&7bz9eaqAdRATDfpm((w~*+2~hPkQ9r;sbwy=}CUD!agq_N* z^=smD(#CIy(^f*{0pAxGgW1+MdhlRz!bJuxWs~i^%+H)bUl({?0xXRIk|rJpc6%xt z$2pdvYiN}49U+k$vn(^q=fk#${Qw0c1bJ}?o_935@C#~;DT~*_ep)uS1(_}!m93k> zX6zfUE2|ld`RE-M#*-k4%oO1LZ_*@KSENe&hX9s)X}X4J0aX!>lMy;PfEWQHkpG>4&>oMxXHQ}=$(eqYS+Gumzc8`wXDx=bwFEE%a&b4#I z-o?SMd5m>80rd>(Mg>QWYBYEOcbOG>Y@zfqNtu|F)kB14nP%kEt)^}9Rwe<ltN3bEW*egSJ=!(?AxczWkYW(791Pyg`sz{@(o=eUU zNZw=tt_mb)H)3upZ7b8Fg#gia)FLivHU@s>}R!DlPkqT zTf}C-L?7Ol|M z<_DK{>Vk#e4`YtE7mZywnWUOuh#xhZN(_{%;#wSvuNWuu8v1tzb6J+|vi$S=iGS(J zN~|qt6)?2;gyKFcQM~g_pyC(ZDc?&zt%uj{>1#p0sk>FV1Snp*jD804Bu^R zvw5f{Zn0-&+ymOznOI}EU4V-oQvwLEhBdPoqiW{H~CM1-|N%vTE)EYcC z-s)Z9^H0CvZ!fw;51`J!*iZWN{Z&_%)iH`3&B=L4s*=%8Yhd+E2C-e8RT#)vPLfkk zz5ul|;xxip%xY?K-{sgS<1`w~QVF$(oglkQYhNnGW5atzz4@2bc~2va z=}!Ck9#>#op|U;`Rl1>w*#q1hra4DmCqo=GN)`#p*~An^sPN4Nxw8hD0}=2}^%l>;ulE}Cq(b%3f?H~ZrAhqzdK9Z#-zT|J~pnyh; zZ(-EYB1Y1nE3BIk-ew0&$LDHftM8ld2rfxoc(nX3yo?;=iyp}3Kt%|lVXv*+%hAGz z8H>37xv{U51k%f}v1L652hy^$N#cFI8_0o!*y5-ucYI(*(Uxb}zbMAgnT7Z0m zN{Q4y1oAB(^&{u(SEZ$*E3uwIjz)eag?ZoOP_1$F3yD)(n5;zPOv+Re4@}#regN_M z7ZpkO@5JRAi^Cp{WzqH{SM87f^4ofSAO=(xwPNI1)1lW-Y^~w|fWqO|k~HV|j45{f zf^$)kPo6x~GH1Mr^z+%N32?Fzvp;X?s~Nlti3Glx6sEWDns#>_X=hNnPmV603fR^T zxjrvC=hpLaU;8~&FY$@Jfr&CZ11iEEX|(plHJ?gK1|8j29X2x6s9zZw)>>cvPje9L z0{N~J<+k;CyUy@p%nzqA3P|t#nmbjT)F3&>@169xDSolLHr!ipwR89|+%yd7F}&); zLZ%&0VtDzTt~tTg(_gq(yOMILNt?zJ)oRrJ5cqOLhx(!Mhu_q zYs*}cxl7_2(qd+YgmUIV&#VRh_gd#Yd-2;0QU|Qyyut!YK>^bJ1Ri+HD!i`C5*bC0 zI|DE8S&pGE8U>1QfQv~&A?{?cxM@}+x|u;xTstloDjRvgMWNUomzvz$u-!IA+Z_KzMn2c$ig<3m8D?>eb-pe`sCz_jkh7C0IG#6-9!is0)>L9pQl|HJ-wcUN%KQ~Ggy;81qOMx`Xm(hVZD3rRXeEH(LPvMi%Y?x_= zwO+QPhGUo5X0&azFvp{e3)S;?$xcv34X|r+eeTMEcPumGn(JgH5O!1`f0@=){tFPL z^tSG)|5+qvd{I=!GUm-?}qm_&<`qQX%AkOXn#)!hZZmXfFqYbKO zaiC?iyzAVAEX1kH%!7I1@8|uXgwyjsA~vf=9S_Obo_~`57IE_~O41GLLzT5Hx$`PI z6>VU)pz#zfHvsmr0ojMqcs1~-1Kz@<+Tf7c(jVRqOyIJ2eRSwgrUeV=5YMzyLn2pa zf4WGgh>DB;ek-yXq&L;``0WB3q~}k}xMyQuLEt2n2_995VdAI+qOX3GkI+)b8aE-B zMUxq8NZsJY3E5{;>4TCeR>rA$+U&TNZOe&vPWzQ zs@YUbqU-vOr=OjmZ((#&o`Z&1x#6I-vA~pX$!0Y3?D-NJDNwG~VQUFTUhKR)r{|-^ zN!xGMX3%`eQ=ztk6&w~IcJ!uCVca8O@H^va>F#yThq(B#jx74~suf+7q>kT(sy=Et zWJ8JE+cY;>Zke;umELE;F++CQmC*yNp^YC%^98?w_))1r;r}#Ig+&c}Z&UqSrheNO zy^BhHW4*aL+Cyp9!nU!85wJJRXq&H0+qRj`tMnd&qq zmX28rH&c8xY{*TPyXTTDjQ1JS%Yr!&m^O5U|0onL7Xc%JfN5l&G`5}}uM>tRt|rD3 zY;~)3OG24cF1xEWB>AkTug4Mi3vy-4O_by`0DSb(e1hI%6ne%>czAZZ%JVL|x+3*` zO>Hq^l%w6G(S<0B(IMZlGuu>x_@e9fg83lM(Nmu!a6>g8*plWNFcrL~_pt1`aWyhb z3e_H&c%)QW2IIWO_fRV1uzPl<(c)Ak;V45Da#C7y0jieBO@Zag z_Aw)C_+%WPMK`nHsq;UmkaINx0lI`X==`efV$?Fl(Gjx(CHSALzELiBNUSbcE-7@! z|BaQ=L`)lS$Xp-Dpz%YLnV#4FT`hsh%-4)vbe^jla!v~4;!WIYKpR28>^86}9h_yE zqPP^8Ey)`n8C##*-ooZUUToviY8`^7Fk7Rt*en`5C7oJ@$8y0DE13u1mB6KuT;&Q{ zENjwg+ZhgLSh%Po^0Zv1RA0+Wz<_laW|~8$(h5Ls!g-$baSbw$Fq4B<)=_ezBGGwcOVi45jC3r;QyVeTn2ugugO}5eQ7a5P!&60^4)^OF#^2&UkYV(9V3K_7(j<6(?&xo;>N(% z7qPN~VBljY6Ue@?cw7;>+hJ#~;AFrJ6seGBroY0X&&SR|p82T@I+eXy`)1;{q9k>p zo$~1fNvbC5gxbW#VHNaEB%qQjf*vh^>{s6Q&GMUXQP+U?e7nm#F$qqDZm;$35_;2q z>aOQ=qtb~B(wewI{S%=AR69v<_A>N?H3t)AaG9m0G(}1%p5X`5LPp+s+6nBs-xWo; zun)*y#?2%}bhD%wgX2SA2QxgIHhAYHsjZ+4`t^(MOZsp5P9s3~5si#g3d1FK5X)Xd zecLUTAagZ&`HCLns1q3TmO$k328p1N4@A|4Qps99JLmMzpRMdnISj9*BKCA8#9I%c_Gh_$l)rzbskIP*Yzb1dJya%nLkS&8vQ z3%9ZBn3BW1YSNeOimRyRIk(St)6rB%wXBqj1i|O=9*kJnU>YsTd#IA()TES$bgf!Q zDxmvZQ27(of$NvgM)~GQ9!8lY%C#--Lk&8+7yHU_V>T|ubTzgUQo5FiFa+R&$I z-N@Y4R$~lYOo@wIFi@i>(zg5y=_J{Dhmkc+nZvA>ZimL>Yv>2s-fw=pO?S<&Mcp0O zn`^5a>si!mP~~B7jiqt9*3^?QwQ^yVLjD_sv7RS+&IKU+An(tl8I&z=vF}O4cIMOpFxraf~9eTz?j z*nBfb3e=)O33YWS8*P19cli)(`~ktp*11b9*D(O%sESr+hxWs%*hZ`}M zy#|~aR`+P(KwvAxrmKXx2Mr|cA}`sR>i)QN9X?_s`ECV{a zF$zT%a!6Bk#gji%MF~KoS6eD0KzT;<;WKcXfsZ_)zKrkfonk`;uO`U!IkoSJ;%XlF zvMB_$i+J&HTf-{ugkb z+>6Boxs;mxfz1L{2EVZeb$SZ7sL2u#L*^kyDdec{VhAIBq{4t!3XWFF&7af?{)Y!-1e1lsqsR;@0=<3ivc}%R92B6f`)@Zpux68&j zCzlhjXKEfu$w?mteT&wMf<@<9-Y^Nim*swG8g*ecPwLrnO1^W97l0$fn$2&j<{f!? zQ&PiXsYho`nb<0#N`4FU(}Vt zC>eFcYvXFZQpPZXzA;M@Y1@J4aSW0f37C7zEcMe1NxZy@NC>&G260oLCbSf>48^FY zHh~=1$`rdUQJ zX&78Ap_Zr)8o0L z7js$Xyp{lU09#%r4q)oePxM30LvXc6wQNzc_dmZW-1&L5U`aQzB8(1(Sr*p!f~`M# zmJ&NS@RC3{yzvK*90$=MCOXx^oZlFM)HdAwScwX=_79N2p!vAn5fXg%akbU z4w!8A9i0SAzZGdp*?4`_P%PzwOb+YdE{hoO+^~RkVugO{9ueLtMjCD#IuOJBaSuBC zn#n8i8y8%EC#AZ^8D+^yd1=$C1sc+lznBU^JUXzO%-#6hWFS+{OGk2HpDKDN3^l6} z!u_tcO#T{r7ae>Qt0O@XgG61YO(&~^O%8l67J^UajoA8|!d{ufTmv%f5Q`EI+Octb zk3+%u;*tQQ@FRHG#C~-hQpQgmC7u8yJ6uX_&m2zNxVwDw=}#jkp_OOqphh?G z25K}{+e6av7>AwCRO(BOI%Nz}_O$E@#5_5?Jj|>q3prVF6fFEJj9%&jx@NidY|56? z%ZwA4C9#;lKGn99w3&LakI89AW&7DP&a6Crt8H!D_m!}yNSF5{w%>S?Qh7gfkd}lL zUDW#B(Q1{CAVqC)u7RY0zQOaZKJPJ0#ygQ=q-SR-Q1r#gcCet%}fI3XVXkXtohQH@5r;ouCue4#M`q)pJ<5Pv7=NM+|&Pp94$gy6asVnp}#> zh14TrW5KjJn@X;qs4-U5={BL-tb79@ZGrIuT>Sz@8l*|*4{GsN_d060?F<;X3kdkR zINTufKwDY+UqGg`>|76&3G^=Yf=uVB#?!?CuuKU{fZ*m!s-fb^@TL>e#g;Ix8s!=E z3dvZ~#pxI+aWqc_eMbX7^}$d8C6jS-&hu}|;#Xvz9jb=;HaiU8KfZW-wOYPT#-A>= z%Ad8ZRIGiuovX6>q%|+mMtoXVDPKbl+UQ!g0vo=D35ai&$}er=^hZkT8E9*PMmwWb z25FOk+&_RJlh*9`0Kt@$9e0b?h|x*be?re+?9Vl@qnwLeDAwIFa~+o*`(9AmOiPuJ z6hB5Q*!$ERlbmg0>(zuPD69|82pX61E5bC$DTD>ZB3eV03SC_)Fh=J8#KCiY4663b zEe#AY>;e`FQLIUqb`Ca?IuhP*lCC_-@M@GMk3rQ0CH3I0;q>5yd>G3GK-fWyFxM7f z{po3M#Mid%`pXuVKnpU|>H+2<++*(LlFvRh$l7@@+5L=Y<_u0$S5$HpTk)6JMt#*z%{q-BS7YLYa)*X%t)uG%~v!=zaB-8QH{MxV*VoFlVg z{iVB<-30Dm_HG1*waNTbXc8GIK+u$07o;W zig{1Va7vnJck$SgJObsTv*u@t>u@!bcvMu@6WC{vW7dJ+MY(_flbUFB@+s>EMUU62b4B=l62VXX-C;y(2jp z-Z*T^r5iK7itEV8Wf$Ok1uL1&H`aP5|2v4tO&OzAcE1eIcuJLR7hXDq_53m=vtmG6 zV^${@mty^JNpsN?BoJr%+Zv@K3{I|)7W)39Nk7<*G;b~yR9Q9?$_ZF zex!w~JoqlorGJU{pxbnZl;Qpvd1HKPas2lWQ3bp;7ABtZV7FJ8=IT^7JF-L&8YD?N z%KnXA|9PnVSNc!9r-<*UK<;d|xU+P&Cxz7U>)lLLZkfikcJF{(SyC*({=bAXLCb-0 zkd!i9Xzy~qa=5sUcvIMfP+_RlJ{$Lb9pFTOJS`WI+}!ce$OJayy5jWL9jc*s>o5Pk zChqpk376vMl~aR@ZH+RoBZ^-o^fqNupNxCkho@o$CtpnP4`wOblDh=yq=$SbDtqqy zwX+C;+n`cO^ccQ(T%G(X6tc=ZOmYn__Mjf*bDMA4MsQSq;c$u$8rG*=8Bu^zy|Fhi zuXmTWuamU+U2ecrX`t}_v9U+*XaWpOr#6K@Uf$pG!@`?4(k+R)#Cdvz<3Y{lJF}bgK#cg4;9tGiVE8j1I#?15?q4p}HfHgq zfYrRbY9lK5yNkBAgFuOQr>8Iz?wen;6cDQ=4FM)sjB2XJXS|UhoOsQwmsTsWfbUrw z+Ar0}@NvJgKz4B2iOhGiJ#XPTbsq~ZT&8$PG=g1A3`d?8AfqS4`K}kn2IMkd63`hF zctf!`l+DuykQy^993(z)%HB)`|Gs?O8>$tpE+K=557m^Iw12c1>8BiEt_N*TJ=78e z*0g--SjOE%tM+oa+0Lo~ag}Y*1#cCO2(OnyR_^IdUx$i0Oi;5R5v<|ruPfD5*?(2F z7H2FZHaD=xM;g8rFtktXt84@hDvC06q-m6b1)Un6aO{_}v!4H8P;;2~R{Pe&fZt@P zcLv~p`+8@!?Ps;jW$Q(}wKe*5Dt6jmNQ^SXtXBc9z+w zr^jXX^_Of(HQD2voW{nxTXq0Aun1|!Ij7a~an*;Ef6&Bd2wdf-`MuGydx?XQAkl1S zcY9W-gZQEN&F1sb84s(}xVmKQp`&4&E6Hcuo;8+nA4Jvji8^?8H;>H%S8~Pir;x4! zq^8TAr1o6RricwBf_`H?c`T7TM^cySMnRvu;nm_bn{z?E(BB@=b!@CnH64LT1MYw5 z*HGC16OA@<#ZT0QuTQx-%*$Nk zEf&FA9u0}EG7wjsbAh5sIPS~R{X4u_rw3VSia&!ENI{skS5JUR>?;lV`pyzBZWNlW z0X;cu0|ZF`4oyWsEJW%{3_`2wT~{PG8%?my7yButaQeR$3Nl~>4byS-{doQ$$xEal zQO_ug4BL0joId=8V`FTTD%!w^RM$|el-($i*Jlbh>leCKCbQ|Yi9k6o81jRsVW!>EeDy1;syLhQF0nmNQm zfL*FPh*{@|^M1}(^X%fJ+M_ilXYuR$gYlmUyP;Vq8lSu0Ud-2LYz4h9uwMt$H8>o@1>!1`|Z zO0uaaJH}K+!bBtF3q7C-My=WOf?Xwm{x?E|gDrU65{@{+$t9l~Doy z4^)Q-oNAz`Flx=tKgkc_SKb@aYwQ55j!2tmTP4IlF^1<>h@@IM5u4H2*Nq^;gLlq1W)WI)C_6R>2_?&$* zub8DlC<{?qZzR5Ay+QuhwhEv&kG&+u*u07{D*(8!{*GQ#CTI_F`2C^VK0%-b+EH)! z*>{E?%Laf@GY%UgH`A8-{xlyUrmha=;x15%b8+lXeZKjJm}w4+`c*vCo<-#S>aJH* zbo*D!xc@2~{D0X7+Ki1~aeVr%Y<52~$m zcIZ$31(fZDFgbkZ??kTurW%z!pn zS)S8Se0o|@wBQm+f|d8VO9(+2p^fBK0p%tr6SSTQ?)?V0FpQXYwVS@PtkgN_e5cNR zhuhI!yIOt$`R+2Rw47-GCFGq{K1P5D(Ozcr5! zUS|(PMuZ9=75|)z4b_P_W6~AGH$~TcsekxXEznMXSyLqzG_W5<5(j;1ziMLGqd>SS z+GP68ERjz|Z51QG-yl;Fl{vT&E1sG#z^o=F!u7)+DNPM^<|0U`dWJ0)ok|Y)q9PW^ z;8;uI_P%F0q+=y>wdq);O#a>53Jko4dm0xavpM<};jAD1cJI#$S7W6I4jt#1s#A?W=QsDbZeDq)FRcrj z48MN&M!U^3+h;t08pSE5(jy`8em8E@e+P`yK-|G$_bsSFIH@E&4pN(=Vj_~4KrS;e zf&i8XP?XX4j&rE+i;+mRe-bV%OA~XC`r_01(n{jNOd!uc3#HF#G2!bCD0Sk?uS&K` z$*Wxy#nH?gF-#Hc+PA8TFZLyU+dT_Qk7=b2LllDiWE%BOj}>?dv4}f&TB#BAY){}L zMjcE(@nJ_v>nsBdNulzcdZS>Ae!<&abispl}C+^&&r*oQz75Uw7LsIHWxnl*9&*wY#l6t;&k7o+Wqtr@lGG$w(c zuCxUkH)7OlwQ^TgIb1I=&<@Go@>0s6u+9uoiGBAHsv3^BgJL<`u8%ni!GyPlnIw9+ zj37&KJmHM-TKAFGlozW4-rv_q7)>axMTG;!%6=C;#s9l7JVa&s80qcq{(T&5yvAVJ zJlfUQmcN0qN!re2EzBLkk1!+GDZrPTmvZ>wuHb&}&+9ZMEyt!+-g%&OCK3T;eo15< zt&eD=pt-d)$Mb$Kz-M=(GE^lI#N*(@Jj`ETQ1mY#x2H{%rwr!}r$Q(2NR$!LpOIc* z2IN?J3`SeD;K;{2Rxg<{Dc2pD45w*Cuas&plx!j29jSkfv;>`fz6N~oR{0}3`}6MG zT~X>0(bzvfe`kM^o?LtN$cm)Bi8;A>x0`s_$9l7LG}Mp${-)vCYtg~a;Ok-`o5%GH zmG7C0!I!yDO)XAicJNL?^?EW7h2|G935X@m&W>Z?RW_-e;stmdtL!&oM_@rQy0|T3 zxQ6N_2PV@^PTO>QbBvDvvku;@XWxvOru24#BP5hVfXAsp=Fyb(Op=$)?w;RY>wpMr z;~!@=zj@1S!*G90v7hb@^4)?OT@g=!4^M7t`QZCS=f0*v+Ad(J7y`gOW%GlLtt9RH z5!(_6Bvfp*J-aj$M=o~BXRv-Krex&W{U+b(QoX4ztA(8c_;^fBlsZiS(?l!I+{DsM z1L{M}IiM^Y3qhbd33_{1%BzaPy;%p0W}4_QDrrqAGg(x~8JSJR9G zD?P_DRKM7UXWDfMKH{29umH3qb(|3QPmH9r-qT1;1=P0BGmC|pYWZ6_xY{FHkdrdo z(z&EaUz{B5m&ha~)VlBH^1NqxUKtz(=~N@j1YxD$N|yK^?!8EghQ+y zBo_-CGn;G5A+62Hoa0A=lbN$;TEoE~lZG5ZWhB1HgtML2Fss+>3sot!hLgNwvG(fc z^DubTB;?O-l^W=1Yrm^1q4Q)vp~dL2X~8WFZUC*s!?D!Xc5>*~5qH67f}Pj4G;wr=eo7^SRLmm2RWFvf>PCb32!V z=}cg~kM5HKB@zRVCWpFkRce0M9I zfSA(d;uQM2AeZM8SNYg~oICR3+$XJQA-yB-irpoQ6`O=!EYJA7Lzmz6^_QVjQxS9O zt?tOtX2aaA(S}ArspEb6gel_Fn!S>$aOc8KC!fM^#3f>I?M;DsO1Y%e3rQzy{gJ@g z%E1k;Q-NJ|-F)C;2uHw>c1oIGl@nUAx)PU4Ga4B_Qo>UrI1~dMskjv?!}APrII=?1 z$a_bJ)eSIswfVSj4Y>!;1`l(qpC9XGS~-jd*zj%rO3LGNcrqYYC}nq-7jA69!~yT! z!YWfhI(^prE0Y)2c6R5s5Tju7Cs%K8+HTgo4gMxz&5pHWzi?g*&BJ>KAPlK(Ej#B2 z2>*TGkqI_QFYEgJpKV|#l=r{!WCA<}?O-B|P?bY5*N)NwT}?w{o%S*OHn_^r7s^bZ z<$0NsD}|b*O$g)y%r54XDi6o+@Zu$8K)NP&KFI|jMYOU&n(Xmhv-L!9ROXxX5kHj1@ zejsWU7I35IL6hTu(x-noaJI*>O!KUaOsdH}j-K0-g`ENMs7d9*ydk+W?dZS#u;C%u z>{eNdyj^L_%*4335jA6ry&-*($P}!6spe4eO@?9*%z5ZCGbRw1=Ao~)BLcMIr|dDr z9#Ei6P!9Fz9D(-`POz73NrdoqO8ig=tT2T6T(eB)QY*bBX|*r@mg`SqcDa<157iaB z8|>6K4|fZRp^%Lq!6k&);5@oshnJKqMiQSDTL?BJgTw?nJaTh+`TKMW#bqPHe~c#p zjX(cWzvL$6oG3oYtY4B8UjbI3cIgsc(=ptwo3vl$$p7u}Y7-h{VJD<4W54%ZaLhH{ z^Q68yHLOK31a$KK`77lYolDR49Ck z^E~0n+Y=-W-E7bcQ4{aUB&Q9-`$wa?B%`D$MhhiskDB(~G!!U)WnYB8J3C4{{#ngA zuPnGGyT3wXxIZ8ZYX5vObaHZFz#hAOMS$k#!;2_;pm80yQP$GvZ>%iLGy`!>r7hFU zlv?%7RBj7fQMIsMV!$}s1LqS7h$p)2W(*(0IQ4y6PTVap&g&che^%=i3-e!T5nrj^ z9n;`fPh6y5?oy?fy`gYxC^vd@>Vl6#0bORRzs-NGpK9EC#q8T`mP(2X_m4ObRBue% zGzwZtS{fyZm5Q_r?P3cl1Tp5Sux(I(FOv6%hL$CT>X7O2t&!%aCi@>oUnJAbG_F(q zzzK+)19gc^O>Y_jxmfxv&`8GL)ZwN=#07dOBlHn0c-gNW$Na96RPsB!nMBgdt837` zE%gPDWs;BW2XO!PY##l~Yk&5Owv3^R$e69eOSA#Yq3cvG5O;*?0mjBLw~@@CGDEL7 zO8j1Zxb^h?K>3#5omTy!4fS!FK$s@qmFi{h5hKj9r}= zJiJP(dQxqK${@)U2ue5k!PSL`hX)W+X^utFO@$7byol64wAtKJ{E8c;d~0;nhit1# z+E4lBY~eJa=r#t=#Tje_*nRcvS^PxEo0i5>(m-7O%&75d)WoS-p@XWQr7cNpQ|Vto zIT&+`scdU)EQdc(*B@&l$WI*=DtFVA3ABd1%lK;JlvE&@lyBq>4G)*ho4E9=KTu6A zl)<)#LIjGTSfyvey?Y{}W+f;?zS^y8teHf=K8bFP&Jw6%z97GcDmzD8#N0L!_=K&7 zhV6=;E!JHRO0~xG7{Lc8X1t31915*7nq*!yQ9!nn#$Z%UJLgRBn_U}toh23^?kAC8RD(7E+`fY$$@OZP!@}CxX`5-H??ARa2aVaKwGpbMSi1B{{^MO5|%&*0`ScA zMU4Jw<{4j$70lmml#|yOCSSiveW9GAyEN=VIuUa=Zkswyu5fq=mrlp?6d)k_GA-Z)VzyrN3r06OyV(58)tvg*^fk%@PqG? zTdo9j@O~UHXo12~PJGHij<{sYaa4b0#rb7+bp(XK+>X7W)^y4#Fs9;ccDNI>VwNj} zbUy1Y_4AUHI{+Ps;lB!mjEQ0=mpr2sxgz!tPy0UQfHKeBG&)_VNBz)nreD$QF+h~k zyCT2Xk3orA_}XIhCG54g%eJVEk_W3dlSSzf77-#`Y9TkA@J|t&_j59cRBmM8r;@aj z*m`^?M1ab`)WrMv?}59GT-q zd)s$?ch||5+oz8KE%Jd_;UtAp#CS*Igi{N3;)udiHDC)AOm1PoA)kvM5AppRqflI2 zUyjoV>Y#p~D634BH&qqHRsL$w482)FAusI%R_mqzLqre25+x{EoBZx z@Pd$kV804HqT5WurNZ|4r4{ygd6CFosm{pTNTyk|2wk-&M;n(|RWrQ<8Bub_K>&%w z2_aT&TuP;I4fkm-=rloPG$d@;rKAk6%@9IoP2KHDF-^Fx32`tZR!`b{$*f^@?q|># zx`3}H{=nUJFv-Oc;RqRrVDs~}v#S43dG(JQ6J_-+*{f2g@hCh^hIpj(UVWQ^vIW~D zL^x`^p=;AaP-Q;zX-@0@#`yvE;pcH4*3$SJUmk@mjA7j&{BYAJ@e-eGbZ{_sLW_9( zhsGlz?TE6o-(Ul(MZr~QLxjlU+JRb*6-)3!=U^yK+lN=;A=6s3cenY10>aDFaX+Pu z<1)sgpbM(9QS%UnBXKBL!TcFr{=~?DZ&#id5(1PTAm@VIOx zTm#ERdA&#&bS5n5oCZXdDPCI{CjmSM*W7@f$VM;q*La!3KQBk!TI(6N4a0P)`E(CU zX06#1eu%?u(tG|?osv6EBI|M8+cO<{^9=KBK5%WBc?;%PC~o-rQv3Mi$1x>z@qpOe zD6I!r>I3;g&Pw@j7wVqG@wl54j!~`DE%W=wrOB+nD;GL@N|YX=v`)IT=7#rkgh0=1 z9MWb?VEufitgoKkVoCe@D%Y!q6w!5-Hqzg-(O?s9LgC(SwBl~K6n?<={~&^e|GT~M z{~BK>icNHQZekxwY`BM}uNzVsnzLPxeAM;50d_Hoag zCdPO8=nYyl>a+OTRn6zZiBU`RK3s;Z61R{8+gU?jOD6GkR3%hYY68LR4QDte^qYy!J9+L;QTs`unDX}xy|UG}65Id%%ovDx3o=CQ z^GGbRP$Xj22;urP9X+>=bAFUhzpu{zdb026UKdl#Ue+$l6cv~I7}AdJO42k@g>h}P zA2Py9xZo}H(tRb6jgv@ILf`tlzqR$=3C|7Hju?+qjfHCQnxDQ7Eiw z9v#E$ZA7-=Yc)ck%q+!0<>txE4UH+%!`bdm3p=unIPwt;jyI43eSqb2dzf{I)0l$B z*yEIJa$Sv`OJi2KB)Y+q`#R|T&xs|Sy92d7hZkldAb zQsvSa7~i>JdboL`jR6}0KyUj*>xP|*Rb2V-^1clWy#p=Kmf?;dTQ}O6W2_HI&#d4` zHHj3v+T~|28}hj*)8W$cE9sU7lu!%lFlDIt#Tq3G@Iz?RAwdAW4Ayrfwc>x|lK-bd zIUefcwWt294EnjioUQT&N~b&0NINxHtE(>)_My6#4ZW^R)WKbRslHNEw11%r(>=T% zd!;Hnu5XsH=*269E0LZnwwG7&G=cNeXI5s)jzpHE$1?JX!x}*tm-5O*1R1lj#ENSy zF&`D+peg5C_nwwQ&!Zn~d6ST0kO46u<6^N?NYv^z9+Y^Bc03gQQ1#8)k47407VspG z|KeZ3B1!c!$x!=GmA$5>gnuwx)ch)zRyMgJ9GoEagkA61TRN&h z!JJnO-SqV|`GzJI#+uH3l(c^QGuT-}nO8;z6gY{c2f`pvI<8JYm^XSV9qn?BT+8{2I?pZH03dA%->C`bLCi?uhGXjigL z&O=KDp!^lspq+;s+^^8}DSX>$1XWRP3VPH+oEgtzzd!)Cse;k@5)z9DpJ_`o^VR!q z_nlP?;6uh6A)!nt zP>&+1Nv`Qd(2ozoIG-0uS4_gl0DpU=)G`9pc3@dd{KbVzExr#%Mr}=~*XcUEd^7Bq zVtVG$XF|wCTG~h2M%1U0vtcM`k+!aJcsNmn`w+!c5`dOrTq|91qrFlV<3_JXj-Z(XFZf2XQG(g#&pT2}3od{^%A=6Mv#tVH_ z9~+Az@)We*GX3~LlJ>iU!x1i8W1awWUk-jkE;{{&AW89WCD-pFw zZ2jyYNf+({Ufie44#aul;MscHPO&V@B%JldV;*zkL22DI!CPp- z4QcA;eiOJ2nwJI;B1x3VL#sM90r8 zL$)v{FUkiL_9r|l0cRr^*O#{82RN|6tgFYlEm6E)E}o1KuX>2X)GCS{6+}mYjtb41 z6S~SPOiU{8tYc;Y04#}GgrMX93m7gHVjWc^7ad#>X(^#D;hLL5@;(3hi&ZntzAf2f zdVoeM+%sA>R`F|R6{8KW6&pRiPq{W2Ig2xh(D>Cy-^Z#`` zM2+R2q87=d*PU0~sAkve6uw{T*l>btJ|wPz{OI3~P2V4ZNM2%@8E&?dk$PsPK{T|p z@N$w1aWxYAp~7*+g3QiABevh&{78?-)bGGWftFTV%M)E)l05B2#d&Q=FjUQ?0Nj`a zsz%#FYop>U$k^WDYgd!EFyxPGc#^J^_h$Z#LvzGCdrDSRoX4_uH4k$o%mahfMJm~O zahUyOc}Ps4v7Dj*l_2eJKmEBx$J4uH9!ob95EqvlPraiFSq-|^cA;_lkVaSoP`0B` z#dE_RK}sZ0KqSlYO?FVz@Ur5m(q?|NOZOotk}3oE3D^HYU(vsXD4tJXP;2-i45ATU zWcET1f&xg1n%ED~(2RU0ezT2FFWK#Lhb)S5&aE5@j;C%U!ucUN=p2!j6^&W=sK3a`MuGO!oKq!ApOkeZs5vLumHZsf{v8 z^r?Lx^V_8`q`V^@l}OdWRn)Vf?G$abAH6et zahWFX8J8;C9#?vpaB3HBkAfJ3RX1;PTw0MEYr1sJwYc5;^6Fl5tZoZ$LN5)hP z(U2FF_+#v8UcpVlG?AVG^*x%0)u zw!5kJmp!CGaHm1fxOnoyE<+0mCkBI~x1?dI(*e<*X)U)?H5D?){TJ&oO>B7LUqw#e zT7Yp)$Yf=3Bc1_a9CG{@!Qo0Sb;j8tZz*#P&}#%l-LC}rj!Hx{Gx&v6R64_vYCNY8 zi4j=w91VDqUw#{XV=lI;L5LmYsJiiWHZKY+g67p=^7R0uyxOONEBtsCg1fg`)jheX z-UqMwUeU8D(TjQ;4;}OV@@ZMO%ce?d!n+(1=3Z&X0+QTqtH?WcA8yyM+`B;nFU>M6 zv}6a<3jlwinHu4%)RBvKdGcW+mISH4;}Cvdu(lk!!^kx9CL%wi{G}Ntv<@Bt8T`)D!l*c zT=+L_!~YL}u(x{EJvg)sXfcnkAY-TG>=%WnY9~a*$sm`(FG5Ln6-&>=#ZYk@q^<=i zANMkNqUT0)m5mb}?iU#L`SSwZEA|;TxX{&E<-^J7%zgewJ;CbRbr)B9KP1)toBq#m zs$8!G!QCXrUgfMojKl_?5`1Uk$~+mHq$BMwZFNAUwuCV{WWG>6TC~Md$FCOVV<&X_ z4~i%D@CzM1dkaH%9KwKg{qy#wuSS!#PAwmd4|Jw&dF{a_sAgfX00nqg{!DQa-@4DZ zbIKo|l)Yw<$&QTaMZ5T_HGVQuq~5pQ=B3ZCL6qCdt?t3A9MFKYDTnp&TIs6+o#xa@ zL~3{?oAb$Bbg431d|X3045&J(QA5VeMtFn26vv<-3rO{`vYt8q8D^bLFZtDZK#9D3 z`w8q8A-C!7-sMKcZ{t?6Vc6#1wSH>KW1^o%z-O$Sc!-JzLyyy6L^<-KGlQ&Ev{JCl zg@B{{LQQJ2f40u()|!U4Nj}l(#~9mF$Jh>&(BvlJ;>IZ8qfah|b*_Z+R;`-`9|Wvv ztYsG`KqL;er}6RcvR8f6tg-?-B*rv?{LDpkZiN}DCO7gMSQ+7?pT!qf>hroWTsgGd z8%QFD40>1ZKQ8Kdqh74XI-K2DYu5e9dG5BL>Y?OL?#*J*IaPhx&p^G9Cx%}CMDct) zkjcqth+G%wuM$rrIXHZz5Q3d1dgzLAnjqhtO;er4>9_Ec zXrk+8Izy|^`_SU9{Hr6@8-7j<@n^`%-2biAdNaG2~UzuACr|#v``0PR=uJm?A zTgP;7&hJw|+OZAE57o{UnzVkZ?9~;;ApO*5y6C7_s^_M)E!ilr!lp%&*ji(#{!o%# z8|XgAFU@~1ae~cTQ{OxHiu_uP##toIK$gjMsEAZv%g2H>Ba^6vnpZUd6=SZ~AcRJS z3YLNGCMvyu^&Lm_Iy{T<$WrHXXY^wM^IvFAec^5P%K;E_+Vv^TDudFQRLp0rM(}$# zLRYR@<^~aO+&oPH@~2?|`z4tx4(n_N#+$EZVccdAjZ$VKYNz0>l^PrE?c&wi@4r4Q zbx_WKb)7so|1EjUpw9Tk2VpBJL?>gk0Jl4C2bcwPN#GP$t#fkyEv8z$Q!$y`C;v7# zY*Z0nOyAtPTm|sl1!E&e$p1_jjc?x6VDGr{@_2*slctp`EM8B|cqpx#A<5(vw&K>o zlFhD!p=9nah{W+A=-g45c)uJ^DTv12y(JRUOMhC1yGzi*W-HSw{S{Nk!=!)074q=V zb_cxa?-`ej81(Y(Y4=TB)*rAtz;ieC*Bxl_Lf%|eUs9woI0lB3c2=uMaxw{CuIpz+ z>Ni1tZ=n(!__@wSXX=<2afhUIhMpb1Zw*qgVe~?Rp6gn<%@nxSWEy@ELn@wW9mKOu z-QN)m7@y!xzxwbO8XqtSrMFe(*GRM=m}&m2xc@pbJNVw3j>#{Z_bwiACV)FE9UQ6Q z_hyBuEx&PtcP;(MKfu_3+F&`oX+2(eAVBX%_n5cAPQ~h)qe?k#OxI4xgkao`l<9A= z0v+!|KKWVFw4(8fPy&#gaN-tks#HMCH{z0GP18Cj=s4lFI}t&m|62XMF0|ESqNB$h zNv9yY=~rOfMSGTJfSF`aPPOI>$xP*5kuENmEY6Gg8H9A5YUOYP>JF9(6(=f>!^R;p>4}Q@8@gV?AzjQyb$Kvqr|&6bCVHx73>E)!Xyz)klz$0TfT+sp|_DTzb9ji zZWFqd(d_ZN@im3!Jp&;*>iV`aVtbz zsAX4@Ql_z*EG7>o6He0!#vkktRy`LEBYBb~pBrHf`D+2*rg1`hhG;_2ACmo~SH)6O z$=qIm*|f)2a1}3;cNs4dzL<1$iy7A~?oW$>P%k?#8orLN>27J!gjlPEuWky`*b~r4 zam{wK$=3^PbN>Ex8!V+Vz#AH!@)!^D;oIBTc2PX7G;T*9=HWY~%+cTJ*z zq$-2KC0EUc(@~NS)py(TB;&Hetc;{MJzJm2+06We^`^JJ^~GfEbw0(8-N%yr_H1}K zM^c`zTknkPow#z-iAy?M>0jAzsFzMQ$OtwB+k);C3=F)S3)|g$$zSz03IM1)(InSw zmjX{PDv7Ur(p@HaN_Rj;Sn%O>7ovOP!Pchd)`?9V)+6cmTmJi?O*)iO@lE9FGdQeG z>mFIRI_^9FYN$TOhx5g(6eY*gLU@|o;#{RF{-Cxj#WuK5SYzy7;t_{*hYBw_S)N|^ zLYsmTWp$G(%iDQ#jN%{Hz5J65E}}VoHKMWshY8*GYRwZd)%Bgs zrC;M&$kodtxTECbsyn>!88mm-e(g#U6GH@X;yVpo{z8+2uOocF7%h{6Ms*tsSG_lo z%k*_fIAc2*=KJO8S!d~NMx9yoX-z|Y3yV|4gmRtG^y37xN1kBFxU0(}ZRCx^ev*zN zlX2F~E%;Q1^nC)P-1R-! z{6zyoNSv|acB|)loz_d+XoKdYzy35a*HhTe!vQ*=!xKQuzwq0sICh7_Xj9nM>Ks2W zrGB+QjH>>snQu2uS5`wJKbu!s1O!0tt=a|l?sOTd3_iPjpDK$3HHf=xz}i*h5rUkanWA#`Zew-R0;Oe&CU9;3*Da7qMB zHWJ85JTfc=SQ)RFcbY7ZxErk-Hya#iBWcIxpKvv$?N1c4cyOh0p_`e-jx(itgSdB7 zj2IJdaw2sn-t5b?O?rdji0Bu+2&<^R7{{IS5qV4qpB%-TUWU$-e7x0b8&cn!_tU;D zC}O$#zBSU{5ah5k^5m&{H7vKgZ4>p4dk>rU36}57#jRM% z(V?mWZWe1}y&|=khz58wyv=Qsp<6N~U>idMfS)3t)il|+kg;gk&W#i~^~+;oGHORf z>*(n5{r!yt+p;kjwfO1ZdQ&tO)s$XpO$#JMx*;bm=lLS}K>46q0z7DF6nKstt5fLU zasFK9nE!>Ai+Nuvw)H;XW7|9Ub&7z+%e#*YJ?JwA9XAd?M$2C+m%StM;JbWM`2oa) z{W{_yFzDxd%3qvC_#tGEXP?~EU(yLsxFn!=l-^x2Ppq= z;{eLSk`aCTvELH7@!crkd|a6{O@$tJN%w;KkscE#NRI3IveDP{_M_Q^W-W)@%8MuR zT<0cGtD)okza&yG@>*%4un=N3nf&;E* zHfJ(jRJM7i5cqnYH-_nO4cFZnEVZ4vc7h!SJC4gu(HD4-p%}A9c;>Vsrwluo;;#wuo>U^#=dg0^g7F#dOXW@DG`yv*>4w=eM)2T zArO5Xax)DZqIZTh@dIYOG+nys(*7&{%%6OXj4m|NBRr(BW}D2nfI#jHOJKJYIUDNc zFSHLb`pU5BfFErV=1+w{jX{E_3M=#XUNhvI4*X-ze5hU@+Ia?2uSTD&v zpQnL9a}i{8338N`ducpd6R?CSHUepgFO#l5SPL&JgRawApQRzy@{(0U|3>_Nb=bZx0!;gYGh8B8(or^jmD3W46gP+k3d%QtLo&~0FYVv@kF5GEYWo8Nq(xD%!ZO6G=25;tm4mtB=3E>t@*+Q>e6y9+Kl9 zBw3ynT<(vvsdv6bFnp}2ik?j1v7StrBhJG>MED@d-qTm$w7j` zKMO7WdZP#4%Kl*b)6)ixi5WA{K%STv+);%eA0VY!YwE{Y3YsJk@*S&eYvv417`;Zw8bPMtcVK5G?`fleb)uZq5Ka<|VBlyOwUFu?hjV-yr~fMa#iou;ECihTzElf7gTIc+J3dD&br z&39K@gD)Ep;WtCe1@8&@l|XeiQ(|W48_KytB!?ef$UA}C57kt&5>3RVix~XY%(I^j zfuo{}KME%^u$sJ_GoiL0^z~@St8$mIF$ghdNc7}otaLSv_#FkpAL5wBRxuUC)Y0-X z>$MV2%d8g?T6u=U=4oceJ^xs}L@&#~9uOnBfcc`az?}$Gth^}&rFo_5<=)2>wQSs% zYkh)v7|p-)T2Xw$4om>YRg_+urMgmuEqu0CB@>%1;$5)A(njEe4n0R9ft$$My?2_< z-0s}`&S$*aQhJh~tre8%Ku-zXA;D4+Ze(San&G&>c+Tf!`Y0i0&tL8Dvc*=9W4T|B zsb@R^5X6e1S}W$yIM;hO(%lny@R9y^(=#l2tV1RoPwo0&vCwg#&;jVwvP{zALy~EL zBpNZ=p#uwMb~vBCSGrw@H;!B4PE;+?OiDk}h=22fxIchj)Ouk$|EIj`{wRKumep$| zYb2Lz=Y)4E^A!;G6lA6m|Dws{RL5Vs9AICeE7|VeND&FxqV74SyFjg3o6BWTtmiQ< zd3;$HsG#@UPc*cJYe>-MUfH~SI{lL$(NXHs3>qNpI-boyTR z4JT7ji5OAVQ!O^N+Lb7S(D(N!M&bNxhjrg0gP+V&67#9@0FFs2>``L<&`$sYK1F@Ci8o@=bWhY6!W_7mwwD`}YDfJ5|493l0v1?x|E~slb#O>}x-+JnrF?TDh zD*ULh5La@?H`i-gl(vSqOd3?z-9$F6BJS-Y_G^7^Sl_G}tGIYVgbjvV2(noV&{@pw z+s&;OJZ8}Hwappaf*y@@Ga5Dw>-{u=J!N%GL;TNo%=id7GFhH!#8MMZS|1k?kxmp6Q6%q;d5^HgtfKo|+DdP1vow;T0=c;z=sDhgMq5@P z^H_de_bbe&G~XaSfxMVZhGiF-VY#fYwS1GoxCxkf%qxl>Id3$oT@~7ef|DHZZ{NTB zv=*!akK;r3*C3^b-fQJwc`osD7+FMhNQMo()&$2AQ~G?YwB@tj%u-^c8v0^qSmj;) zNN4@CnB@OFMSKv{r+BUxX$F71JfVf}S6-Y0j3pH>LC3!!c7H0H5?rjPN>7S>sCvYk zV?jmtzdpBAdvBLYJM7bc%WqEh#%(;s>1R_aQH4}5)~#3tzp#Glb}%k){2XFM!EDKsznh&2)@)!__2QSod)Ud-)AFcQEj0Fz5#5^|$Xo0ri za4-uVf7zo7>9#;{FD&U7c`Y1=Oiw!DzBxa-HbjMZZm%&d7_;MW@@#=dM9`rG>5v69 zuLw7NaM#S94nT*F7E><8g$NUm>a%XZ3)Kon?HmDMk6z7;WJZJFbEd^d+t^3RX`NS2 zy?4CnjcaTCNSNz%_nCs%dbib*ZDO0$AOyr#AU~eKT(gn?J^i^DH#;wyN-P_a^o_1H zZA#|66z%W~f|R^mGeYq?uHaf)u45y|L+`8Ki~9<4p1Wu}(J6cjY>>jVY=QljxIeKB zUk!XViuiDD#hk*#OJmkhf5aEaPU=SH;D8I0%dX1GA>iKKw~o)WXimcji@j8)gk>S` zUK)d{P!^xpq=F}Kz9iw_de9*szJ>^|AE^8IdSwvDg% z>*GRS1Eq+6!eh|FD(6)P5J|}V=p7~Po{7tl-MuIf6PlH z?na0Nmg9Z=3$4)}$OEx;>xFS#cGBG!m`@=VU}U+30MTSXF^)$yURQR!u~isO&<^){6pj zT#$Tj=*!nz-08%k*Xgu)t>|BEQ3B z!OS0#z3lVRkR1bb%++4fC>hJ-`ib`j4YZvjJn+J4-Ur0hxg>*YP{09T&)Xv7afsExA7abPvcCtb)y65qIazey!vLH`wM5fRfsdP3H^kq&x z^y34%C2VXG63mXbGXGN!@V|ky|93IpKjyFElh8}=cOeNsw+5b--VWax;=$G$?}U^%or|s>E^(ViaZ}jmXsglv1%aImiN>QWl zu)2`>6r@>_|2Z3jCAypE$^sV(2XBh*08XMPY0V^ zi_Vr5&${w&f-?fLor(wPb^JD^69!X?-36PL z;{hy!j!iI{NLr;M(|R*KXSXzybUGS5xX}9|wd%fikn|t9ombM*5hA{G5Gg;ia@hpY z!6&6|^rAfKbr**G{s|-~Lb-XFNJP1MRvWS+RDIsnU}ev$2b&|6-ud1VR=UE~uF@S> zRGUE_0|fS+4SbpsPY(^ErC0Yho`IbFi{0?Q{E`3u+etySyM9eCS*rMFAMTuA`V77{ z|9)RbA#e^EPD&cDGL@?M80~NV2=vA^iOsrjgH^E(YZhv17JIXKyo!FF5aXDew(*r< z9xCAHghYDH8O-MM-$=nR!J;o&u+?KsNYH(GSjNR{ytD~ zA4uOqJCs6W+n!Q3H(lcOJrVDUAHAC9X@ANCD_JTxg}-5V|J~F8R@yxz1aF9Y6TtkJzk6_6h1N zF8Ik`Fi>KP?3sfzmd)_exKvDD8M@GmP;C+H%a!v#CNOORnpM@0zr12u6I9wih6V_I zdCMDUnVilR!@!|hWkG7NqU%e6+s&fDrq5`|#SVQ=H#gF(_q7FOU+-kFe}o*4Mg(^u zE^ZN8yREr1E5YORw0>moFGzUK;k#juQ_5KoW5>e#_6y(=Fb(dE* zLjXU;gV&MF@539E=`m5B9&OOA_T0Xy!45p79eh$B_GH_zn^9F_@G(A^(z}hkSYlx~ z1<>aBnF5Mz8H^I&Xim)mXINU88%m20 zRSLTmwKE>~jrc+USr+=ojPwWUnz&(BbjPlo-*DLOdFOR6qlnAcTCuyek={gaJze{E zd-`vs_&mwnLUXJp)m%`?vKk=NOL1&Er?KU`l=aRz+KLeYk+@;Wj&Fvj+)$_Hf zp~9gjTw~6Gk-%TPCUh8@eN6bIm`(`$CBFn4DURgQd0zv?b+NPw4aYQwU=1xT2U5|z z4MIyTLU1WRSDIsYwTW#H{w%|##Ogq&2~0zUuP%H9HCLuEx9IoUz@PZf=6Y9|hdWv? zY*k0gZhX*b&(nm8N+rWB6`Zo~X&? z58qd5wVGzhtJVNTgB6|vN2zz-=aL_3=tw1=fQEcr%RwZn-cro`wV0bciW9-k)!foP zZa98}t=%7yQy!hSsbOZ2_=&I+T>!GSV zDB|)jw4Of|ha}#JPqi;cWLSR5(EqRr@`wu+`T2-({H8t`{518gaZdVBefjUnU;pwv z|1Xfy^N**ZAA4Os4v_#Xb=`mJ-f51kH6;^Hau`OAC)IE@Qy44IKKj;T)U=+n_>+ag z2Y9--nWF`U^;L|#z!?ZiY+wC>=YlKe5A`NGNKJEwu7>KFNVG$4HVJ0h4+nK+u`hcM z=4?hS?A~-K>gB*=@!BfTdoUdU0o9F5Z4!XbKmi4-gN%s$8m`h5V#C&Fxh8B$1V6pV zQgOZ`;Cx5z`Kvd&m8wn7+jEVQxThvz%=N5uVVU%aFJ{wFyC}c=3mdUGnjx*KdBaCj zi&DCjX&BGu@)w(S`D2@fmSd+{?TuI;_QxKGL1$}QXs35-HFtGmbLmO$V~Of3+KQ)P zu}|x{r>+KGDz4~0YPBF1d1S#N=pA+CM#FT08eCv)>uI7g zt^KHbCc&m)J9MCP8~h{9Bk-$0Xl|odlyaPecamTkdG$1Ppg>E_i*zTF8>YokDAm7p zD@CoY#5~>5NT~ROB2^)R8`}@kZeX#qejgL_>+AHTH<^4Oa){LEkK^wc8}gBsen`+Z2Xa7O6mfwmo~{90(ry?*Is?cRxHeT4}>WMKQ18q%5JO@aJI2t z<4s3V(sBeJk&?KYXa6FCQJVoQXD<32G0KL^>=vqFTJ#k5+wA#lWt+@RkK4$XbUntp zwO5#Lfpt+nK~)=`itya|vC72k?!u{`@}b>A#Uf)IIWBF{*JkC5XyK;Uf8f<)q1r|E z16}5=4pIjhy6ot^Ctj=BQ2z8BsX}b!PIKiHYz;!33=5ohi-;$BwMF0lAo#Uzbm0*q zUz6CZk!w3FO&}5DL^#{2vP64{2si=^jZ0YVv}@|g3K8u}jY6eW{55Nt!Q*udr>A8~y$%k>nisU$ z1=j3|{`s}7ADo9D6TT1Cx!k3gP1ph=o&;j_YByScn-sMkiS0XI*T~-fjQu-hq{R7G znz#Y4lV7xb(J^IFt5(abz(Orgw#^^v9VeF;Spu_^o=vgW^+=*@7xxoOM((eQs% z0Nhj9m}|7QrV-y3d^0dTFF@1=$}ORfoXShBSCn#>i1faC;&8fmh@RFIh*jt{j5bVX zYGG+J(`tO&y+)9kL+GrM0vsyzPWWUiN}EU8-*98g+Hfd60L^b(Yg|Qn=M|4|Y@>4; zBq6IOfVwV)=nY8cW)pvougx9qrl42lZ6@*NGI>A@Ch(7k17NY|cNO)NWwQ>7E!Ox> zh{Eg<6PYxjrJepia=fW(jt_=1pQ_Zp6K_|9sC@cf)-xCIcI`vVqjwef{=cU#ncUT^ z8GH#mi>awTmF5_7JFXJ5hccXEJxhAw4ob!hQvwoBaBy>XQ^#lz-K(fgv45&%+0s?H z^+|Za{AG;EY6Rvb$%7yvUdlgLH#RVgTQzaFf1TK3Fu}WBbWk()$(O%8dYhqW73lrl zDPIbVH;cjcyiSgK^+!S%j3!=X0wS)VHLy^T*q^Ph74L?uSTI>OHCeYF4ZNgRL-jy9e@eo6RKp1i?fuYmcQp_hO#e#lT5iWZH~ z%i?rTSFoR^EnU%{%v!=75z*>4lXB)(-_(XPtjf42I`6@@28e%+ej9Eoiz`v0Y=!X3 zq+szJe&j?Tfwl+gt8(QgcNF!F#hyA^8li>nS@lfS=~Z#~axSD`cf$!?#*1PpPVFM*rl+`@3Ew7J4O>EJBa5oVDi zE{@*K%ZF4;i_JFf1p_6?lO%xx5~O8nsSAeNq5|tzegOp?sl6)s7%+VAlf*u|XVyJ~ zjzd^>qcQh{E$QI6Ttt5;uSTrQ(lZ_{sH-ZeYC-%wPHV5ziu`ptB>ZL(FyPkZHu{r=anKC`U*Y{WY6Z?;q0%-2ft5L_iHi0_mVd>9_>vXE! zDn|Ag;lHrkkor&Y*Sga8iA4^Dirr1ZRTP-U*lH)(_VUb1f~VhaG+f{+9q{~`R39MM zMc=+q*`Xj2FO|@gM{$T(W)gPMaNy=Dz_uRL7DQ`3lR=SKHtsiUWkH7h0=O1|Js~~N z=|vN%V9YHr5*Zdn{k9D5fL{QKVmpCBW-qEccD=IA*j+~y)F6d8;)6k zOWKH0!>bfxW`uZ3`$by68z2ZU< zpBBxl{wsaY-_g{6p?tghKh5D)E=Sz3@>Pw-sC6ep?>Fa*vZXb>cg)BraAzYr1z2ln z;2EbWZh=>srreyi$UT>8=@unlQ4xl~C{?3tREgL+IOw%&ky8U5l7z=ug=a#tviomk z1(UCh>99Qw(L4BG?of`htJ~|Eam3d7#%s7?$UH zR7c373j&fdo+Nnu<9sqEPLM6bx^fkG9EVi{bLH3QCB0Y1NaC z!B%cGv?NeXh^SFB%}Up!v(|oeZI&*3=;af;OIy+y5LD(f|NAAy`E$?H@%aXn0mVXx z>Z{0jBRxbk1Xl%U%Ld5dSao?JA~MEMPa zXXmPO`M{#M_*b5kVY5&}T$G*`_rZ1Vr`DJXpKoPBu#bRu974Wub$-;V}*V@8C>?#&p5jrJxS}RPWG+dzja4BO9?7? z^j`&@OP}!Z099g{^_lp&Io_gn;b`pTmzbMu4RL1Ubp z&&uK-n~gES&$~u>RbMtPW>OdtHr+ZYW?&&vLGn4zKYfX-gCcd`ZGXQ7K1_wt#zb`& zaa*@!W6NoB@$tCGEcl%n>QkUm^*3qZF=KE=JnI+WqQ8L<8|t?I=PMc?WztxyUh!hX z+;`sF!0RuxO@2UN<39UeXiKbJDf^)xVkqy5*e~9EDc}iq+Wa2$MeOn|4eJFjWSuQeJYt_KdxD^9nV`atgc&n{>GdqYv`(?L6uJQ%lCT=J1x4SJ*T{V z6F!GpSHAxE54xX;M%8sr;em{ZmMhR^`H3j4TU;88hq%m5_auR!V*Qnvnt5%*M1X%a zU4BNIDqcvvFZ=7?8eh0_;xcprPZ7D>n0GSyr)3Qyv55-JoHM~z*KPrwt1YcdZoMB{ z`LU*Nmsu5>1-1S44Yme7>$5JoP(( z+?u3^)pr&9xKweIbY$8rpdSyt%zTYs-JaakJDuQZbH=uvLTAEdd+JNG1=3k@Q>njE zu%C6m>fR*kL4xjE*_pm>Xo{Tv6lAK$CAAr|TQqi}%TTAJul)<{KCsriboH#aedDaYR|b|` zeqXx?HyZZV5d0cf*3PN$(d@&TR(%W#`~kP_zJrzidz%a5L3YJ|o}>jc(O_up(+YB@ znb!E(o@!``!HTTTqn}jdr48+hlHl}Y4G?scS_636KKDCKtqZnikKw(~E7W?syt|HF zZ^(W)`FNN$+WH75SUW=zya&zVb-h4NAX$&^ZtO{!3dAc&u~Stp^i%V7Sio9-iqoz5 zAK?BzEOvvWb)mRJ&lW?`y}ko&7@Azsx==IZ3T1W6nvSb#g+<8DOU>7v5uodhTi!a; z&WRf66z%7N#EGUo*GgJ!E3@?DjQ*MOM>?|9J6XxavH~uG0u9!D|7~+*s@Sc1n>LGD z&|vu0k^MwzqEYGk*zb3Jv++~!vlE$*F0V;=bag-5=xw|iF9))xZ$h`8Sk<64g1Ti2 zd!2B=NiQ3SaUKYH+bl^^76)Nx>=vz}rT;|`_P;@{|4V-K-?zDPt)(+pAqChm@jOy# z8lcdm^wQFY%mF@$rcU#wI;7HEQ$brnnvfq@Y;R0#H%L5W7nZ#oH z%7fqL9=-G01!JCry1bM#+eW{W6?a!x>il;ayEXsM&uE#2VrMKngK+Y_6d%zIhVgA) zw4~=aM)j+*$)(Miwu8j#GoQGWiE;W=^%{c5KE-=#u3Z2A>UM}pbIvPmAUr?Io9hk6 zNHD|S?3r2yw&zzp7b9_(|4cLlZjK;wT-qijXFhZuouQ-n48|ihPp;!IVsP?VeA;GC z%~y5uq$9v4M6dlwCfcWw5dV%8pWZ+RTW9!eZztc98Qu_| znO`mlAg%(4NI@K!3Bg@s=zc>>3WB@lAyu%DW{!a*m23(!$ySpo{sR5YewvKpwc(ug z8AH~5?!z>5Rj!!YKKu~T5i_q>D;b7~g#m9Z=BXMI)f@zAY@CU7+=RdLIG7X@erwbd z!dl}4xo3Xq@Z+izoO-YP`3k9qq!JgqFo{{`CrzX3Lr+S(6f+M&Su z-`iW15;85J>%bP@gl#v}HEi-h(~4^GA0+!gbA5e#%#B~q8yAzG(!E|7Hq7@V-Z0WD zNqrex9K_{wkQuxvy(ADz7qQ3mLK3e z)&r_+NMP#a_^|=7mUA^qqVQmxt6bC4!9qcNDKyE=fIT{Hzm6qAj-?s%mIN=fBt%i^ zJ15TugSPz!QJNZs?B;K0;064~!qoFxkyYA@uhOj!EWzKuJK_~RD zswztrp!1R{snU&-(xv%;6b$_{jV4~ScAT$>_J!2%LZJMbaZ1$pUAY`?LNYs4yZhp} zU$Yo%yQOBHh#Iu`v0npLRNZMyK>hW>>zOE#Ya4Vp@BeeX_)mWD-)B_+3;)4CsXhMZ zB@zE1EC1=j|IQ*!VK+xQZ%RrQPQJs96BF?BTbQ=G=SX zxJ8~UK9-jEj1E@A4TCiRw9Y8$_;ZZwJ%b8-C)*8rN+9~SHZyq}cvm(2VG(h0kKPEO zPkcE*5hgq21%P)s(u%bxs3E7(w9VcvwEO&L;q6Ip$toHDK9)hAZ5xGgL%%yRn1C76 ze6CmXW$7Us)I3UJ+)_2}vNLUglk+5~75&CQj2F#;?Z!fv&NDXfB-5#HR1Jw+M|B?_ zU~JO~^0WW4vW39e@ilm98SO?paymf~-yB`+*R~xQEKw!&^f{TF1x;MS_(o?^Ic>yT zb}KUwk9W`7fmim)MpImx_M6Y@j11g5f1w!@ItgGoBf)g{{ps2cO6y{7hJy(pVP$?Z zF*{b0w<0#o;&{O7o^6+jxZ2!25ib*(iJZ8m_lz9E9Jn^i9fD7ILDXo$k6q4aqxGS6 z+_h^ti)zcXRU4$p6O^eI(^jOq$mfJ4F1aBIo82v`gPJh%wvmq<3)1Q^2E2w zRmteSs-r#BvpT~0WCh~M+OR(84-pl<-3Z|t)-<^JytUJm)Q0Rb6a+0OSDll>JJH~t zs&_dmL~MQ+{grD#AcW$TV?K;~hd0HZ6F67Q@tF%h6M@d-VGW-SCl^R^FrcP4BDPK7 zFI#P(W_08V6)jlc5*19US#-g*8h)$ey$;v%R`w;Lw>Yz9&O^%~28i-YXw36AQ#0E5 z-F>)DG^O;Oa)|q=|GFXaL74<4mvjQYu5K2iaaCZ<+ox5_wbg0t+y}1a#M5oHK=!J&<6Uv4C&Yn)O zvaB>0|4=`>C}(I0&Ka<2ZB|P+P7Nnt&+8LAg??xo0!1m*QJ<9tU9n+}lM9>Io2beB zSujG+8pUKRA;|^O(Y<|QaYye<#&w`(sG;qXEl~34 z9nI+xoHq}GHz!y|Z|$&__rKR%P0ffq=C*rD7eLAmI1qPe4yP1_I~j!bpV0g0nR_{4 z+7Go;dt|tt5&S^P`Y^tqlO`jXE=5yudnRE1xduST1uOOO?AzBR!WZ_Io@LrxIbC9lSuwQ?Y(7KTwS&yz)-Cy_Dr}ur%J$v8% zJpFS$HP@`U)|zvUG2b!9`!-uTCr(H0Sn@n@El=My9Pr8&q}482LvAXQtK7)&<-=Ie zW-gMj+6;fDU=g6;g82*C^yiap`HjsP5Zomzy19u_HLTwI-N`Sn3-q?2?V#|=Sk(=( z@V8Yq2h2!q+N2f4w4(BC>bBQH%*ITqvA0^ef26*hAal+@sdZ8!(fhFWt-;ieGaaaz zPc7!ekwj=p9fpF%*&>OpPyu2t#3L{+*Whggwp-QH&$ic@wBxwFDNBuZCBQNmi9K@2 z=FGH1UUG6w!F40V-pkoKmBy%vijpn}v3J21^M=&eu|Y9I z;8fbyz1TB3cg3e&#;L6lg;b4WAXVZc+h?Geyf00VNnyQdKcVmrma{D6aN=o#=p*l!1>>&Qo#JJ z|5C87{;yzNnHy;4oK?nT?k7C|&=2{hg-gtM^RJHyI>4#QCX*WGjp}D~yX|54gwz~4 zNWT*B{rF!PhOa{@3lSA71GS$81VDqMdC1JurlY8#nRa_``PAM7ALMOBGctZn3xq=3 zMvZMLTNsX|3MfLIXxBL|#h;WUidZ72We7+a3Rn+kMBWW5B#qZ;oE}i>aX@{BFL*L{ zr|GJBBwXr>wSSjU3$}%qi%kRK&RNTt46x=<3PBnWnG6F`u?xQD7{AJ%FwOI<<$D&C z?u^GqU9@E^jdiB%juJeZ9#*!dT1(DU>Q3sLyLo8{OV_G9TkP|Qm8trPl>RQkqpANR zB5)QIiD!M&`hmM2UfN8O{3roeL3~_^n+zwwB#h>hI~WV@17EF6m&#!&@nRxme%bY% zz2U2Q>8&fK@L8Yz=UnOGp}E7w1?ikf2rtO4osN_(brwcCat#BQ9)uUuKED{IQ7bw^ zr5>j`_Lw`B7$kLPE(u=mw@<>$bHMei$?|d6N{ZG#)R}c9G+C{KD z0fdWRrxNpjo3!8i(g#U|Xg=GhK}PLoh7{$XTJ)pl2)NKA_S2*}|Mns(a=OYEw3Rav zE}ThB3!qi9=WokGP=X2VmE3E2)8Mdm-A?6%0TYIL^4rT+O|uZl(Dth3SwP*^SFuG0 z?F_6G_#d2>8;0h)@z`+C*qlpt+`%>UtLBpk^eGR%=Wz8=2C{Q^Ob$AE%h_)^_%N$T z{3*&Kcd{a#B#liRd0WqTL(_{q_6|RUpux0tGn&TntKZm}&wq7pt+?d=yu(9nsw87M zQgo=vyX9m=^ipziq+?2L8cl2BHD;~&CHD}vBFV|#Vkr`T+DEA#YNNWkt4O@8Ni@3WEw!=7_far*j1H*RteL`N68aA{eNF{NncZ+wUT2EA z60ekG5}~dZUxwHl9;8dCY?CJu0+i6ghm1+y(&@L^mB=Hp*1{8qHA}&$AP^bCAtHYz zxnGw0waA@Gx1~jplQ`_o_ zzcC>&vYD3H$^l!6Dv0WRoRg}mbwkb?e&HM$_Z;UX?`R^I$y76wJU4-H)25gT-%CFr zr?NcwtvVQd)X6AZkcsmBPPG)XL^gg&?*oGXqLZQ5$`PizF5+ty$vc!3TkPNR_$#-y zZ6>fsLU|CQop;ESezp~L&4*t}OOBll9FbFOY~u#qzf-ZE7(@hc_uW(QpuB5Y_l9C}DeJgr_l;HcKk< zV(}pMJOJNdOou3EthD-8&5_aWU7jYACpjKxjOb0>ILDgsFKJqHkm_e{G9oTK=lamn zPhZdi;?arv(ZwzbI2A98!;zhH5CPZs2?>CvM*OBPt~Qmdl+ zDSDJ`yuxRALE*N{2#YMv`W;0)jqd?aR-zzxu&EGt;I*;yTXdN@#IPv0vhOoRT!eCS z$$ltDI1EMrbdJGn!;9zkD^BV~^)t-_seATUlT&?-<~wk`K`1Qiz4nx&yj@b=XmMyE zs?*Mg!_^<9fq8};-n5(2tZDe4XgsChHl7pA0)(zCG!8GK7mcNw3UZfuNRFdvb4MVM z)8?aiW(+QLploGe9ZQu3<7Je)mMY$nD)5Z+ECaaSYN$0y7>5W zj?6>(I^J<1Xs%93UWvs2d3j+W)w^mrQC@WyUk$Zq39rKW^HLfwQ|)p!uF~dvPEq!N z8-}-^JK-!y-Xf@=C~MJD6TkETf3O!GArLq`b?O#Y$j2qG^o(8`JYQH;NOeMy`=*k` zG~L^sQCFJ;#%Yw=pb#`yikoCrQ37L1&}_hC^J#s9T>8v3CG*B>Z50?B0p2xWQyyYR zGL~*tMHEn!wEkM$#pAg3Vebu+s9UUao8zA2)*a5>4v29zqx!-hPFF;_H!6T$^ffth zf~C>af4URdQ^%hYJ*0cgguFZ96=8Smwj>#uCgG&+QLff;!GYO(wkuHuCX?AC@0#i5 z65}PMXwNgOIsAmh2KjhQC}n((LwrtIdUdQ(3d7(U$DUYct{TyKTEN=N zO$Ews?ZEvm7Q+^fLV(g;@z*+Gf&Ji{hSsL6<}aZ9Bzh}|Eb}u|K@=1}=Q$UiK;Z*+ z=#2q07#?p6Ool}ekwh06R7JN+oBqNpos9!wLyH^Tsj59I(@x7+&WX$p3<=Muc;dgy!A7q-MJb# zy2*E&I`KP{>R%UW{vojYJH+I_5k6+C zPqnzzHTWS-sd5Gvcwrk4EMv2arH#} zQ1bFsgxS%cfEF=>Q;q+K!ncN!^Co5R=tHOTcRn4UiV7Dk7_1An^Q%gfc|T4F0do2i zs!~695#VJKg8HSpGvqYcUB0r6C}Flr6PNlSg@`SIi|@}(g?@y`tuTc_4~w*Rl(rYv zBH<%ORo3N;f7E2QReM`n;-p_%?m|u1?fM3cU{QsHNj2@HB&pi-Gn);#VL9wk0DZ^a z8>fkNeWvaHm4&|_lYc4Z>YHIvQPFm$GP`Yc93>6m6eCiJE<*jTMA2?QJV2>|Y<`l) zG@k1DN-=3mc)B3>K$6x%QH?d{XXsN|wpLhhnLtA8Wqd(C@uhh#Imo~N-7dynXa@iTWt2pWD@(DQ(hcE35n#7 z(=y0=PM|_A)h#Wd$CPS6z*CFF#CwuA(kgC*G&qDRa5G)bJE<_+A30fqW6jPbCZ7ze zTs_5|47mI-)mXQJi(6?hG`}e26&Ak((Q=P3A++JXVeg3Eh^ZLNshi9bgML5_8)WVf zj?}w-ce1yTiE77;3E+iaH1q?&*hx}>Ks!lE7&XDWFKCT_6OMr`uK)QC7FgEG8KkNj zM5Uw>oE5omnM+X+!X5*uNdqcEuGBfz)uc_*x`*XEvE4XSe zbMXkkpA)Ne-$@G>h#_E=lB?^Ygpvg|?^{B<*U?z_qZIj5(BVRYdTVhSTMb+j`kP1D zX2@zag`3{dyBt0@Ze`oAQYB>M8Y}(q(JL2o!U>N|J+v%;xQKfUJJ7iIOZ=mpq?upX zE+<~hZmFv^XSzKq4(9A9{`F@9hA%O8nG5Bc7MuBE-b-EYg>5|tc-v|e0bV~CPs2%z<^i|^9K*g(jx3F^g;#l)rY+urZPiDF%k z%m2md_Ok>H3b|?HBYL)(QESpy30-tn`NH3WJ)Et&2@BRD#cDm$)cNONsYmeS*@ZV`=?g z>YM%!*#8ZS`Iltl|9HE4%9regl<7)Pap5Mgq!U%-MLI36UIj$JWCnuYO+IVmd>8wj1E|bRwh@J4Wb9#?lVzYT zN8DC(!iF|AEgiema1lqCFvLid!deA`3xuP>fWR+>6=7Y(&bbaO`B7wI#2QD%^7~&_ zfer;lMNM?6Fj9i7y$&cU3$Ml3jS`??0SS^89Z&b-%kVw|;U=Chg+PMpp@N1d02?CD z&YG_MuKBvFkA?g*cE=T0;VGAopW2=PFh(`TLeXC}N0)Y1-Alwc`WUFA5!ft*N8Le0 zMfRHVM3LWKKmuHLfefKpyIn11|_yVZR?za3_s+ve!R25rhHThFs04z zQZm*^k!j7W*NBwgT>BDBV89M;fCwy4=lOIDE*I7ryots^Dw?Ey7k?tCsn(O1Pj3`j z^P_R4n3cg(;5D@HQ*6hGIa-;egdwTPs*2vP5_GC^D38#(F?vTx(6I?# ziN_K;>(a&8g<0dbU=Lam$T9cAXLgluns0G+Ra%(G-ecGt?1%!k$+#Ykq(r%bTR5#0Uo`A%kvHqL+rD8pWRd zxzxYe>$#JS{KVT9_AABr**43aB%caC8Xj)z=9ELu0Sp3!9b#LyjgAS3-ds^h zEJPd$QdE8^YF8|J>xZu{^)l2+2KmqFao&U?TboamBMLiJdUJvGDg|$kvrO6@Rq9-( z@@?PE7+%uh1yI=ZQk_!(A&pAuoyDZziC3(Kx zu+Y>;8BfS$G2E0x&$MnyTBR-NA4Cf=MByR;7xidyz^cQfhRr6)Yo(89;BfNm7=yiy z`HZIRovQcNUyF3qz416UB?55Ay@o|Wde3lB z9HueCcuMH^FYxb9f+wL{Is=}s4rMSoOHn=`|6sR8{Tw$V{QYpcxM87msA6uW1Hp|? z^{`HG5o{@!oDERdyD7}&g-N8Ag_|=&3)Bg}afz|MUu}@wc>X@$4T|53DD!Pm;t5ct z92$aBN`8c-zH$-0%Gx|h=$xo6>eAY_#avzbWdV)p`mp%0rq;TdV^f`lm_RjB3C}A- zFkv?6o5ZIVJa#03{oO=2Ye);!Kb)8xSQ*T*EP4uEeqHF*s^B?&<@S*m9xHRk_0K#Sv=FF9%JvdEbw(kVmk- zus4wX`wjAcSSEndN{oA}+-p>_9YRSRiCy;Qe zB@a89?;$<4mm))PCipB`M=|x3167|yxGNKelt@%O-tePIcwL{4l|7poT*mtWiZ2IOBWx0xYMDva(N8l7T9xQY%6Gv3&C39fFi z1$79!v}(q6x$`xf?}fuPuYJEsP^kcWW`IRzL@}@H9q)6$XC--YwLWt0>Lbh=O~<0? zzT6+@hg<&mQJWP7PBbSxazE^{@;aoaIctkNk>d0HpWD8fwVh5Nciz70GQ0~7z01{Q zMf)_jt!f5-0x0~Yxr-L!oZA>)uhn8^U+}12t`>2Y` zPk@&k)C=RWUYc5DWizUGZOwWmKhLP|mh0oH-q>a~X*$HaFjyH~cz@ebwHg{0Su$7@-Qrs*ZuYsrSAFPjPGm+B8Q z&e<1C2%F)j^odh>mT6$78&y$ahYOg&5x z^YHV6UCc4D%vgZCY41W~N@^~z3* zt>}C8GVtiIL$+zOLdSv8$;Lo-keWU5X#^4UfA(s`!crqT59m@|S`dxeQv(rZ|eS4+u*UHnn_pM74a4_(i& z+mCi?{9vtZtl8I3smtJ-XMf>o8O@v&v(%Y1<*~nj6ZyHSxZsLqda}>^lmp42%K1tg zlXe1UU^d#LP45ZNBDRrYYby1Y(+j8|caDr7g9|TzSD~^t8fjvfHHUqQ(47D_sW4M&`)I#1wFr zlLK`Z;!F`G90~TS=3+!a4*2QkY%00&#Z=~nRp-}?6Uc%lJrfO4q%zvvYSE3u_YWv8 z1rbxSzeMxx>A3Xy9Bhab6GB-Vfh^%`7E*&3`=;*hX|(t6d1F$crwYiS5yMF#z4gQW z>yebaVXk^ptA)_#tb=KN-}qjxNXj~}&@vIuaY?<$CyuojDJF(SOo_xF34f|ET$NZ- zCs+)Y^oJB~bV}sgdu?5kMpgykk$BfYc<}5J)m67}CmhonytGB#SG-dKjh?k!+$&L0 zvWL-@RFyTPJpsPCLROt$SElDv%KH)ehxX*zP^!n3Yb!`g*FlcRC+8}Ey8L1ts@N10 zKH_Z>bL%=eW=C4q6_Zyy!xRmL14cR%NMW7A^O0_)Vi*Oo)&T3@FhePf{cU9<&TG z42N8=_2i8B?_Q%w84E>PP?*Y~jm%K_AK~U)Ko;s;F_iF6lIU+k8JR(;!8DC;i9?2Tw)jtjp2z(3O=K@93TE7EjnJCwc+kZmA&}E|z6n7Fk%Xt~Nq5 zDd0eml`^SXdhVbl1%~G^qfE?%(a+cEZURoklIn};CXX~B)6yACB- zN!=I04qQI3TO@G^dnGs$!r2ogIJ0dFHk>M=tvHHCkn8D(COZWO&@BI5 zR?k)IK2{eYimbc^zelh<Y-7C=fcHiBZ$SG?!N&ZrN(7rKiSTpqGBi;|Kyb&rc9 z6LdWM&4s!IBtK#4nITyTE!pp}kL6X}xA#U`8h#nXu0h(&&KI&xU99`b6=J?KSrJFn~t`8Jc3x0_n-hwD) zi3;=%g!#;ykfi$KI;%U=7A87tt0GS3yM5Z(1eZL<17@gYOT}KDrzgx?gzX*rHsnnTe?OVgX z35Ttj6sMK{(F4vYd$6n74D-H6^ldYSnZlgBrxGhm%@d%yZIU9{OTG1xWB0w!#I?Z_ zU{Rz}pJ2*ydRh|X;YcRw4Ry;%!hq@Zz?x~dJyK^YuIr;6kCmuAN(<{cPkXowmZLLU z7&qR#9`UD`Y?5lqQa8+&e z>0i&?cdaj9oyJJ`P@jw*-u8IwE3K-V=&BdWu`iqovWkAsxJ-sMY5n=vCOA{B)AQU< zfa{~gt;?nbO|~pY^#-GJjPR@WUSX6!{~6x-qtt^gx8!YOOjq@9|Fw2_a_=Jg>bltRpE4D(hAe=*#@S@VW{i)C$s zd{tr2#kkAp?(zswJ+SS*fO&cV8;?9*=QzG$FOHq_A#p6C-S+10(zbT&Gb1KKwPq1} zb)(H|!A$+?ftMr@XSqQdEX===vgn+Ivz@PN#~gEt@@jw-_G%#pPFF_IZ=tfP;DeE6 z-lhXm0$rz0mY2oKpO^V+^CBpVKf_9XL&#MP)dm7w2F+3G~jO#7*9CRsQPn5>qN zMvFu$B6#a|lY;>#l8~ai@G+a0X(ZW284})2MBu_5YZ|V(pp_A?x0rZ|HA+sHiAtp7 zZe@)P!+<+6*5};M#?hp-DQMzQEDlmx=uxC^jjs#mv60UrHpoh-R`hEVyvUoJr5#je zk6Xta>v=I}Y(flc1-S6lSf*cGl*i4kh?@WsXEMYAv^3bXv*N1q=3>z(@S9;bRj0^Z zIbh(~j9P?dWx|(X#9Utuw~o=|Sj4&tZs`1j$x>CJ(_Ow`yYtrx1@9SpO{eLr!yiF4 zx#sdfF1AL&?R+?TZade0pq@1MWtY2uQcJMo7t~k_C8tPh%JC4YM5@{TIJ#7=K-K5u zuOdsoGeW}o1vX|-7C(7Tsw*j}_7%I(5X(kzf4-Q)^)YrE8P32&i9Fm6i|v}GV0~$Z{-V=jJhM|Ry=@g8 zhjbI4>Tdk{bY4oYqGXlD>+~7XG-~r7+3d_^$me!CedG+i647?EwOF%1xUu+VB{q}c zsPP@1vBLNlMPd(#P%ENqt6cDJ_gyxPJm!}r3rwJ>$mo;cX)fB66cf7V8BOPoWbX-x zR8#?&FMV#DM_h|SjYmJ!8b3=8^;anD7OIj?WtYP!E?Zwiu z;PtCxCWcM9C5~v-?#TN=D_7IExNLSj7RO+!OI#2)NPNhw6Eo0{71Oxy@{T{QG$yc8 zr<_veIonbB!hDZQl&n#XXCPV1B!2=szx`sCr@Vm(_rYuD`br6A74$(SEdn3mr65du z6jA&&Occ!BM*e(8ctgM|+N|y_D*tkhPw6yM{@Mg+*ZG^9a%#gGIrjYDUxmPb4D$5l zRR2Rm3yV61H+mh&$t)hX?Q)K5xGOZs0JB0}Yr#sd!r%2W`C3ZeH~SnQe-*^+=w7km zHQX?3GL7YD3Zw~NBvn!gSi}4IFH?-e{y&h6{G(t6>@@tZ>jl~BJBX{C zy=S#bz~^Ik(|K43!LS`EU!2wB2N`s-3HfiiqimJsch&l=V0kNHPo`iw>8j{gWsYLK zmQG8P+@4ghHG^doFDRms2rtTj zCgZxaHnO}?d$xbNkXP{!@xZ@qzv{NykUc^7`ZNMsZf26+F1vhPnxod4Idel+mybyHvh;2?~4gAsWr1+^s!_Fuc{ufoM)8JKs> zf$vG8(dI7>gFGR^Oe}Np9U*{qE!M62UkjXu!L5&%%i!U&g}yYfyKI>+3MM zqfn`5;WV_y;o%Vr;hDC98YLN1E@=i)DQaD4;Rr1C{D=UR0LpMFNlC?uWYAJ~YZqRg zA=_kmWdB#ps%byJoD@dvU5+>&W!M1RK+AvaU-DFVa(7BJVe-NY=$5(n%aUTy;tgw6l2#X0{Fq5B(;=b!9j|7>sm+tvKP9kZ54J-@u%9*G~aaheC4U-4i> zsgciU#HUl>DjNM|*SFjs29F}of5PbOyxh98#y_4FA9H1w8z>Tfy2bPXd-q}q87l6I z-+-?OB~Qadv!8FNFTv1Fn#VwjM1A|fe>eO03;F-y4AGN4u?@Yo-Z6FxCtm;Kuo?i*M4zqplUK(%kE6`Rn5394v37 z_O=X5#PfLU>{fKB)TcO5G4rnazAfhLKp(n>v(t9?1Ypm-Z<^h20CgR}p9w(=N_qJu zLd=Zt8@8)$rUHz&1tR^gWWF&1vFM7zVfJvW@rvZmdr;$)34hyUDQTl>aDed3g0xi| z7d}a&{Ieow@z^4!_{%A~qU4!<_mC)Bt%wR^jv=jfp*Ts0x&&TXN zu*Zg8K9;9?wr#BrJ?1_EX!UJduc#k8V3Nf*I}NQUW?R8e0QJ7+W8M4qebF<;|L$M$ zQWTqaH1s8NDi_1vJAN5V!!~jZ&?rx3pz=qqTL>=~DQeo_a~Qb99vvLv>SE~rh=4&h z7qE2*E#VuU$RI6QYT@^%3`21%`7zD|JR zpcBZ0z4qnOA_&Rur|a`WLRg>-qh*aL=G5O?0h<6&iw91vA?byW6W_pzNc{S1lys^Pzm5NUWmV>kJ#@z8YK8dhtNVp zC59)jQt8~uw6eCs%R_Kh`o_5&CUfz3^Dt}cmv55RgF14S@Riw(_n&WIEG=&;&>w3l zuKaRBGzEDRD}e)VWy{0Yx~a+mX#?X~ID_PXFh$G6rU{trRLXC;L@|P6i&+a4La-(I zaDG7rV;LfMsJ$u9lQN+f$<-I#p}vp&VRBJY{V(*D5Ik_cY;rJv=J{UtQ4;*2m| z8c7Vb5|xyM4Mv5*I{j0xSS+>ti3*vw^jz=CBpWeFD^L&+sdI#}5HS^`VYDi-!2yk4 zk9m3Pogk!SF-Nvxt2dSRA7T$s%{^8_V-cM)v_XS}svr=;5Y|4%?~4cDC>h z(%G}u-S}H|p-ZpaXET24;v;I~iG#PD#hkzQu~r9ba&xBZzx59dCHJBC#pM!AOy@#7 z+k#2@pkRHGdxvwAtl47t>xHL{nA+0f5tNC+#zSesX*O{C&S@>B6rARD?_AODruhW; zD0iz}c$qeqmh@PA?wWOcw+v2|q%P$KSTm96H6N!E^$zaK7%XU>aW-j)5 zrjFhLgG45$aJ8ENZ@W=_a7#&5&pM9|aVPXb65(-@ajmbz_sFv|1zwVxf>?$1uA=9} z18jB5Go*dwt0B1e-6eCWaN+Q$Mm+BUfx5RsMMIc6Vru4aN*o=$Ku(zyej32(8yNI% z;fD4Tng&X;H3vpsKR~hMLB*SmNhXXP`#PVFm^uQP1f-(_*Q#~vJtN#RrF&W(Oa_)( zofFK0ENkEiM^=&b<5mZrq>lTlnEY4IPy#VkJ&b?iRa!!#9F3!=c}*a#)IG`z7$Q(xvn!f zgyE^m3M8ASzV4R|OBgzkOe3tAU}Y`iTmF(->i7(Y%qY-GAm91+4cJ1 zTTBPb7F}?tWEqrG9VlyQoTilK z;#X|6nMX&L@ET)a3MTcL)FNh^oXBrc28V`H7=9b*PaPbY7hX~N#frlwF^IXCYj2@3 ziH%2oJgAEAtuDS&&FM^}OP2GNI-GD(L!i(tqg7Wm3zFZ$nYS1zmD;#WH1DR-w`q zTkvwMgK1M3J(AEcXsz7c#KJh!7_z!)j2SgGKn1oCt*U*;X1(*T*teeQAVq!qxA3G5 z)A`oFl2%aAn|^%}6@Ww^YH5t@HYIW18T4wBS&$ftK{Uj@c$3)34;lIPdy2%_OYl3d zURhXmbF`Hz4AXJ@f>N=Zxk!Mp;Ak1GdWTi z&Z99w9!O4C;70CRfahK(RsT9dKKAO{Y!7)tzJGLZ?I9l{fwvJFgR9i8mDQ}Uehnk# zaOL7xNdB*4#vikkU7@94@H}k<0vv`X1F*l`Fy{@b+AA?ias2XQPnpYWfK&u&B*EQr z#{H7Z89yTbDiB<2u^0Tfti5Q*zrB^G`^BtwL*CIGvHucl(c9WY`n;E>B7YQvcWw{5 zpK6{Hk!oPTF74l8-@pIXj?t@k{8i-^v-_5k*L?f!n77YC&OM_WsM;=KaM}C`Ff;sH zx`TAa&e7NrMyA(`exI9L*sDH>d98If-F2rg^BB|fNJwNG_VDUYOy18APJa_%US^z2 znINcOZ}^Av;D6q!;+p<)u^LR8;Zql0m92 z?Y;sVh376QSY5y^?GOTab^UR>h{*8e2M$uAG@IxTEkflVFMEG9WTf&3A-T6t2I^WV zw&C7&E=)aJud!whF_)Ab3d^p7RuH@w-NP`vV~l;%0Fz<2M8yQnSk7ll&q7{y$rB~3 z!h+4JCpl@+l0nZt^jUmzf33^w-}FmN9m|P_?DeOBlL4M}o0lX!bZz8hg6gjpn&X-Y zXI~zY6)X?)7sHc%lfz0F1|3B%4(N}vdXk1Vc@j>REqgi@M5$TMRm{z~C`loM_Iw7y z@f=W1jI2c_jfmgw2i`I8^!u&nKpE*t;fH6R5eNGPmt7?ZjCAjrFkCLLTq^HLK)`Z@ zcBMZwZyB_HZSp$ z9rQfT?#no?zq)O}vqh%xT1cs9-M!MN()N+6BKMKLiFbO8QKKu&l9l+5DAumr6~Tu6 zA|%LGe{NczvGKM*IC^Vk?6L9*zP(^k1n4kPet*od%rmPtK`9ZUttkLRb2p>y zBmFF2bfQKqE-t344!%n%Fts^KY8qo^Q%)%4C+@i6*wMP!?}~c2Z!kH|-#VD6y8wxFS3}Qs5-nj?MT? zjW=^KW_csfp`i_%mbj7GTt(I{5-r_*oKqRX4G(50?p6t4uSmfK#bcLh)6&&lcuEx& z6)cs3Rl(CrVCq84(*e-@IzfBo`aO5MdMAtXJI&AFc$3bUm*H!P!=?S|p#zuAm6CYo z+>^EHI>163OS0k1gBQ2_b}ZDwGSkMvCd2%}i&1aw9}Tt)HmQ_^g`)_lWWSxjGU|3O z_=eDZasxGR>e_Z|1g;=1ytB0)*-rq0A`k1$SbG|~dus=Wmc;5G>C$qjq!P<~*+oW% z2T?WkX!KiyA19A;;Z<*5uz3}I?^~dtgQJPA3nW z1T2*Ufna#-XxF;(u$USsTg#WeMdf$3Uz;718Q~=z)bV@y4Oe^{rhgI)E&fcC1{Q;p zxwd%%{PIZK3K3Q6S1xdIroDd=HDd2cj0i=et5 zx%?WmWmDsOVCw56bx%Edez|iQGA4qwDeCng<9pGUUixMtV&<|(U7inNf;4^FWyOCC zD+iP7r`00jc!a7v&+KdWyPEopZWGDM1S6XQ=AGlTdp?W^vh@#fMBDGRl_h>9&DNUb ze5OD#TiVgTHxsQV2QT{yFAFxF(a*O2#}6B)>5oh9D(B0S%~?Qi&lwL!gOktRqoPD( zM}3K+|8D&6xAE_}@#iJ<@0IfJedFI7<3BeOtkP|KZv;Dkv1#}nIU2ky%CtU>2!<}i zpIb77!K64t*0dAqg|f_mDBbcrWieL-J)DoUt!VcZVx7R=1?*a>ZWz|INWFWZe$88* n)a<+4HA33q^)uAhF>Pn)0i@;V-2Dfr@&Ca&5V%L{v;nh>sa8C@IrTx?u@Jh=a8 zuc;}e>f+&P>0%96g~$SLFn|yU8!51&h=MRwR76rq93mv7BrKsQ4uMFDgM}sJMQ(nO zzrjLWt-YM#E}nmbwfP6E=zj|P+Z3GLZhD5mkqB?N4HW6>%=`z-Qi%VY7Vv+H?=M)J z|C|=#{}fi>h8Th0iv2f={#((F_58m5yV>46{N3>3E;rVWyfN$RLjds~#tN``f8#z_ z*NcD7B)8aZJgWq zxVZR41o#9*B*Zs~gyfG#fBg~u`SkDM{{D3R9zceNRdUM+8;cBZiwp~!4C}fZuyy0( zSUA{N|L}gmZEPIeJ6N~y@vyJ}*Z^#-o4>y$tQ(qf@7%`2Cj|g-v2J1A#v{Iscjq<^ z!3~n%?BJ4--(jJcx<@IL2t?_p7~sk4On_lElfruSRNmBvtRh}ww3Z4UwVuSqtF1O?@D+8%mA`bX9V5F!x(hgLeaHYNP85=Q^uLu%1}WG437Vd=bUuuE`VYT2J=t1pwg< zhquVE$p8-kD_?Q3!{*kFupe6q%?p=*;?Cq`EDb4W`VmpiiJUEr8J@0pu(kV9C=2X~ z7OJMDfhOXNJ9xbIHTclr3|lx<5Vtc;0@$L{NpX3saD_UqA{+EkZf*gYCTO;SY*V^y zd@p{8iD@9j^&#R;wHios>1}U*iihQXKCM|b8q9nPB9sEf$vEQ4TvV1(Mt}uz5;)!G zs3d}9S_gObIq-Ku;@c6jcyGdL$K&;oAkJ>F%8NihWYL@k#kiU42&q5mmsx+Zy*S9% zu$h&yHz2(${FnX&vETAY6qxA76l8V!b4eFk=g+qWb1en6<=x+j$nPq48Sg5WN>Z%T z8wSX=HS7MP8(&9RymMvXQ$>d(yAP>6fgv5Tw|jp~+<8qxWcQk>cvCyV*?j-|$(D9i z8t1E~j~UEoENkUwtTPOe$3$iAxfW(67Zf;W)bytirVts?oDl!~L^+mvpW4quDRP}p za$ascvkx8*|C5*hX664#t>~-L7?PN|Z<}_x+dYm!aBBc-+O$!>kO6g`*&VBmQCsl1mn=Cl%8apN90cypgq&Vrj zWkFgJD*Oia^7YN8>M17FoHhKvEx%im^69hbv4thqg;bvZX#C3my1SN?;jf*TIj5}o zwlD?w2o9F6k}u7flv!z3=+`xCD{Njsd;>u9z^krA?f8ZCE7NQQvh23?4^E{h?o{RA zyo1h}7Ex#k_aLj*Iyefk6W_75sqK;4#KZ5jZH(+V7xa2g*|0U1b7<}=)8?|6xu^Y) zDDdu22j%fnbYuaX>r;2HE}$6+V5-nSD--r5hynP0sQ|ogy>~=HU%)U zZN`XG#VnxFlN&QB2bkH~g%EP|1l1PpZqi};32AWcJkfBh&uyP#jPsRo=fP-Qv!TA_ zlB8>SW?CG_yaHR+hPfBgznQCEwY>~Jk`#?<{Pd=ZF*F9*Wq{3SdVX)2Zrpj%*mc{i zlHrq~f4$0ASK>ku?XIq4)#?#7d6igGi&I++Z2^M4VKTW?4+=FoxzBPENiUjgmblIk z;r+9mO56qe#tQX+{a?cu*IxlwUvroDiNMIBug411KySQfOP=_pH{Br2j*8lMo| zVz-1{Ys`f44F@JR9w=V}$~-DS`nvl}`1`AA^Y`oLNn8F1;p+@h{~ap-|2%+M`5jV( z^mUxx*;q3=C8^aEb$UCaC&GVMod*olLr3)YUxg{g*YD4UrYGX9dJ>rqr5_%=L!hUe z=xbR8&kNoJ!tLLG(I;1_(r|~`n1$-#{fysLW_D`$J$fs3$$j~Aly1$z4#w0Q+>T>w zuPq9B{7dC8Pm7N@ko`UK8ikZ|;`5!vzU-`Cw;X;p(?`QoY!k{){&|2$gIgUesSbwRY4aH zeJp7}seG(zV+G23vW~|fTn^^@l_g2a(Pn`~@OdZGlrAgqtqK~*P>`VaBj1z{BpxY7 ztufZe)}iK0H#_6h2# zJUBozqvo`_qc02X5wu2yiOuUCY-e*^=4bepSm#vZs{NT18@Yw+cx}f5R-deG6BLX6WVV)jU4xh}2mad3eXNe99H!Ho9|0YeP!*wfzrEs zG#!}twHt8R;ij6Lz{pQ2_KS{Hz2sW~_m2oqMR!fv!s|XHzI&R-=uhpPjh^m^*3uc9 z{Pje@Z9{vjKani5vDxB-|LjQJpjd62)2NU`-?wKWVb+QnyEy%xwT^nx+!B6DJ+tE7 zi&=3wfgBX3X~%NvT;7@*v>xTuPd4q6DT!W9*0XRxL(eTdF9TLITjdEZ!Dg~ql?syA z07L#xTw7aIP4^hoHa~=lXe5KI*+D3cx`5sqU&H$eHuZC5Av@ZWmN7RtG_^C=$nMpm z=D?~(f6ck!%82XF?T+Nqn6PD03QdZuh=$}6XdI%cHQ&67;;=O+YOD2iZmt-AYuw?h zrVroV9?xgtCDMbiFzTuFu_fP{_{8qD4pV+}$l0I?Eci)9zLb?rTei(yA0bv_+u75! z$2lTK#`H8J@B`7)MMuRFtw|lqi0sxzpqAMOD3Y6uux5bE6H+vs*$S&j(O_XLoN0#G zk;M*Ir~A>@p;hT@X`#LlF)MZk_omi?lQXmGfQW(ATq^eavLMPW-G$Hbb7C1r(QfDl z6Q=?Wkzn_RS=6(%#Ja|G-d zYjc>ZVsbo@e$8Ppf7)t-*5NY!Z6rD0dNlxd zMCU$u*cAG{`iNews^7*xhhpip!x*AbK7$ zAhb}*eNtv&tE6F^q9yCd(~;#I9J6E`vPZ62(y6A26D+)?wJy9_b-=&4zzJYbb5>5? zihXYMtjv&zr;#W#VeY^T6(j^W4GM~E6?dEFFZiS|^myX<4mY1+9sk$dML{I3CusnT zD7ktizZyLqUdR|5eKvx^8>N8cR4x)XEoQL7I7MkMYDfWQ?%W>mOg&+mL1VLY*dtoS zfpwJ*S0C%f1#~T{SD1qhI}IPA%!l)>7i0ld0LLmR^yR_RLn6+ zIEHOSiqeePc@rkZrA#vPOjY{NS;j&ali!XaGgIj=tR2WBer9bepXXAU;q52PU-+qQ zHD$gWPgaM-PEa#5Anj)ijF!b5yFcp=ZfmT2fmobx$3%%9iaM2OU+^XtaL78vVf6dC zR1rAIx<9Ty1!S$D$}|b$?d)5*Y_s0`#&pc}+CCKAz6Jz{K0+Il}We0r@DBHvB~f3yNmS%I#v&^A{a}uav{dH6T;z6 z1z#>QeC|~UN`ICfDrvq;`om%Gurt^XBu#h^4q4bN2~)AeO(9E0=!Taha-GeKrJH4E zO$j8ZDP*14K%U?>Z*aUPLK5(oS;giobq>R^(1Nc~A+b$rFz|CIrD!kGiL2UJ#%R>p z7JgtY37>Hk)7ROC#!7>SKiw;47RO2j!yEEUwiDK=#-lcR7A$eWI_ z`lhw<9jY}29(wKe+JV(JYr_Qyp5NA3jzb<{nE>A72{%f9m?!yh^>LE-*Te-bK}9K0 z2aA;KpJXb=Zeg}n$x@UJsxZ#4M7bXV={y$}>Ro(rW_QIo-28U`8n9*Zv+3KkMS#9) zu9fgH^eg(1yo|Eft;Pwtz!$(F8BTsUYrZ3iKO$DPs1o~1;k=f3iuV(aR6`$ctLU0X z_2}3LN;NXjbG-f?;a6qdE;H1LvaD6j3JcrXJCglhy3eWfNTw30Wk*imNvvdGe!l3P zZ%~=faan*ZfpI|3J{}Qdn!g?E>|B=jeHf_=rJ=0ZTGsi+{HUz4^a3sI1by31kDwi@ z9FO@nA}Z8Ysn{4V;SZh^?QvVPIts}JTVw_5PUNh2)i~Xvob{8ANZVnm@OAb1R`?E3<<+D$ZJhL~<}~ z$P%rfT(kqs2rU`oHWfBc%uOKe$ho7=(v<3j5W~_)2G0wqCKMD(C4A(K5(cUTCJKhO z=XB?1e*$iXBfqD(nzz>z|ZIYZRFIv9&2|HHAwhF&SqJZod@=mals*H&r?nZ1A>Ba zf_#Vxi1NBC7X@R6@y~-LR-Vhn63}-FF*t?~k5=>{m7k5M!fw{!8fn8}%x_iIEWCxw zA zAnB$1rbyTk$WY+o!oc9yCiPaqTqELWM>JNV!E6((p90o{G>pMyNm`UkNc64&jU?BA zFD|ZQhmTX>7*xzCKP>psUV+3@%I04aFbS@;vn^gdN$ z%z|4NvRG>04+nw!7z7FW#4^PNoEur~DL|7>xFU%nE2ete$5^I5O3fCX3$Zi2vL(}F z3bW!Y4z~W!x#L*A`hf!E9!$P1{<{0>py{1LTqXs7jjnpGt_QaU+hhk%ivsMW&R(9{ zqd}NSF82vCw!)d7@zppAAQfSzS@h(xauV{!v=z+7K;B{O&3KuAvErICK_ufnwxS#Z zdeGthYdsK_9Ui#*voUkaQ+}i2*@=v$96{qH#U5&3`bhbp?IUj<31jVL;s*W~^LI_T zdPSBW{U11Qe={fbJ;-f~r_p|S@U#1Sfi&^e#FeY~;BIiA)6Y%c&ZpF_hnzFqb3QBa zi+*nnAxzSCN36XRtF6!7M964!WK3;s_$0V40d+{prTOT(o z3i`ODU8-Ak)PBF=^l4?ppHy@HH_`teN%~RoQAGdX%ek0ll`Aab#nv139eNqFq;q|8(NvwDw8OP1c;llz z5gz}iCYhFRG}%&`%L0pZ$ZLWPY2I^VPe*5uTG-1x`)!Jx9b$(!mKds?$hk7H#M!w# zaLd@&;^T;q;-5r3rEs}1Coa!#Wa;S>OSCx|>F-mA8k?^HH5b_bwgqn^+$OWpn}2qL zpU50)(Gp;CYPoUohf&{Y^r6_REH3Id6&BGkV;*Zkyx^-p5@CAq+b~J5l3gDB#6MSK zl!Mrn-1KmAa*qFe^za(6-=1sp?`Uk+he9y>`s{-VCiclM_=b|32S)Dv#U{sZHVqXE z-hovaiJFrFKY8Il%^Bmoaf&}g`6m}VMK?4?nn!yyMJpKUq*jLSJC6K2IW_Ia#HapJ z^;o0jetZc2rqLSqJdfo5pFXJBdgFt6rC`yk@9HTICQMcETuvYDjDK6LFU`q1!9JHN z#kxYRlR8jT{~h%3FGXShR+OOS@H~XJxmi zN28x_Jq|5u{0@5b@ASN{Z_GlL2wO_L@7WU5PLizs^JCqgQlwZ7@Nt(bWz};UwhG zD5Lw|!RLQ(#H=jqJIq#C@S(5uD!UM)@DrH~U1IoL8^@sDk{h zX6MTxRmL+~DzQlH5%d{qL$&;#Y}@sf787iF?Wy z&a#u&fU_5iP9_K6DBcGw<_E-?l{U^n$53Crv$d}QrysxS$gx^~GX25xj^y$U^pfG5 z?mqqV)Em<*diUk^x|m$byUyI38ijwcMh{p1cGSYlaHi(cJcpCu?3dG?J#3PT3F0mY zZfMlSIX_hHWMH+DMwn)|!}XBGGhm_HWqX(dYgiQ+mU7A;xz}l{E1~@Q(>36{_^}?F z`_HYDkGA)bI|0!E56dJYApPTj z9bYTVZT$qY2eT$u7X3gUc`CME_c+yrZUeYf5oSfT&seo;jcg9$?9w)$o(fdu&xyJ$ z+NYT_N_U>yzA%5=;SQa5YIjR(KzvS2Z>n3ZnTXorx^i^b;~65z^s^5()a%@w8@4D! zXE-%-tFa~KvLH`L)4KbEgxIj&+Ec<=Xwn$~Y)62d{x_!X#0`rT#puNn_J*26Iz5xb zYe0F>O9BQM1w}-{`xzh7@}LO3|5dq;NxfHn$-qJt*oO@_s&H($IT)4EDB7QHX-=d| zRJ2-1R)Nmq$WoP9Ska+VH~0Z$iFcSCj;Jtl!QcEi`IS*?|2w_S7*{djj&7fXvwt<+ z7bI||k0ITC*~|&IZ4=FNsARFU82N?1#{H#kyz(2QKE3Ul$by&KvZ7YO<11{}vwXy< zMp)rGGr3Q2;#)ce5T#RJ9jPo3x+)5A&EXKB;NZCsXK-Te?R(t+#bua#FKSzBpB^%5 zTgWhY$tfai@Ifc{#^!R1I(5pGo}ycnpBhilqP`#RcoM1w%70j*r#M0S8rzZnpu99)b-E$is#Nf{()i#mdDTJghDLV zLv(Cq%kyx_SwZ_69=6WIY)o+ki7!8ib*<0mx^>qEm=K8yZvf&Ld&SAsGh?;6$yGF8TU*C+?Fhe+IkEkc}E@I(-{OU2bk$ z6%l?d+I(e`C)0{5Sgbq^#t}1h{k`>;kIvZO=Q&X|Zdh0Yk;$%v)2D{qPq8Qs#a60# zLgA7T5*Zvbko<zBHk%q&72KjwGeQu78U7c5xg_EDs*&fNkRBXxk zo*PYk#bd8kt4J|nR@1@82Hy9*Wg3!bmY0*Xz#uTnur5ZA&1Y`v#V+|xqi))dHYH;@x1y7Ghx8le=Zi zz|-KE=WWeCE8m~LaqRPJJ$ZBRhI#%PFxPiJmR2HQAn-v#`O<-UhMVF@0DUERmAv#= z_Tuo_$(e|!{^!qz$NATQ(E0cagLmt64B64wfJDcOwQB%#)1vD&faz#o{TI8k)V5dB zPI|>{ZwsReTv@6DuhH&cDvh3jw4pLLbctq5oP7i4Y_Vyq36qFiB5;O5JDX=6pbMF;Blnua2$(nRYryO~*g9(@l2x89UL^D$e z1%XrfCT&);VKYCRBzQ79;}thmuLc%w6lP|_iiqyMLzaLFa%Vo=)>w-$(EGUI`SBX? z;mtK*6;8w&^5E6;&8CUooom3}&7^R)^3B&!xUS1gwwOCBZ`7Zcp9^N~=xiTnJl?G0 ztqEN_r-@oOESVDms-=nr9Mh(qRxH3_2p#@ca;c}s8@d(|UCc(1pq7ExLh`A%S~ zJ7)b*!6ZyJz3E`mn$9x)OvkQCzu-GqW0B--lT5^MUPY>@@4mOSs(UoYvZ2U#R+ffX z&5Gm+6$LLUh83&2UBcZZ%vA1#Kfl7XRX1&JVjYJu^1}DbOwsyZO&7v7bdfL zXo}iohy>t9^?bgd-}4UkHneuR!zIL)LB1M9L+99YiN+TfTxZa$juQ1ET8e9Z5F9f+ zkU~@g$!M;ML&)45o>bp;HlbyOWK1f*W``yYG}_MeW{PNVs61sSG7U>>mF!6!TM!$% zz^_lEB|vv2#(+py8_Th$1^EQM&`Jh&feFj&6T%3Q^RJ468)NSvJeTDaoEmoJbhD{6 z62o;@v5k&Ho9B%K6ksv?rJ$znQF zH{_s{Z@U!k(8m>>@Tzw=0MndE`Er2w&ww4zL&=H4c?dDSrR;cl{li^KZL zRRm4)57jq`NwtaMiXq+?{8Abc`)b^Un|0~x9He3BB(Vflk=N{nEkzc(BNaVlvrmT0OamPJ zMT|f-A|h2<&|oTQVh1&^GfZ}ZmNQV+OIVfaORdZ14vMg9)>McsXmjlaAN|8+GsjHx zMX>`rw!tH)WDQ<7EgT?Oo`;njqi$~yIqVzfDb6oU^>Z%8=aI1if|E(&qDY&)9;7&; z-!w^jI+3j^R=|?1)#J)BjY+37aEg4`-z{f%OPd-yW4jqr1#+heLI^H+M=DqWm1?R5 zhd9_V6HnN=YQyN1@F^3U1}io;=0Z~}{6HUwvd(5~+B7Q4BSB_1EFA6$XSQ>un#?K9 zpyrt|OH8CHv@ox@o@qR?8?r@+FKP4Gbgy{F&?40DW3Dx=X*x-o!O`#er3oRUt5VYPD}-DSBjo_BO(_g z$w%?dO3W8@)M93L|K)k3SzFE=@EcMowJfiOn8jjYTs_pskxqkmh@NNBTi0!JN$F__ zEV+bZv!YM3A!ZeQo{_k`q)2Z?%}++Uny77>rF!oyt)HT#E1N()>{0XRYruzxgEY;Z zFH_1SW{axtKD#s0zvtkH;OrTG-2L$xlXODf7KL%1>0Zdma=cAFg__B<^IjgOUhr33 zN#boyGhw%&u7O7)Q8PA@FYf?$KwqccpMA_5C9Na{nK0*hgEn_CZ|Ge}%wviSd1Nd~ zx7@`?(@Un6EqX)?*Hupv%HL(IevlCOK2hj={BUnRhER(Z&vk}#Vx!E_piWkhUw*AH~?3vsWW$eZ)`vLewTMNi8-*s@aA@s>r+O1QS-g?E3NE1Ma(#uO1q_I_3?x{K8!@v+nXP0(>P-Il+B= zno0>OTzJiBMZj01MINPy2R*|?doOD%@xO@3Ydf6C9A&opC zP9=`3pzqqR9$=SIqtezTD_R0!Qu_I`b-F}`U);+r^1c>qjIIk#?mJ|qTv4q=2C~l$s{QOL0yxzvZ)jsCC+y z2+0w8ALm~PW9&2Hqb;l|y`X8}uvTDWTeL0MJs42us7s1Tm?{yadW%nVd!E(~w?^VK zu+7@2G#J2|k_K&^ugmUgRcO!>>E)l^Hd*Hh`suACc_pd)nNe|KOWkdtafQ91fO)z= zJn!NfAQ3axIc-pm8&-I{<4*mI(#kBk2z&q3^hLUj0vQ%{7K8P_x;8fYWf-S4A=t zU_&H#nuKKQ)F`BG%ycboD4ZDCg*+n@(48Lp23X>_B^4>-++Riy6em1Oi#XSaKjP!g zp`X)#G-KT~8|WI}@rJt?Z6A-TIslm`NN88RxTj)5)TO4EYuy4BP5C;Uj08RmqRXG4 z^>n29M(e&-qc#1o-mN=QP3!$zKiXQ-X^tF2!*aK6BAa0tRN5IFB_?E$!CCeQjS-cq z#!can?mf}NaG|nQdxuj7;lDyIl06>SV~xdyi2}ktimd1o#h6g_l+bLhfCwZ6Dng-@ zv#;{LyeLe2U6z_*uHAb~Ph%jFBZujACez27bVuj-H6(3@Fh@J6c5Q+z^vP((4+>7V zXy;yfH4TLU8WJzdm0RsCvo2ilV!0r-){(Szj3er7(OrX0N$bN(Aw3`tO>r&-%8>&} z;dJ+u8h=&`XSPr2&!sIs#XOaNLIcBPz-c|IfOe5(6gJ)-B?UKJrdSQEPBG>ZF!_kI zc#sz4l6Nuo4hX^0Diu+Y&SK5@_Su1T{8H>7t}}ko>HZj3#=1!SE!-!$o4P`*$-=*BK3O7+9BW4GVk_F z*-@pv2fWB2H8~J*e56mCRx_8OLpDnXP9&rZb$3S@b3t|2MLWt=@K(Lkow?u{WzI&JfTOun^3!I26x{407 z1?Xr#>|Hn9OsCSA4$n$W61pYRG_*J(mT}gC9%;u*DQ(_ZF3EMPqsS(@AyXrXEDodks739X4J|E{3;2}$QG?m|q?+mp zH|LTpVgKd)A)aw&IId-1ZNwxsi9?mkYdO7z z;gA}?i=zsHL~ASOih7XzK3kF|FI$o+TM`UaAVqffYaZJw0G#%sn8C+}HLA|vPE=OMP1OZ^eU2n|hJ$>MqO{6Xh#k60J5 zdgO$uHe$~NVQP5N#}{Vb+K?X{{Q4}0;CA6e4egK&o28f?p#^A_)ZQqmk95bR8!4km z&|O?=GY9uL4loisnpa#WDCLARqI##(iPd2lrnrm!U+yhTqA!wQ*@dW2^{uDb?}6Cx zp;YJ4;uGR)HH$_ zB4Y}E@G62SHQ&|tOv;;pKqb77(p1pyJY=uJpR>H*-FOT=?B{e5!U-mUDv~~QUf&>l zv2M^4WrHY0vOZOA()?UA!R<$$FK-co@_5<_q-W?f5jjaGb6H+y(Jk}>AL)yWI6L3d8E#h0ew_SZ;H%Dd0R)_ zd?KcS0+OVPw6~gEU=<#X?k0RC`O2q{y2Qu0&nl&fAsL87BUE1u8xacL!^Z6jw3V2Z zHH{pf+3>iX^opmn_aHM+^<@gIFqEy`Yck{s8R_Wxls8m)f0{{YaDJaakd(6f zgDU&L8oL%Dy8mCDSVbqv62>p!nBX7cf~=?5wAUFIPk0L+h=(1C(zVCe!q`+kt9haF z%Nk;1Mx`?_h@U&4c2c#Yk5Ze*! zPTQ72N%REhNiM(4-0dzkP2^t%V_p^9ek{7M_f0Da$Wc?$sBhxZa3v%)X_Z{!*GSJQ zi2x_81)QfRa=q#k^7DKsb)R=jq$8_MSxnEZ!)yt(VJ!7iK%2ol4CY9ppRE_X_mR9& zBr-wYhDc{>Vn)9^uQJpSyMkeFc8kK}F{)6qd$*aR*13S3VQU9(K#g^Bx>ai3(}l3Q zv1#eBKl|`9|+8(jy5c~mu@r6zWC$zNmZE?xLmrm5LeiR2m)TBotK-wN&yB zk($WE*#2SvH_8$!ZDkRDLhidSP#&sxISBKtJP(Ngc!yNPqU2`NxDoMtWx*xQv8D@Z ztu_m(ce7Jp8;YeRV4#V#b>*3HNhfF~cwsy<1^3;I; zb$jT4--~Zs-MD`QGQWJA`+4Db#pOrYm1Doy^9!M$9@{+XGtuXxWIq=|&($DTLtAf$ z zTzweRkhNYDR?iTTn1W)8_d@H$zEraJBT>ZK{U+!QQBj(ysr-@FZ2mCVdRcQwzbPMG z^GriHlNhR9gdH=rkFFoa@t}Kt74x)^y}m?9vL-5boPCp=q-6S(wwIbc;>2jkfx+tW z-YBZq(`}G@6s%Rc1&)Cpr&hfbz0ceh2J7?bAM4(T;i9yiTrtFsd5L?h$6xyt8R`7M z-OJEWZOg|#d#M#~zj35wcEQonQHNXAZ3(D0)bRmwwMAMUXXr0XOn&x*^I1#O-CF&R z5u(pYR|>1Dhl69E^7a;g?052rD&kGg_h55cSAm2xl{wW*^0U+m!$_Kx_tVl()fwFx zttK{}@nHNqdh@?34uyc5YSu@|h*^&wHpd5wN$c07YU6K@8tT{kp{@Jb_@-8$W%CGM zyi1jLcQNi3*&&qHyG1zyH$JzJc=R26kB+S5Lhfqmb%I15bE;5lM zEOoR;K#qHPY&k82w>#!{CeUE%^!F@ZJC`1&Z%(CkyQC%GZ>p?n8tW>#Sx45K4Ekrm zx?g4UFAd?+bKjAZvJndvabT~jQN5Zu*)?rH;#%<@W=E~7Vtb{HfB9A)8e_|bPXi#K z-(9@|4_VvJIW0vFLz(n-1-Rj%syRF5$9Xv&jYOThSzDw#44 zHs)mRbq6grxlH_+p^xf#s~9kR!@ zS&}@gI?nQ}UBYtfPgys~?b$q)8Ar|>USQT*+q?Dg81&b&^C@Axwcqh8EYu|^@7f0N zNP?3V%ysz_d38-pO$^|Lm=v;HmV~UL{vX&BZM6Ek-zD8PCMpc#yGNPSc=BU2rrH;i z8Q&DCv5Pq*a_43t@IUCn0&~v;p7dtE%E5|Ug{e#LGP`BnxtrBj;}pObRAy$i$9Qga z-ZN=%cDclgCY!@+-IxFD-043(jQSr7|0}E9n-{!B^_WzX zrl0$TSCLSRJ=f2=Dj5BtSvjA2{E4C`R9RZM+q4Hbh`BL%Tzds8_ei zfwN7b<0sQScofV;?QgyV%VS}^`N%4806cavNxA6VKtfL5JvS!Jw!le__S#c3jg)Vw zSzcob^Cz#9Rkv6TY}-Zjzj4^NQ_ba&33gg^^y6+fQIE}_uII2(q}jF1{f}i+}iXQMDb!C$?;&I`DZLrNK2>;Gw3# zphHz?LRQ{?4M=`8aZwt&AR1fV6@`X_7n3s8mJ^)0?Z247>J=RfBH3xFuK~Wn54B3a z-IggG=I*#W;Va}VeJ0{Fo20gaATUvHf?^WWsq*?L_01Ii7(b#LzO@`J=*UR`Q8+r( zXH_RsyfM!@q+cy}`QNL+iy0tc9(T}c%RslJoNVY~-Oh#;1;Fal4QE4Q5Am3}xMn;`RAyd>r{`P0;&uu{WcWgl1vfJ^!z< zDwgM!dQB70)zF4u;j*Y>2b)6F^U*Cj3Wm{X-|@W&r`DeQb`;NPCf#Z2T>2BOTDpdB zrkosWv0CbZO1}GjmK-mN`MS#yXuXcY+c5!D_3W78Hi-dkPPb-tRD@oVT~;cH1dp2a z8nDS3#4`w3-0#8FWxDm``Hv^A!&@B6@Gf zPqJ)zv_r;y&h}p@2i3lyl(W;k4Z3k(kctx$sw6vZ1KhUJ)AdbC1L^7-7)?*j71l?U z2S)4VhI^kDXrr48<+}+8GR0{*#%n_v3yJ~~a=h|9kY`V_!qgCXK#t3@6tghXg@i`F z_x_#c#&&>gSyE4>V1)7Ga7V%-!iqkIN>PatI=FeyQoHGA{gkOqu&^}uBLscYBOWu$ z?0t}pUv)0m2|)@vOJmAp9OY0%t|saO6AW#u5`3=9EM>}PZTd?SgEWmQhjUA0av;H{;hT+mMr`Bh%N-X?MRD2=>C zLrbpoz5_!9Q8?)&s$zynm%YfGEooX6jwy3LNk0i##)B2EHM!q>?RCk);TvJORhrD? z=+b=-wB8z4e=Sq4}pe`ty|onFt$p-gRtCCFnV z-z#b^YqA2%Y3>6bGImdlt|am<0r6`6tU|A{Pmg5HglmfTw4_^P={DSp-l2&S#J%#W zXru11Uph%sqGrN`TkVi4=5{{T&5NnET*N?{<-4d+ww*f=73ZZqMdbtZ)RhD`;q#eE zu?N&t@pst5jm`beSz0gMX1;5&eG)ar(O3J|=c57= z5`9-gsewmD-!IyHGT-t1S~wxf{TcJz>|0dQxz$gPkmug717V4BC*NFaNt$JQPCvTr z90@2YD_Oj~nN4R}zz*-%;8kFHTy&oobLZJ1JQr)dol-s?VLy1j%yVLdF zg0;wo$} zmSRkbS|+!RZJ4oIEc+6xDAyPS6Eht6*yAea8qh8fE#}^x90IMqDE(&f^|B}4Yfk(P z-4j5s@}tM}o#$VwgR&k2Mi) znt3|;f+`!9x22kn8?MRM@=od=;?Zjr^b`eOZ1)F)UNv_4Sz%KV?$EmPFrb4eX`aB88iL^+!NT+aR*o?g zbjNrxo_k$CeSm^B=sD|yEbdR>^)54m0u>kO+GR23y4nft7R`z&=ekS1ir5kpYEY!` z#qGz#d!`5Pw57J$LNue9thxO71{BPk1!^{k$#`#G9Y~@0?;I4UvI^LQM%WnQLd_?~ z6+r)$_;IuBd$3~GdKCEJL;XhE@;Aea4+%~;hyJa$hv$w2A>(gnf0Ywp|v23=1Q#j^P zdF=x1>u?B$2@~fYKx9JaLnrPmJOMRHzq5D)ha*{>KRlyncDydEaRRja-BG}ma>o4%??mWTJGB{tBI)s^*{3P+!ly=-q+M?ioj6e(+;{CRYQc;%?N&4VeksXMjd4C38wP#C~paS zMfdWp6{`?xJzbnUl|hrtRn& zF#UkKy|zn`uMkIn0Mp}SEBqN?RqB643;%wE(7Z@9hs(}S-c9qV1~TOE`N z1i^<}KJ@2a+wZ<{TDSVx)qAsS+>&1!9)248cHu*pjACk7>w8zjx#>#1|H0l{Mzs~K zd%v_$T8gx|QzXGdi+fuj1d`zH6bmka;?UwAB)GOnaMuJY?(RoEsz()hRJvM7I-I)_t;ZH4~3gOrUtY3PqjMbmRl~ZT4%MSNxAMB$V zZoIr_9W{RzmIY2aPa9l5*$aXy1cmUU<}D->?g;V4X-igD4B2@8>V5j=VkEnHzrQA3 zXE(K7L%Sn0uGeT7>;l4802yBE75Sx`-YL8juOE1s8O3i;$;OF+#OYh*G{BVZle^q` zZ2kz&^QiO-zu4$}jR>v|S=R7gTGeAlH#KJwYeKIoW;9r%=6S;DrlBFkQuGw^u_QlP+@|Fs(Jqlj#H|tgNai?}~ za4I8InLQe@8xoh4d%Z_3G{k;P*(8C~JT*2%amyZp@1U*e(bfo)q8Zu|PUM8OHS{WI zoiZak7mR16I?@pCFMP7|xF_?;5&_Nca(EnVzP8UK{>gc@(7?E1Dw{!*6Ge1Fe}dPs zsvK%Anc4G9Pk=I#tsx+tHAgb~%OZAlEms#)W;3BC^rj;8@!V(%Ng)I2OzpFM;{@>i z-{t$shZA3W!wpxyaBwwsGz>lIh{v5*S}$9;3cTLte$?TYP1Wkm1$N;sa{Bg2RrTIS z`sn2`=cs)$h|=$j{R!DRR`HkBcOcXB;}>a!LM+qdBZ0{j-cMdvdWlz@8B+foHTe3y zw|VJIDbO}f(q2GkaoJ_N136-HXdky|;wkjnT+F%f%1C^Idm3i|hKYqKyg%E_ecKmnJ*rIiw&~&V zj!l)O71TUYo8;0)qm9||x=KW^hohVs15Mr4^A2!5`j@B%Z$)BQN1=zubC!mWkCX%= z0`P6zOS$Dl5rgvr(8MVZ`}>C8c%b>7JSOF>2E%(ET8vU~;G%MM$XYZ7DNa?+KK6cE z8K=X7!s%s%b>aHw1V#FI#pA^6Jrdy|)KJd)R6(-R&h6@Q`6J>HSgK)@+po1MqL=_kq1;E$o@ja!W6u%4ow}ML*LCl~S52-+TNbn5NOi0(TW`@~-+ONM5@MQ_ zOZ07)K2x>zXEs-KQC>-%Y5$W(r4xMi7MB^J3_s&&6FX-<2OH@Y#|W6ncR(tS>C72D zd1!HJ_iC4X?twX6rDfd1o#ZP#=SWqtMSd|cHihxDe+1K5RFO4=I5JN|8%s;>0#J}V zx1r?f8KG;>JG%O&H+mhs_GB<;OlN}vx8_CZu(9XvqP*}f==B|)K;BBSO3OP?u78%rmS>;im_tCU-kzatR+>; z$~2$Io7gYR8SxOyM-78*);ZYh)HK*N`5^?B6%r7nU?KsNT(^VY3;jPtR{AQtuT2E= zt6Sp^q#4{fC{QKO8SMfZj@`G&ed%#U6QN<`Nd z3>-n#>%(xb<%i1e2ElXvWuqA-`tJ&4;3)L>cd`BHJ!s`FTZ^Aqd3X~pSQj6Cu{fBKJN{Ek+t+Lx8N#x>+A|RFB84v_2!z{ z=b~gMlJKo)-3w{OL;T+LPw;YI%7K&LCsOBo>Vsq?e;h5}c*V}#|HpB-P|G(}A(LYw6DzmVBmN(TN$`iN!Y_XWY z`{ti#EhD=T)>@Jz<1)F?Tf?IB%kAUjelypBT?ea=e+QALI=j#RUe5pCo&O6uTN%uZ z=gTCZK0!6X_WSR>_KtPE`g@@iPdqGD9adHyL|LLagm=mLw4;2%!L1MUTN;h9MwD^! z`K;=Rl~;)7|LT$YcdSmgu?9pn2#4mtx`?f+T%2)Ez5@lGv-N0_Q^Y0?4fP30HH1Pm z*5kKx6(Xs@Dy8VH(y0_4A{c6rMzQ!bfP(#x+$%#lvII@GKnv9&5s96{H)3tkAbadM z%iXCeQn=;?_lG6kXEvM|bAA2dJJO9a0T;$VAVC59{?KUR9H#WEu<)KR4NyT>sSUDo z6u38R-?FgH?3n57%({RI5GNu_%8E-+)v_lKN!C^MIb<;2-%xP02c)zV7Hwp!@;$w` zThp^>rhDsq)NpN~Wlz^vogcPHFBr&J71S&64D*0EC=}W2^R|3fo|m2Y{Cn%^^_GUh zPDxU_*`QC_j{-{~+~8llXYyHV4xl6RPm|uELxlobFI-!B@d^!H!<^x0k3GflN2+BO9P zcD*j0W=W3U88&Kd8W)9{OXLoq^&D(>p+E^qs`MyN)wb=Qf-0sbyN9zOZKP4LfIrH%!(Mjx` z$gB@MdR`OrgEiep>uJ3|RLX`GB1&P}F0Go-LIK+xxqM!6?xfCP1hQQ4ziJgblGJha%xE{{Sz`OOZL~8QW#WNoB zsWX!4!|9mXs(7JDR7XUCe&}bMdSa8HhB+zQw*djsX=py{Cw_0D8#nH(34yIaFL%`?0ki4d>RxUJm zH5J$ILCEzIbiFZK0ZY4lv3jcO(8>Mf2aXh?r%SSM^B{4wjEiO@v6&hOPzMrj?AUPb zkFPdg9KJ`>B_ip*SRG82e|M>sGLZFSrs<* zNth9N(#5yCCX0b&5_04&l6N}gGjhgO0>;#{xS}eowi6zqf0d4o_l%jDO%zjOA)h}`n>omalRooSobqVqDpFA`~QVKlNDX>QNn zl&+6OomE5Ud*!FXTSf{wV6j?4MEG<>%&d9rN~uY`i6Y`D_}@x-)%YxFoM#)J4`;!% z?Ml;^CaYj#8r!DGPUNb`Ueh0M!yU50i5lBrXBs7<&( zju-st%ThLI0i*Td&3Lq2`WP>jCz_^yK6kLXEji!LW^FMMy5BaPeg1+yNzWM&+^ws~ zq*;<_rOA?;w_Jgfx{UN>UVm(tyZBX8%x(iQ-KELkU+gfOIGQGsXgAr%&iRYAoSqPQ zeE#vYx+uomB0jIQEA!rDoCW3}%PYo_ki-_24iqy;>V_%cDX@T1-z2JjU?|My(v?-sB#zhtmSx+-3Yl04j2a?A) zy7Xea?O7s=3!t`vcP3ZO_N8Nj+QiVkr{6vnYWH_C3IKTeGvv4zDCP-;<|lwA7pi~) zBT|Cm8RO(F{^;ivzP`%J1Vc*D-tmDeXS*w|mxIy2=JiIl_vx~;dC%q?OSQZFY%tT8 zVWTdhJlLX9Yv(^13r(36S)$}+oaj9&3Ick&65i|LvhP6iVG(QCiq15>(1ok zvbm}hEW@A8!axJ1Z5Bbt_+3dFNz3(L0bU&F-TH}Zlyw@Jg1>4XZODM}b60dYV#(~IFy#V%(~ zzgTo!pUV|haZwI{&1>H=sl# z15<9ORQ|*?JaX9CZ+{uH8}B^hRz&fm)2ia+05`rChRRM@d2Dy98~fdOWci)7;>_y$ zMyko2!VR$pi?~)|j@$z4EazM>JCim>M1Mu+7!eU{GsqsfnjWh26opaXpSiaXGthLE z;iawjo{khI_2*C@&eayKW*@do9wLxJ7jzc7Q`@8z8skO=JzkaD7FI z1$tirNsU9_>{uiCy?q#I=T^(1uhh!l&YIs%DjBbX?->>sUyF1OLUFG?5H+$DWuaYx zE3D20W<5K5r{j5CG!}Q7ucRlEb1%z4y#l&Ey*X;?*S_zZ29lt2D26OE{Z*TCT;lVGg>s_{N3p z^gmtuz4yuP7A-SHeuqkC0ONVh5;hxll&ISJBOB3OsQrQ@#eWzoEX)CY%NDhGJ%v$_ zE6Z}Q!L|Rz6H*6yFp4@U#K34E`@8MisW^yHdgzHeF$uNxUp(ipdb-Y8S%CyiGNS?* z5)s&1iB%S=-vP4Ymq}lQ(=myrrqe$enbc*|ytDAcBolEQPpQ(_v#!qrNZv{pORWO< zeNr0nJ6xyX{opDU>rmXEMvG1Rb7iLjv~z~KzS}tFG4eW|01OR{{YHs`z;6=7*L>zt zQ0L8-)qC?Rxc!xQX)-~&8S5yxp~RNx1Yo?%x9{eZ$u~gld11xDQC{%>_1JffW=Z;>78& zt}|B!3~0}tHptUXL4*!*_|<3TqF6phxG@|nTyZAAV*J4Ox}mHV0F6piJ%#4LW~^dC_wnM*#Z&H9ab%=-p^aZBJ(ajftp4cM##FsO9!)vdI98Q+ z950i~vn(2m99T0v0r~c~Vk8vTU-&nM_3a@@?(mDsxcj!3LRmYL%$nayRV02{hy+M; z*>nKQ#Kbf~(HAP-Gh?O5)&f$JVVnJwR1pO1RzK^lHFY)f{u$}}p|7O@t4E~Jbvz_3 zi!N&AOH$;!GKbCyC5!T5p?VTuL@zmQm4B^iVvj+5DqBBAqCZ7Zvr>69;MFAicafF> zXA`M)^m}a>K6! z+@!W(z}_bO1DW0A_1~eW;f4>5;AlaXAr{H%vNVg!=@J)v z8(tXf%jFzoC7`+K07Fc7EbrK9UMU z^|ZSK5QV~=Zw5@OeVaf7>07$_eS+AOX$&~v@QedQA|mz|Z#!OL_o9r#cKsH4WqbL9 z3i-t^yHxZZJ?Shs&HC9*l)E6XPZ_;duOx&VPZ5hW0x>ufIn9<+g#*SyuUvitlHw)u zNIw>ulkKxALB2?B22@+QInts`)*U^nG*+!4>h+hJIY5d7NgT6j+RSFS>^M<9lqQ;; zoqaEaNo>cL;Pn{+U2@H5!56Kx$|j8OL+`m6U>oJ2?tTZYGZuoA1p|DVPn=dP`J7ps zg~G}6iS)MT#=gor{W9<4`isY=N~%cu&G$}1#-duP&o`pdqLehis__d0TQ*(Khn{(e zyTvk*yFB5PfUVD3BJ9Xp3{h!vaXx-ZXpyk%-H)ysF16H~$v_JZ)KIB;A~B=K58*r}oBc<}w2p4C6u|nBv{0x`$J7 zvo+ko<^Q_ErYE&x+S|(^wi#;tPR0h#D_1=!Cpuk}Jxb2re`zLPhe7k3mQ_NMsIHJCh zzq;jYtEX==Bv9#M#BEX56Zd}j>{ObiCBUuj~frIKKIb(5~pQtFNTf>yPF$F zY+KrgL;E$rcpOo8g0=#`x$$8Mi8*dKXEETDn+iU@hxe^NFih{&r<-_b^I13;8QGI2 z0R`xb5>t}sX<3Ux)2Z^Aoc9W_{B#TN&t=8S>;B^Pa@&KiGlxGjAYMmZbH=+1&8=6u zIKrtUu=|}z#5BVc!kMMyqkHt+3K0i#ec;?9b~}IVwjI~ITcTd|IcO~AaM`age!pr) zuMN3oT4bipnmTjtgul|xMF*?`!f<63_CQ8raEblnMw`^2_v4iF9((Ta?F^hKh;0E+ z>?@u&-&P#87$y(yyW)_g*HJSua3Brk1#xOqc;Q9+{UF3MZ&HLSy(4XHF@F zLUIo*`cAP#V@fP7teWtxuA8ctfAR8Df2Wg{fqR*p4o_^~yywA1H0^~D$~&C8eqk(@AAK~^ zRjiaQv^=i}ZkZ(~SmnR09CTKBkA}d+ym4@!l()-UFbGXPUl*Fll z1?pNG%fMbBH_EoO?kWEul;CUxkn~g_#)TKcE;u3{@sTa+!oD2m9YMDV41nP;Jw$IpkN%XeM zt+VfmVM_N#H9>o>M(G79DMgKHrU#{akpie63G(6;J) z^O603cly7i2?WTlGjM7XlH}ehbJph9cX`Y{KdlYy0u%h3-Rq^wv62I(er3~zU!+|n zC6WPjlQVl|#{rM7Y9{kmVY3vT_O|5T#?tExkh*7oz! z3wz;nCIY?X0i6lbNE`Z`tl<_xK^RVNmX8k|KI)s{%yXdCV`6NtbqyGcnlt)F=M^)G-`}WyZ4K^IOD1yAW>xIIqjl@-FC4rMN&!I121BSn8?um9Z@+l~&(hly7j2qP z``lZSNqtpL+PG6=bG@lOWMLhtJl+G(M&~|K5Cx<@JD|)jVuu#eD?JMwYgH(R$%8Q6 zY>j*TK4!rS-I;wZEQO1~Lj$FL}J(G6+SFHmGq7A)o_ z7k`sFcF?w-rgydH1NB+^IU5$&C8l^-&?I?8K8qS1@y=>hSV0P=nb?fI@2}S58vcMS zc@)P4RF$TGh%Jof41rHVP(I#n4;d4bprHM!zj(6aWvUpk1G}tpT-=X)jsIah)GKaH z+boC}^k5#5_2FyJmxvu;SR*_p7+{}LAFX#`$33en&pOD5z$+JX=L3^T$)BG|SdBqQO%>u95*j!;ds z+H`cv4zmzw&vwIYZdOr&m4nCbZo6Uo{6_V|^9i8aVUdZ%eqg-VhODS)`Wf#G8x?)U zTrvYR`$NI&>%1tlnBC`Uat4<{?C;YUi!2H2D-|fnf)3mqrDG6n+ymA8r}hr+45RRv z=dR611#p`m&wgwRJ64LUq%?m^qAx+xbavrw4UnyI+Zk*-c9qEe|1xjZS z!hf}=P??r=mi{i9>~|wqRgUk&e(p!l+*U(t5@icdD>I^jqyoW#GeWW?dTx}_apeyz ztLW*H*rLp7yT6J@!{cWbHIWS3zW4Z7FC5vL%AyggskC(rm8yPQ?FEq9_mBh@>9!`A z@okmANSYu);g;nwG|;KXb|KH6Xhi*JM2jx|Rya$)i_2q+%E%#%+9QAf{HEzKFrDef zzO|nT^Bwm&gX7MHMxQwH)-=Aa_0oOqC{C&5sH<&o0_NG{xGK}Vg}?56heHchTfy51 zh_j3LjoFHfQWg?v;!r^FQt4?q9@FF0h5^o-Fj6uaP1_^ySfjvF<7I|;2rTDUyw=gS zL^E|BCxfYxs$zLOn*u27=Jy7zTO_-B z@Qq6BB(YCyDw43%+TZsFar2|TY%!wp72eYvn;%uo(LB_uQDK7zg~Rv&JL~zUDGL*%13%GUJgor9m0sue=85M}Uqf&F zD4eEPy6F(D2atyI^8B4~-SU1(-t(8VIjTV4_{sz0AAlo&fM%|^)< zeKCd^?%Ie0GG7^ION>xN>h$49oov@j*XYsv0_)b-&hHfF+TUkDrLt3#*iG*b_16n* zM%;irCOinX%ABN7`q;SiG9H=cI19$i)y1&os~%1QS7rFJlS6HrYhz1F8arhuO4}*| zyZ4)zqVp?Hc}u@gJ4BqEpH0_BpK{%cBhkn+f*Sx%Ww}Q#7HO!pQsrkgW5wer%cS{P ze)ePBjreT^L`k{(CJ7=C^Cn`iEhoDXBB%aEUU8wdlrA!5>5yWr_^SgRHI@0%=}J^f zSrhZ|wP59C1+~?+o_p0sRRU>*bxP*aK5-DmT1iG+L!nfj;_H_jyk~UG@htIKn)M32pQ& z9MCArFozbT0WMoxe1aanG*G#}o?!PeqO^M#mVJH-9)w9c>LKaS;(dG{VhIh^RFB@p zTl;c)2VQ6CJopia0rs0pBk8n7E?HMzHa7e5#tlO%Y!)E!fj5_kUH8nGr9Wo+73$*k zGy5(i-vm_8eZ}zj%noo=K6JS=5R*Y;Fa%WUQVBVjYc0NH8AMjdbc%MUQMx`iW4k+m zYN3<5;oKEvXKq7c6s7N>t?BbGwH-L-7E(WZyuPE1D2sDvenc2WHO-c&fA=7(m`lKd zS!hBei3_mER3cc+o^wF_`b$fQidzf+xT}K@nHBTMEMvLb&w7Se+P#5j5u9}9f!R9G z6~*J7sQsw|c~4iba@x2F1xo!Sj<0fnz4-Sk(P=mx(OdT!1qGE|-ERb*mofO}k zv~>T33O!eUMQ+5qb*bWPDZrzQ#5_A1=jF=OOyUD4Wxl@>l6|y#*YF!PbRS)v*R-U9 ziBcQ(lM`|lg3CYmB{p=xu!QHce#Ms`nW#)nYL1{duFZ*S8GaZsJ0TX26mXfEt5QiS zo?SHGz5AZ_#*Ocg#!l6U-(X1z$jxmRa1B^*Z*hA&SDJkRYG=O8r|jUEM+B!eNAZ;i}rKB zzdAlrxfIxRAz*D*)%1Zm3VhO>tx#sYsZ?J?f$osqO8bjv+X}4cDTkBc?|W)DGjaID z5TnU>(>zcQVZLcIh3fTh=)ZFYy!##Ue)@{%vLebW9Q4PrTw+wsqeBmtlFTKU>TDiz zTV8$C?2s5Qf4;DVIHGJMyN+-)Eb2=$qk|^MSfkU|L4=3*S|v6aYx#cG6LvCw^aQqs zAg&haCAdmQH#)18YpL>l_j4AW!--J-lqqfFJuoD8kg*wF{|J^>c^p|+CbP*6(gqrF ze)+aYZE#y+bVzpisZafjS4gi#8U%!ug3*A=_}1<9GsqFtWvAaa7XbaRCBWQM{*W^h z{)6nP>6`Mg^cLsSi)>$)=DzZgW%VI*y~LDLBiyW8)SBESR1TzYxPf;{xP%~Ni(nTL z&AzhGLW&4j3MF4&TRnX!FmxG^M)Z)@H=2#U&u7M5&`(<@(W!vjZHO-Z|O$1)(*wr<_uC(}w=Bv6?axYW+tP+yOohlD{ zEZg@GZn7ZisV3_$gyxiE%OMwZvNF~Y*OsC(m~jSz`k(En)d95@$D2`%>;RDc+7^;+ zB1md^@2D%&hV{<`VPS66oxB=t75c(scn0FZ^n{CDf79@`Fk?LMT&Oq1hwx2XyDe37 zdZxB;vdOG#XNjqBT0eQetNpGMmxlepYb1CxEcY+oBYQ|%o90}9;!yJX4dBc zq*k3JW}{bB&=kh15EPBXrSRj>T96&(d!p5(nqx#WJA6UAl!PEHPGuLrP6YsBB?Nx?kgx~tfS~cBYJKEe;89GopD|m zCC)cqJ2w(EAMTIlm@FR5H|lRIIQj8q)zYNQg@47ff}jerEEeYTP_4fm+(di=Fu~dF z@!Qar+FfQhq?({bYMGWL@WRFKgdxaS$#2y01!kmzq<9^80b2-_pWO(0ra@#ogj9Sb zO6dK(wUQWha-7a&YN9|@pRzpFa_MSJyiX!rt)u{D?+niG3&TisB^Yz$LiDQFu(Fw} zao)@*L!F_nBsR^A=2`*cFtRL|ILSL?{~ZI*ca^pbrFFC}PJ${9DmQdGvuvvSwu=jM z?4DsOKZxu7j8}L7$j6O&`_Y7lY>)zWq`$I^6`RU<^n3rn_Y8d5nQieJzUAN8_&ieV z+|fMIqimEQ5v$BbJO@QR=l;AG`|Yw@C8RKy zl&Qb3rw-agyOU;)&pxAl``-D3Ev5T2m4%e)hS6!2l7rla14_MWCz-tsui(n4k6=e5 z7H8Q_nX8ArOBrh(5E zHH0C3djrjl#Y4;Ci+m>q!?5cdMa(vU2W&q#41=Bt1XjG5Bp3BrNxQZu=P)H(LJ0=W z$JOJ}<9Vocuq_ky>63D(T5(o0GKfFHrrJ7st3n2Z9TBl~smDQCs}b|D9qhkjQtI3> z*kp8zRclM4GcZqY&W|UV3!Y%jSRln5?;yOFf+6&tyh}F+uDj14C%?0n_7bk2J3b2; z34BEQ9gMzFkD=hM1pn#N&k+PXxUk;c&i zinah15aIPaDx+_8VzqcV*`hk*#lv00=KU+{Kw8EfnU@y~b$t#-?gvp!h>?u$n6IL4 z>AE($DMsBTp`HvPOEYzj(#3qaMu_Ia9Q#BluV&sLsVc=Xh?GnW`(4xh;{l`mF{yh{ zgqC>UkX7bVk~xIm_%t~971#2jG6gP8LD4XFIy4kkX8)${mqz)>c>qLFP4xN9C<7mV zw7OEZHUrb4u2z+$)NBGYarP!EejZ`F~DgK3&i0x_T zte4K=Nj43IUNgtDBa<(tni3m>M9Q!P)l*~CXffVYw$l~65T!e$A)WNm zwDCcyhNPluqp9#RxO~7pa*73mcHo_7224R&O!X-kdi==3bc6o!2MSpff{7klcmoQY zua@S}YXo<)Vr28At+5LpyuEA_=O^ir&D7shn$*L!g_x9^u8C_=LL1T@4tjAp#mhF} z21CFCO2>5G2=6{+iA-=MzMUEqMWUp)iB1FE5c=7WgtY+OWW;0EQ4b!B*~H|6bZp!< zWrNX)8p_joe*4HCS9hSG;!972EpY-4C0^RO0Cd;@_Ci1xLsw+|Q)0?25q`2);<%*D zz*!Eogy4+2sQY*+t)Kv2=6aejI?Q;PelIo>L2X!U@7rh65ZV5)?fIDHz}XQf%}ObL zDEm2S40~6)Wa*cKo+N7P)#}>iqWKQOLYQ7UWw}114hmI3$ePF@oUUf!G=wj|^@&Go z5Q!|fH>yQ8$*m+-njHezfmsd&_a16Wyk+{HoH?3bm7f~D-hzBONp7;_0ktHgt7r_sqgix9J{gI zc^yf_!S#R=T>DLqX}x=0!vM0fXtj%eZ_}%6 zm&}(@MsYNPGwA+$K;~o`>YAaDcjp^J9iNet=`U}xZ0mgm-sVC6T0d1%{j%&67 zNmm&=^bsc(9I%sh2`Os!E8||Z$?Yik8097m<0^8W6tF{yjJO{Ha~@U}yBi5hG%C*t zzZ@^}eqd|S$`Y|q5}%_z;CQmLRPc!08a(6c7C?U*kG2x zMvN8HEVQ16#<*V<2)V2^8;+U$xS)8+LhoCR;a#|>m4l5k-Ys9{2n~ZYypta|*BK8R-0)pNil zqRal>ZFKq`!dc8A5}hh*+0btDs{ro+Qgw8>+herHCdW(WdJ@|3y{fOGRc3&On5O3g zL$D`m{N2L=C#dTPE(5$1n5%U|RzFKY4+Zw~1Z>Bpp{g!;6d1!s#1-biwJb?R@vl4; zTQ+r{7$gcYyHgiyYRU`xN;=&WnQwaYq<<`}dX}W0A0XdvWrj1FJLv_WY(-9sit}=A z#3XalG{z3%Ve{>ii0EDWLCIbLmsN7UbW73oSArmSq)+ZkFlF=s$$Q20v898jkLX8f znu(q&H4))9g*eDRrMp*4!28qyHZpi)!~Gp7BtCT?MGUXMojYbjDNyt*$Dij6Gz0Ez zZ~n0l%@r%@GD_J3@$@=jRe)|9`xSogh5P+tP!Yl#ubZ(5{OtbP_G z;j`F#xlKuwP=9aJyxS`fSN?}vb0t3nWljN17CM-8e5CkJ`ktfbe&Ms-Vo8jcDi+aH zWjyRB_WFY#P4#*x&8a{}E}jw_!v>*b{TH2iq!<@&`2fJw9QKYj1w&bipc;Gq5v-^e z7_+~oyghigo~h{@_m<7vZ2Tat|D#%y1z@VVpeXsKf=h)}d?qN8UOR?^gF`R7najCQ zV1mtU4%{9QO3n`GyZf>G%hyt})TYP|Nn@%pp*R+y#KQgCM|{FbgrCKn(S!G4*4T;+ zwn_7Qb>;rl!_jfrLC%SY2kfJ52{WT}zd~ zjN(!g0Y}PX(;|oNk!lNx?2zD#&Zu1!l%Q?IQnyG&kvNem%uLGKN2h;!rPpwL21*NZDZ3V`pzp7gR6IQ?6}k9lj;fbuizo+v?0!*+>kg)Q-KooUNQls4xVtQjI+?iIPxMO?|FU z^O?A=tu@-4OJG~of0k7njB`FfuqK&GzCHVtGdvI%uIy?ng<4^~h2N1!jXM9PuqqS@ zMWEb-k|rmlSi2~?tvGVBgS1{g=953=%m>kB(6CF)wWTJ}Qhi5hrtSkd72hDasD=b= zl|tqiAH>V$Tar3WSP;2rW%;_Zw;m_WZR>6Uh5?0o;o%MFyWY&fxSS@il{eoVSRdWH zrC#`Qo67P7k7UjQ)p`#toJw%)Ym^$P(dq(Ul=~&WFbSq8oZ9eICli(Y#YWtMP&UPw zUMJbm-W6Ts3`S^!m}azQW0qVfPyil3TGER19=8@=6s;A>uFK$jT!($g#8{1W7i?`; zvRHEvA779}sgh6lXQrFC0gCoX18=1ZFlQ~4G3wXKk%%!;Yrp#RCr(?Md6*A1XEg$7 z{JAODP;MgU0&Azn+B>rhdk;iSXEVv*uW8EY>pkr>m<2fiVzAj@b2N>3o=yEcfo`&=^jRxQcj_8Y}*$)i&!{Ws#o$MYQXaxqmW^#z7Je7E6y<WG=c!3!fNw?p;6VrlaL5qlSumAXOSyBL~;IETybk( z8byw(2K*Bg&hqjxa}}@Wx)h?2#iXfX8186H6_M;9b{GmxV({FX8hxptqp0i0DAw9} zJ+7>Yp2J);`X}X=j$Ns>hyQs$kB#`?Lfuo&%HvK`tYZsEQ%jfFpE)2&X@Gg#B@43) zi+u76DhO;x?JMf&S1D^{>h02J#pSrQ+#X)du7;#(Z`vrRz|Q9Nn!zbglh`s)l`&%Z zC?MzXsPjjNP>U4SL0qQ@i;?}cbnz73pLM1RjItqePL^K?XHBdcUMb3?r>B1>&>H%?J&M+{ zDkfPgd6L6V48#*S1H*}|*#qqyreb?;%M^37H|F(f7U~I&sDcVc1hO(q$HvE1#vup< zBA^)Ypg8zH<;h}*fsJ*T!n($?{I^`SVat*%F~a9N(i}bPn!rOBk&)NXtR|x&9HD-7 ztfmlqDDx>-u-W4=I`by`NhHT0bcPBOsuYHDdP#mYRAF<^`0YTwJpgdc<2Hp|*#~2dO!j8@oJl-31g}oi*P1g%0BVBqh#AFa zOl-O>+i#wjN3ZUCHrHL0J3yVg^7a@{R79Z0r%Kw8BFWmcaH(W1Rih-*)0bmba&s{`Cxxy0X-%5o#JKU0*QlN4d7#^m$ z;w9EsaLQY6-_Ce|h}49VOt3`U{iIcI0g0W~=1&DF|BX88{}cZkoG|Idx3Ra4>?pc@ zzM!#!)Ytlc%X?n)I7Ov)gxM%@)Lyg<5)sWKS_ao-h#TV=kB;g}-|A)Zj<{PD4fTlP zdTDXJK7-_cf>+P_|3cgBrAYWB61wVQ=9aXQ>s6G{aOb{nUS(WEHoqbmCeEe#@B(sq~VhPb{?M)^D^e&rjEyqfH!PrEJ|xs z{9V50qm_b^WgpC8%I=NW3>h8Wq183gXIsoLSxCIHW<)$~DHmD^S0H}h3uYH})0OI(r|DdV_kn-iAs;nSml;0jM_5tBuU613KX7@>7=cuhAT z+sNhHii1h#!2A58O=rjC)-ukO*Cz~c*Gx>Iu#m7wCPfoS^!DQ^Ajgk^M*XAN|6`5% zUvYT_r?Ov_PC4K31;w%w=vdclaeQE!v*TLTM%3>KtwC-DB8@h079CwQyv82vkkq*N z0)VBhKbm{zmtFh&j$a{;A`K1W7Pk!@)#nvce&;$ng(OZ7Bw~PWW}-a)X{f!CWB_^< z7Rk9cF|(D~l`;Imh)!RRYIDRA%7=1Uw0&hn_+I(>?ji516KF_pE zjk1D_H#qkZ@7axu=!Mf?G^k1qzbZaIyC<#LYkbC}G7eA)cD5TkY8;5t+|pKzKk;U$ zsfyZ}p_+UB^$ob}|6%VffZFQXy>Ch>uEE`cYp_C*A|Vi@5ZsGHaMwa9#a%*hDDD&u z-r@vr(W1qj3R;Ic4qswT6 zJErZdbldRhh)bY_X2#4Owm$^JEqM*3^^0DZ(-4Fup7eICrE*LWJAJC=IQsrf^AnxB z;i7$Y?Mjm*XmU@j-sP}T&A_fcPVcgG+(J`a=tWU))FcuVBbQ{sfPzf#(YB3SwuuCe znS34(Zj-Zc`-Vda>SrR>*tm4{18L={xAs>XdkP=y4OrSsEo&0VC2+ zZ%LNP%rYxJiqoAE{wTUx=AQaxwP&4-YS+<(`YbyJGqEN^z52{apVhslKsUsSPc0_( z?R!_$<(IR=hG&^~)<<<$+q-6dAQyG}%^WBo#jc?v=;M(?`MZ%jaN5_du_K#jkIzI< z*@_p4CsBI>2sx;F-HE|0utoFi#Dwr-R)<|ywn;eEyI+eAAEQeea$asSF2ZTxHYn$; zt2k}-!=y%;jEC;9=;h@r@s}vU8ic6hFT(2b{2@VbEJ=ErUDL5v9g(ZbAs&xFl{hy# zCPjJ7p)#t3500agspOq$gt)u3LST2$!nh4K^t}Mp@#;sNgy_j&OW3q=dFUo>y7qF&B590P z8y%)q3&cq`oth(EfvNMTPCDmaA|{+NaZlU21E(l`u`9$j9C~r+T7I7$yRhRL`4BS! z#0I8v9y>HlchvH^_uMvoh zfn%}4`<6;scM)N9PCumd*gRJrWxtHu*1Sq{Z9?UGMp2SI{}Lats_v@(Vd6uHDWBH8 zjDXgwG6p@Z&|t=a7~5*b8R-YLtv_ zyy+n7JI>C+W3@T`X4~5xGA$?cHg8{PI{l?YP>s4ccbY@@jK!z2o*HcAR`P?HRUU#L`k9`V|60lpInL3_HsDf+eTyTx4O%~BKEv*_S#-1xG zomGHY>LR%otFQe&m{&G;Qa;IjY1m1G^p01fB+9j}&Eh_5A;7C+y6PkboHIG#*#tTu zGw%AHw1~qM+vLvL=mW<$%!IL{*m25TdI!m2-F58W%d7Qn_D-aHew2z2_;Nc4H<+M@bWYs`%|>Vp@E_*ZkDb`a zd-`bu)eS~n1@=BWE@x9~0@ic&RO)+XW|iWpN|x2AA9&yuJ^VOm8M-`oYFMA^k)KYA z$CSb~!$JhI4`m!uma!g5)4^M=8Th8vV8M+I?b5LT+fh3C=VadMm&WHUp^Gib6ZK%5 zw#G3ZRcaNy2wOxSUN;t}w+(YD!ZO9^T7fo-?6DjN*m(*pfX4kF`_HM?R6`4#cxUk< z1RFKVx*)FRc{|FG7kPo86*WBiMEkwZwn$rBiKu>CZl$!|+d2gLz`sOP`eP>5evgKr z0Tx(34Hy0{pcig0mA{r#-!?DPVD2e}MYTkpBYaptYobA1Zi=Tj*ue2HTBsO7Np46I9pnWJ{c0!D$~Yo-#oX z1xE5Xe8SiNfA16D&0i9s+6srW zPo~=oEyp~ssgN9Mffs-{9}y0KnMu6PV%M9)r`Nk#N|vz+^1m&69~7(iyxd+Z-~Ak* zss>J)vIuzVsFL>92Ig0ATXL2Dl(JVj;y2POjVkJ(Tp$_+Fg}+e)=f9M zr`yEo%w?{bMmdR!)BZ4t8+Xi$Pv1M(`2!=7DrHGvP?*6s{SdDM*dZ0h*YlF3(Il6~ zuT^+gf9xK?s2VG0!{43wr9CaJpNX?@xdI8_*Qx6~gQJ<)0yWghG#|=i=2T*M#_P*) zboX2Jk-TDE&8D`2<>>G`GNAZs-_cv9f6m~w7sA$9YMyoA>>G4TtAdKr3Kfd(Wp6Qy!Jxt*UFQ9&DU`L9w!}XMv1bRdyvrn<@FYT5*1p8|@Qx<#xtFF4 zgsq}jMJ^Nep_Q{a>Lf$Zx^p=zRYldDMQa~+HPvyLck8N`MOi_3tv4oI=W;UX2p!zn zi(&T$7?)#Dt4dj_S`M3B)!+X%fYay|{8g7H*3W=&S*?&*uQDxYCtyvpE#;@bsb}*Z z;fib=8;q{ax&5+one(A^+=nnF^%)!^>1w+#ci0`ylQo&NvX}(zAa9sSvE=h`30vqJ zg{G|U#Rzek+mdrnb}6EKBi*Q_$}C^a9Ml&b9}e0B6OF5ybbrY-|GVUs&tO=lv33s7**s`)_n#YXxgVVamTdl z&PS8gyCV~x!(rCoBs%DWDKT9en^uPpbP82m81hw|VSoXQeG~NR2#-Y~lnBkE=i<5t z)DiCp65g?&n^j|9t2$Lo=oWa1uy;eFCy&g3c$)YLkFm@Vu1_(jlgj}%I1S)W42h_6 z+u9cGT@##BbPyi8({RGci}WbZs{pXd3F!w{LktWCdifx1Vo!cNLW@Yx-7j|l5ulu< zMOnunt*{?f3La~G^pM9_JP)ons&!uZ+sRLOi;VdzG`Y$ew#P#jc4f5AlgaA^Ap4Rf zpX=l1I z^*vWzLnQ4Zw<3X)j`ArP)$8PYnS$^8OhLGR-niKqz3G@kP!NDW@YwwK%;E1w$DZ#pX=6IO^UyiS! z00A6sLIr2%NTr%t+zuYF>G1m!5FL}CK(YTyln2tvu!_spvVQXW@VYE9*MYRKY#AUc z=pY=kN~`*!$=ceyx6h?5AbDWO#QMv8zOufp=$37PX)Z?tf4icS_K;mR=pG;=NB{6@*UCZrhKMjRuGqdvsuLJgOy?B z0xhpM>O!S&K&zQiz6Ke_N=wpiG6Qpq+gjFH4N8ASDW^ zuDkDMn@+u3Tybr(-dQ10pTJT<8oQNF_P$}u5`xRrUGm>b>}0;~4+nm;`q`d7Q?J*v z#qmr*Gfi+-(oJ{a(*^Dao3=-;#=;k>Q(~3a_4m=}c+!t&p&8iV(mG<=H_KGbUk;aq z$=V`D{r56K`$5leiRZ+zXj1tH)PG;LwJ7C#ygan4l**%>5n!kjbmLO*)=9v+9I;897smGulr3n^QS8E(!*R-%b1C9qtScOP1GpO!DG2exgMtSytb;+ ziC4SA6kh5jc_cLl_>ke0IJz%Eb|fl_Db-?6wuxvWCY<9^C>Jw<{KbNY_;K#zpHA37 zJ(!(Xp7kbDIYocVmp0=?Ud~ZfP4zM*kLH*c{UpalWv(ZW$aArlcGto~z-taVs7#4j z+0G*`in-g`%(%fn# zK{TFpW~>0M0D7N1=F>G(&dHcAftShAsXDk>8z|3e422DDDd6b6Hh2X zMZb*)1aT%Gnrl#FDXOMNb+-)D+ewJrd*F1Gc*r%arF1n`=ts zrFd4ojt#cGvS4>}e`)Z*O7vW5WqSKekVBrGXsBb7!$*X4{stR#6>Fn@Xhl8dPB|-- z`&$Z#cWNXtz&no@wKYX8@QwwhV)=Wj&0tI0;M~j;v^f}eUW%X{P1$y34ZYSUJARYf zZ_vBfkuJQjm)AAlCqSc-nU4F;CJ9D*HlV#@#HoA?8(4LZ3RnmfAI#V@Hd$S^VCK2t z92$vJ@&t~EyNYpTr8GM()R8(1lm=xJOc2iqqrB~f?GIL2AZ9v#gN+X{YZ&@hD?Dt+ zI5!S58Z=5YKQ(VK0Ge)?ni%k69Ym0Z6yJYbwVtbW`fzao^yUiMt1nS?>RKPiv_v+K zOPoLQiRGl%xfU!6s_n55E&6TW*Xz(2+y^LoC792)K{E2;{(Rww1Pja&$1Twc?%A_5 zwi5n;s-r5#yz#GcC&7=aN$ZTn%dmD(6r+HNguGw0KVH0YzA5Gu7r{XN0J?WutGXB+ z>3U~pjfHa*h6BGl#2NnN1q8_-h&ZK`}th&5EW1#GftZHTzC08VjhMfl{6M>AGZ{jzq6gnDY zZt+w`So;c7Q&}&iEQZoudq{Ut$V5$^;Wf3Z%2;svs;%;vLibQ^cD(QNk7K(VJ{I(NP?UaW?Bvsq%B4*T%ikW8w9!@xFb zR!)0}30J?sTA%17!N*pXVHLrPnq;!-H+h=b=8pz#a>GK7AS6ufddJ4(5`k-vT!+bU z%l7q0^D<5Abtp7d6`zZt?w$6gvtcNek{p&%J`vS)?yUXTfUbviusrn7U=MQum{bd~`%@&lX=<17qC1u770o|YOk5|)=wz|Ek!AtD^KB_xDo4eAb zBj&nFJasD~k+)XvXFtD``Rfscf7$!}(N!Sh9~gJ9PZV#78QQN%x29v7{rDHOe>xEH zDpa)r)S#y@K)jCJCbD=YHkM_J;+|7dudMg)t4;q=DDrnA5ckBtBov*-tJY_i%yr#L zbOlEBS21Bu5Qs_Y9k%r3=Zu%Gf!Nc(ho9EJ7*fA&4DIND+NJ%jO0_WXMcY#JYQfgc z*Ea9#%%YOwx6e&x<6Z#!+s73MXs0&E@^zofQhDaY^L&cuAwq3KMNJ_PyViLxW|mvI zlk2*BFpAk@eo~;4o-6~S^!VQ0^qTb3?z(vYfkEn_>cNm>#Xm4oNerK=e0gy$x|`f_ z+17mvJBs}FF6#QZ{P%le1{+g-X!7dKp2IjvUC;hZvL4rm_2UC3k-{CN`RR{$g)$R2 zR{wjah+F!#kcY#%KVyPAZl8MZXBYCzp{@(nWVH*Gg5SOg7<>6|UlhHtetxJ@O@83+ zdqG00b;f$MfADL%!2U(U?aF!x_oZS8(U*6xwt0SoWzBvucbrd5BbiNur^}cswTgNc zKgifUMMu{ZmR!pPW}gily9ZvB%;Q}=?!3iGsJJ1$^u7q)pB9xf3UU1^hX^W?`yc*W z?6atARPcU04jtAF*Po8`1ZgbDoz&m~K6tK&v{8Xqs>M>jz-4+qp7-qkf#K;|@V!Og zc?#&!0Y+tr>G5H3^Y4{UJu5zIjR2qmO%H*WP^rqmb6@4<;G^Vajh}`Os5J)YqO-S* zA@ymxBMTk2n4FHtpPY6CD?&+sZ?o88pu7d1Nh`rz7 zdRjA40bO24vTSmM%}3hpoD6T?M!N*|v`=9l*v&sZq(L7`+1gY!ecZwywYW6sHH!>< zM1?vL4H&kgeeqeBJ!#z~rf!P!=~@d^EGvdHUh^JR2rm8*&xRKhpQHT#x?6=Q$lYyT zgN+>|(XXgkwC&!+Kn1CQ&Q9LAzuOq}ZT!HZhN>`I>jKxwq9eW~yE2Gr~ns zXLn;$(wv#y&~UXPd^y>EvfIa11Hd!t1ope)^p{D4>>O^^si>;3RFr-fddreREX%;f z$~Fbb5%{7dITk|2`rZ-eZP^jbs_^lPcFOAub~1wFkrH|A$txs>i}An5rhESP_2&wKFRG;m?Djb!4DCtWW|bJ zA}Q(CU#xvn6P+5D-|Go7>6+VId$@2uf?wWy% z3~{LID&^`xT+L7MsT~YhTQ+KT0e)tmEir}$qMb&MabjQjgM>`>_8s<}>+|GGW&|3z zJg7-pH>ZgL^xZjKQPcyGbIi8m++W%}=Gn35Ap9T7HHjZj0hn~O5l1atpLV3D6#XNY zFjW2M7+y21Yyg%Ss!d|sTvlSm2M=BP!5+0(m)zd4{@t62s{yE@Jv z$(ssV_{wW+%FywWCynCnl1c8$u7QrQ96y&_T?CDEm=&iipNVSQr) zm%aL`x6u13s#1ZLe zY7Y%oA#3@N#?ynlngns|>Hj?cVr3BUU2?>ve=r#EeT1LA&#~M8Gaez30vhzjEX={DKj4FCMY;7BLbV%{sT@C+32o4@;kM;6vRN1n9+KOxN{eS1&FBh}~|t zL5OCBe2TwKhq9>$)!A-Qf)(|Gz;sK}9x!~FxU#eu zv3(NNMtX_$7-Z&Ll-e_>qEoxPXM~c{AYsrCy}E@*iE&zq9>+_*-3hOO(E@p|Su*KR zP;|E3WDS&xJ7Gu3E*5yqth$Y>RB58%BRDU}nNe zy=%jpz|&fo1v00^;Pl0Cc8(HvQ!Zuo#>_|laPfoA3n7z0><&>=dS+`x9I<|%>B=+;+|~(WLvzu=e^BWl6g%}H26P(Ww$wx`67s;WMaL|&odININoHIK1{0k?uDV~f z1TF@9{T-APKblVY&vW?g`z4f__Iix+a?u*fx$~doLNeZT%mLG&A2NDexf3i7CF)h_ zTI}f`6o@vHu>=YDHd9$|L_ctFzxf!GNLc3b`Zg_b#u^eU+x<9et4+zGk($JVUVN){ znq+UY4N>idEuPrLDI0!jKgMZVePlnA=6tLJM9pZo6hV5_HOn&?ud>wGgyZ)SO{f%a zyR}~LYit&fX3mbFD*Bcz$wAU?JoktHw|j4xg+j4mNquKCImi-< zDN!Da82J{S7?yOF6CE@VDF-)^VdLk<#tK23yOb&GQPV^=yL=^y-c-tWHw2{A5*9+q z@@RewuP0WL8fAMNIi|}_AOE5tYxRy@KlaPy?)8go+%xU@q#n5}4=2XM!l@s1@^@Xa z-c$U=$%GEjNToA6lagJh;DSQRo6&`b5cQ z1D%vnJLJ*zTOy_r=}@G+ZRv$-xc}F&UMmgS3!Q>Ayzd3d4fq*I)eoZ|_wJ)z7fH+} zJ0$SV`sI?=&e1VJT8|ZF88~Fo8?j4EK8dJHG*(8Nrg+~DZ^Lck39F~^F5jcMHe0Wx znD`Vg2hF%}JDVCKy$)3xyC*02YHF-hz|_b{fnf?Y@fvUyI9%M(iT=6clr;;oKwb2Kzo@J=R#bDVRyPKtYW#+DQ|s3;ok6VKGTedy({b z>IYg5dD>lDB-QuRaMYmqV>e3MfIEq)+N#}tgvKYGiF9MmC!aHk77CN6n@ZUCQp(7H zKgs8!9#>4ZdSSKPu`!qU3@|uhWr2okO#PO3S9BSU1N&V4w%O=C8n|L@-rg>OHwUQo zspcdCLm(`dzxWJi1d5-gO*D+q+$%Yj7MiJ~J=vtYM**5904RZ}qf#sg4LGF@!HJ)FdT#?iMA(qU`JZ7?P_o06_v)Kbp%GK()w#$;qjNExq)5KOe2-ibl zXU^WnVi#E6cA!pyu^?!Y z?i=!$@hnQm^RsB192qu)dJPrbYU{UN z`24D1VmmS4&0!p1yXqyy4k;Za=Y=~di47S`vbW}sDFvp5LuMpn8GP!GCWqAy{*$<~ z|1mu}@fX?TcgJtvt5}>*PuLG#XVRAOc(a#r+p8taR&_4xfHMjs(%A0xdD{146l8RQ z_Oa4)mW@XvWR+_M;_U|XnoKfk32Mk{{>O!>05M6jPp%bZEGsEnfE75fYL2$d-mF?s zX)b~$oMvP4WNT%*`r%PR*x(i+f6>x3x74HG`k zl?^mx1oOmrm5`@sZ{x6fQDv|jkoC|{{KQ<%S8b*Az<2^;`apRVM!%WSl;(BV*OtWa z={E>AjBR53U()^|s4)qpBm7ldd!8U?3wkWZ9x!~VdK!U6{&!v{%KCFhs` zJ04>de(jYJm4uqylkGH~_(Td`0a2Xrl=NXe9U~BibiA{$LE3L1lC($3olP;=U&_dtxpdEt&gZpSzJ!-+|8l;u5t@~XgT$EtX zsz2)V#ivo&yS`Ib?Af|Bq_c`ot0>H0xeP$VNVt+Pv7CjmiqFo|; zWrsFtk567>Vtk-&qs@&=td7m-g1RhL+xsh+)Ae(xAfA`au)FQ-SiPayQU%gA@(W)E_?+Z~L5ycBfxvR4vhhMZI| zS|W@6oMrP8^}@v^)O@9-tLDx7gqCpzAH0``4+g|Nw)cIC&HgoZYt__(K{DgJjlwI+ zEMY4Y(po7gqGeX|4XO-R5jPD{8n4JEfD29K7>gMM3%@bvJ8?cO7PZoUB8$MI@9h3m zU$ke~3dwNw#D>dKKvasZ!7mq+AMt+sPbv=orV1r@)&AGkMCjFANFc_anB$0lFx~g( znDbvF(!XK3WQ*~?H;CU$Hcn8IZ7LoT{Y|Fbobuf!3RV9!!Jz#d^bD*XGo^3TJdM_& zSJYmO7!?r@fb^@j%HrBcL%hizMfA0a{7&E;5$DyocZ>6=vyqHp==&7=s$Tojzl@wa zSbZ<|8L{V7crN>E&_0bp@^G-o4`;iyHmpC zi_hU=?=%ml5c}BTmIOwmtBH+dTr*tpeTELd^~aTuIPg>#0p8C=W_9c`nPJ)GUH4vn z12rSH9;*f%KXDG6&R#YzYK)e0LsoODcWgYi$?NGRJw9th&`O4@>8W(6E2i0``h}FO z&InB*ZDvB=sH(aJ_|u6+O*AiU(IIhS^NcIVOyJ)U;;YAkMju zOHd`9g1iZ59^frI@R3n5=857o`KaAEmQFNqOJNP>{T-XM6$$UTp=I zsVu~rSgK(U03-+K>~LS<5`I3q&9C$gKr1uQo>1|(W-_!O+hFVFOpPqgoIDkXJv(xmmA7m$?rC*t{ z0u59AAzGBP4j}SWCzkKoYwj^v8@`_6gsDHrxIba*l^24GZUID=T*grqgV@0<%9y#^ zBS)0oUQ>R;4nQg)M|# zv)i6O@Fv)9Kx$$|T%^bfBxgwCj&bX+$ON0wEkip!PoN=E#)oe(TW>UV+eITBW`VMOz1AHw2TpPv z_M1>%BGJD3v_&VsfA>6Lp#UjOmIn=!b?KyI1ARvWQo_y}3^#Mfxa z@l^A+l0m-x9SUfj^_B9AU}r8bY^QYu9H=4LL@y?=RvL7W;m$To&(f<(J?0iJKR9S= zbrPTLP3YAnsBtq3m=Qn|DMCDD0!8gU0H+#^5Wm~HDe3fbqv1tQ<>I5!uh;80)shp!TsK<*kl?VirPfLUzwS+cSFw$M3&en_jnwN{Z_V zxmP9s)yKd0%Kejy`LAyOUs$MO_A=tWj=|>TZ7Zgr@eT52iOLX*vNl;@&#?PC|HxNY zmBkdCz^=2mr*B!7{=oP&aygw`YWT^|CEsX|J0NG_g?(1vO;&y-0OJI z-3sh-=fS$$&zd`Dw8YCR&@b;jUfucl%PF#7%aNCA;JfkNcN20u*VNM?U4`8}M2wU{ zw|`4&6py;;{JIR2lVn3+{Yhf@w|4o@F8@2Th`|Y;yN#3Amy_SJ5dRsSQt%JaDSx&3 zP?)z(E{4v;e($?C){Squo@Z{!{!x#~ANJSV+JB+#{Ou}`|N9}@-)R&7uUGvoleqQm z$6u*zu2Ch&=!e~FH-=Y>DfiA@CpNeH6M7Xj)W>=3cdZ0Rh}i4Q@sO;L(Jw*;cm7WU zgXo^{US9l-y1BnyX7#5`<$wLHGNb2jGUs23_Zi7K+zy95+-$t}G#%%-nC_ zrF`MmRPeo%Ingi7m+?~f=H@PsFYtcz@8A2KH+=rU^`p7q-rfBF-|YX>CxlO$Pq6X1 zoV5P=-0}A{*Op5=WVH@qOsmM%1euxy1epUxMj?O+?-4Pts6GDam*jtM6#6S|@SlFf z%A-`}%BNXu^GWu`%y32*Iy6d1mRAXuUJ?sq%{ZMmValPtkN519k3-Ds@7>>?On!{2F1O66lDQ`r%W`wnv( z8wQ59F8w;~Bx2rKRIv|MUd%^r+bAQKJyob{M(VvdIQyN&u7zx>YNE;9rm~%8*UXBQ zlF@E;BT@ic+kA0YHZWmaW}6=<>p$LWOMGsdD*bBy4LIQs3|%Ht-0exScg9xK_a0WV z!$QwTL>#XX1|J(=wkCr^NuF$i?~$Q4_e7q+*|a4geevc@Wmj=WPH!@DryUT*Yz{1p z-CJy%@x00i(@Rz~eEPOnN9d$q<(2J+_MtfSegV7j zNL~#}vhZ9Dl=vM9m&ffrOnJkPhlDGa)Td7N=u|HU&3F`7H*Rm6<+V0w(E^4A3zAJE>nlcgo5S4~~ES=hp!4*`r07KXsF%tXp_A<_R zIOtNX`cybGZ$dQVw=<f&zJUT3H>)&e!z}!O`*R9tml6eh-aHO+bF>hWxMiV^iD;tg!Ow-=OIRS z4qng7qdhbt7y*X{sJw~aZ%j>S#K^%6A>EI7`O($prkCb0B_@PZXH1g$*{gVdMZ;Pu zpyvvzJlQkFP+Ya9%2$||$?UShr7wL-qOHKHl)|t4&1c1!IY_WC2P>5PaYPxp0g2`_ zr7v-$bS5z%c$zr~66VFqoO8IPW*})q)H(Bc5v>D_i|I zd49!YU89uMthNp-C^gl|mfzZ2jjbGr`N&C?V$m4G*Ii#j>SIC+^vH4I$B`!hvduRv zc}TS))88;=X7WAitIPAZ@7qyzL1IQ}G&P}p9@;nDAG~tJSn{Api9}#^@lv!736Gmt z(r+C$QzJk?{zo-^&X2F2D8#H!gt&qS_mVbAbTD&MN8A`k+CpD>SNM(N=gid1KDy*z ze`PywT8oS|fSD#efLaAr;6EEZ}fabB{MZg1?(S8x#v8u2*Xu1#gEIi!%# z-X8T9aI5+~9&>>rRwA{7!l)l}II;=k&~m7$QI%GK6*F;Pr2w^4c%^0@OxV=6`uj)` zkm7w9#7PkYk!0*vxBQ~iuMPMvKc(>6=AwP~O7+Ud!5mXB#*>Jr&VHd!qCvI&vdP+WN!L1}VW0eU@V(_>55-KmN+zeB65`59om@-)PIE4oRArJ zicqu;s%0e;c+!G=&QY1%zYPC?D0Ahb0VQY>HcQIYLv2N#R-eL3H_IG6aKn@p5>y3Z zQ$)s|8ey2PJW3zE%-B2zaEPqg!$4WHwMA_GvZ6-`-*v^Om!R;0m5vy+$m-?+#2yOS z^}^4}+MY`NF{+x6TE0fD+(H>ZAj91*anjd|ub=7JuPz8lf#?RhlVT!qT;n$3YHnsEfw(&EK zoKvdBoNS{;Qk7W^JggQW*0%9@u=otJ*jNn#-nqGYPaZWQ+tTtqexn1d!g)ANp7{HM_>q{nWz)~Lgn%UaPv%8TTS4wez|Rf4uE9+@LuO(v6}zJ_ zM@?3SJG-JE5T}nkvLqVr7KzzoU=X$K_lG#Z|TD1fIDm5va}GTY3Zp zo!hI?W{v@eOND1810ECW$rR`& zwUcp<kv z+;>;A{iE2SQW2)(1Db9{?6*@M>*g65K%;9f_v$lL!*!Ku%yNO*V#-~mFERP>w6J5s z;g`p_Kgpl1Et9QJpMy0*9IlKoy*(3{881x-O+)~f^3q?7qmGa5$W@LXC(1&yGxgK= zOp&U;dABLZ^f_5qC=Ol3&9X@(SL`^*w!No|)C3}m*}owWc}Bs-L)A;W1KSrLs+8C72<PBp?ZdMR|jK_EqM)xIid%Ql2N%`0?qJ*M#6vTMWHm41d@oT{Y`CGGU)DMZg8y?Z>;8ML)iCwcknsLpnTq9bAS92ZM$j#YG0@3Z5+`37nwK)k0@*86RlbfDa|k$(mZ-)HMKJ)a zL%GZaR@zDSnyH!M>lWHa>%!CLmUGG%Y&TUxA$2WH3OR|Kb*0I;M&NARLl9scfPHWI z1;a|_qcpZiuvXttJ<4lZ-OFKSuZ^d>4DW9m{bBAaZg-dFJ+Ec{KpKyzqH0l~d_C_B zaTVh@cLwEoI&~*J6v*dzeH~RIv*qzVpRI79^l1kqOY)5Qo z11Ew$)2zj;?4@n)&tzz37bxPkbc(d@T%VDod=g7OWGTd9niIP}?+!piF9iepKDsF5#Tn zGBkpI*sbabyQYtE8YHvWRSOs`iK$9y?+~&jUoscQ=-{U4IYq=hVmc?$M(qEJ^OZd4 zn0Ww7RT;MYC9aWQB`DNvR}Xo(S#8VoA!#Dp3F_iI>?_cv2&`do!c#fgRph_v&*JG`~ zF4#6^O86M5Ka?aP6#Z;C(mc-Sd42&$AObu}2Y;py(R^Z4n<}7LC|y!|ZxvO<8Fb3V zzBZb%%@^25XlY6CyZemvsgWa{T4ff3oqJKV4U4c(Iy#- z<}2}RCMSgM_`_7&u1|mC+t-$`f+*dRR+eHYuxu}OF6~NERcA)+StnDR$l?;Hb{mme z1?I?M**N;9Z+xGo{HLep{j}a`-KvtoSNOL38*2AOqaRc)h&S(?!guMQgXd@kmN}Db z>d3b&SOie$WzK}Pp*-p(P7Rn|$yb<(#~D`pNrX#W%~!`~)#67yOw7RUih&kC6PuzH zm{R4r9H=U&18on7rM@hI;aAHYGgYF~^>PC$xU2X}Oc%%`Q8yi_gmdEs50Izj4jTof zp`!$f5FFv5nB#}!JKRpV3+sv`c>>O&VR@p3d@LD)O+#B~7=H%tX)V5ZFp`+#(0yK5 z>m>Yqsz{Iry%Xs!FlbkGZ2EFMCc$x#)Mtcef@bUCd>ckDR=R3B3&9pKz%w&Xm`i|R zF;cCq?}WA+G(laxB&B^CUQawU4jpgREG|6evWyoEu47Y?-As@5NH$k*55l_XXD2L( zhgCzjC%G2z9)YpVCXa2pdg&4tYfFzw~`^ST%8M4%exP;TgcX0PngU6Bg7(Y|vfSG!>uByy- zuPL@3hX-GT-<1KD=dRz-3lnq$IsTR@!1Kqqn2bl1c>{;$LB8&uY41b^1nZ6!N$l{e%NXfjR|8FT(RgI#`i8Z`X6Eh2y&-`L zAi78@1(GP4#|8mYfw=4b99-1F#N-BN85XhRHr3=PR|Agwa5*GhjAzEZe^=Ju$-19& zCGq=n{qd|s`SCnRXZ4tQt->IcSnsY&c~%O|!|J#%(@`%(G>^RQOafBB6r!!xizjcM ziK(}{vCa>Aq`7fmm%u0Q!SFmmeDK*ScN3>8uP@%tK9HXYaJ!g^!9rP8m`wk z^GeDO622Y3b~hc&jDsfIh~n}daM!=`xj?bJhpfhcD1O?in&4gKn%43>;|ff5wdf+y zwDOWy^X#`x^8r}1nTE39J3TV-l8Q;KA%*4x3~0coKmq4(Yi zBoqlq2L)+CdM7jmLN7}1sPx`@?;uU7Dxf}`bLKv0?##K*+_`hl^XmU@&)$2Lz1GfJ zYv;GVpRWxmi*4$ydM6lgj~2Xx^H9H_q>i_KG^~-YyDjA?hWl-8{egKdJGT9`N9AmT z-XENxG(wJMp2yGQZ~2rKG>?_xLPE4;OL#kHVg2Fb5@hnl@JluHhHx5PSHU-xun{9p zX$RiDwD2KjBVC%oUe{9Bx&DmDgRXlJQfTXFaf^B1n z&}O)J3Sk>vetEzzjB0SVj$CJB2C{W*(RSlDMPH0C4>^t2&=(hZ1-4J_Rdr%iq)F=U zOC_8$CK9!=NhSM+a-}H{uWIiq_&Dg5Hh3UZUp_ zGZnMyu8XOty(X+qa_l58@R+b`Z=giNdDIgQ))F7MX65l4hi=#?5j@&E$8zyYf+?=_ zdT)&_fepeTwBHE&!q@~trDd`ih3vIKGZd_5*!&7rKE`ZL>3*WAEPykhjA?}{k z{2d3=vCDJKogWTjCL@gsmjZA1cxDbRGN3d0JSTNnREa~$(X5(L1AM6}#z33J&k(c? zT_|}gJ0uA?1PMg$YnH7(U=Bg)b%U>(ofAw?kMRqlL7HfopD*=w0yx`RU1 zuG6W(@+56xr>+tX>k)}VFALMw6JSE|Sn6~sK`RL%N8assEnS_rZ;{A1I;?#>=HYm_ znP5lebtwhMx+ckSPPtN)rtT7@k7wg@ic5LMAT_x`+LC?a!(QJ8Eo|)pwk@JGQw(sS zTIH)c2;o#JF&J$VJH@!ZsXi&J1xp`)dCF9#-&$8O=?s=9kunGs^z-<=rjg^(cqeZm< zgIsc+Rtfs={aecW(7ar@2ELSRag;$nxJ zP=wD>ic)g(A^|rdDO$N}F1G&ETev{HdO0r<4xKXj@`TgjmV0&VtbCHYinD=R(HP}M zy}1{DbBoOI%d&#bQsz`P>bn}pTWTN%i9lf%Ba&fR7<+wkw3zyILVsvc3KMJ*0#7pt z(FU}%M7gzYaoq(74P7-2N#;*WDjP=WMCrPn(P2~wCAU!{?JsH!XGp6Ta)_G82be(TxwmaUqe-I7{xTgh1>4S>V)vP4VxVVyM$A(+y-MPpOeEN$KaEUN zyc$t6?ze|6P|8iso0Y|gNa_s~y$DICp5f3g8L2bs5DKclhfhCbGui@>pD90TR1Y)l zYszY@IXL{f;G0R0JOHBDGu@w7NhjYLbBO{5*dPWg`>KPD1x{(!_$|e$vJw<^XXB-eZL$?mTt;C>?Sy7pY8e~Ud0n1Bfk zp`RD`@8q)-WN5*3`gtfR(5OdXwJbgOz3t&Z!E;hcv>T4Z23|idCREk!P+5D#g(6^x zHpmHNZ;&pM@WpDYkpGG9^94fG;9F{T~!Fp~JuUB>~A1voH!&mzhSWnU?q zMp<6*&CmsP18rc)`aJCAe7ASS`M|CjQ_0W|*`EYrhI0ueO69SUy^Ng0s{Eo5@<#h$ zD;@(M11_`t9I?UVI#}aEp*9YY9^F(Lo*I&2QiYw4h!5QTmcf0pSMU{oBM#$jh8u2vN+LN2Gq}aQ1Vi~7BN3uJe~JMSavWS=Ss6Uc05CohU_8W z&Tz<8FAY%bK3G;2QYatg#QBg02VcTNdFz_*fRJ@TX0qXX{F_@PKXXo=ffc$ z$V99Ul0n!4UpPr=2O>j35M*2GyBYb3M9*Y7J(&+ZBPU35;NZ8e*31)0e4(2jmPS>5 zOuXaka_{W&r_v&0cJSW0UF|v2W1rtx-V?F|SyXhHSLb_`&v!)r12na>K1_>I)*b?5 z?{U#Wa)bg1&~6vLbZbjK#0~aj@_i?GP0?6JtO-_2o6<|^zCizHkwv(n*YrJjc1Cc`xaplCTbIqU(pz9*N7K^02hp%QD~GT)N8bQC z;-UYZ!UWRp))PueymZK8J0-o#emdR3b$s6juR+5WV8IHLXLb1mBNukK#*@Dmf5+aF zObKwtc9pR8wAqy%nDwWm8h7`x%E#gD7paviG5CDxj4w$tb55wqR^N1}>&7Iijeg!C zQB*JgM3{~kZtRqHuUYe#KJ?7-3SUA)tv}!fS0!ZiN{scyr0vN|2U_<^yLKW{d4T9@B(5f5KrV^Z4CxVm(X)<(7O| z$)P-hU5NgkaDclp7Jn!2&RU)G{pWgW=J)4&xI5S#Sh5C`n`8RvURH(cFkgH~;$bKv z*_<(c-gW7m2mki%%kwFX;&<=s!x#JAQ%@<%v!$ms#J;9jq*?era0%tu;JmPyFe!rP zC~(Odtg(DFt)(C-T(Vd(e6;P(NsV$qDPX#N|te!EIcD z7G-32VC|upUmy`bqv+Txv17QKhW>ruh^ww!Sj?ew#FIW=ej<{X7+Z0wqo*F}*-uPn z>_i)PEve=Pta5yF+y;@FHdC(T!)c7^DMqH=lWe&B81g(3TiP1HChpp4s`ooqA4goP z#R0K&I9^Nr9?o$)hYrf%Y9d^m$J#!2a;P$lnGIve$)Xy)akR$mAbPeZMmIoY$DW$} zT~f#NGIZmN{`H}4#;{~%dJEJ%bE3}bu29T82W^Idaxx=2uJE@ zI@E0J&Jn$CW}Y?|6RO_TP_4Q}&@_UzeB=F`2ASeZSBIBNcH(9lDRGRR;@T`7F~9d4 zv`Ucn1hCce+(>TiQ%5I_BTvp}kEBGj+Zevm^@(gbpW}uVSCIL$;tLc_3|fLe7VJ%J z(tIihWqHrgb@W`Zx_A&79&&I*x3B-4b_y!g*pM~wr%+Juj7^@UxCNq0Pf!iyC^ef# zP!DN3+~GRUJN8}hS7DptsICvUrslr3OCMSwH8B<(%;&T&v``tve16ju9CUIeMCFfZ zH#?MSuu*QTdD+v}FPNv;pEyCv+VpX}ahtmEEL6FOYCR_|Y5}+=1!Y3;y|2kZsoh7+ zuSb-rn5>dTkHXD}KRvr~&-lV{^FnLS=%|wUfLRx9rilD5-e+(5xzfh@$E6?*Lhr^2 zSbRWLQSgHRVV zh@+a2IP7FNzAq^{9e2u@f!A`z8uiF7QCJG@!TGM|{k6n->1hF^jNXJD;u*@)VOr#> zs?9r9QS?=HUJTg+B2*8Fgc^yUw}N9;tVmH3F~8m5Y;kq~mQ1-=0o@!06&<-t z3uri7=i$%a3|AfCmvKDmsor`^&hl9sfo6kE&l|L-Q+1f$Y?gD#IOxbrP;MGn#$_Z{nDc0(RgSNOIQ zzpRPp9U*Rnc>JO+>4y_B;L~7b>}kg0FT(+XB>gRr(!~>!$ye&uiF(^!-f6~4M=8UH zaA$LuIYDHC-ML@iN$P;kBFOBeb3YScR0$N2A9M#v%A8eplm#m(#%L;0{^W<0tE z0~=4q-gS&Nsc7aXVh|O`LGfzNJb9EEXqsfUlO8VQk*t(;m1Ju<`%cNdeW{$qaO8l( z+)NbuSb8#(&ZJ45k436WnX5BG`ULnDW8W|z>4?2n=jbg^7&wz1;*?x}RGY4&E5!&56{Q z+fkKbP=}iHWkJmDZT!#FDgxtgC`~!<3d6@Ca$ad2d6**WGE4&NsXhh zbw_}V1ohH6XgFMWkn7<)EeZOSh6jU#;aP?q!d$!CJJ++?Zjv-#dozX22(>1PyUrFk zxF-~2Iq=s3iHWSw6xe|3yUtp0QVFbk_RTHkOuyW{H6tq!LM)3uBblrVLc%r@8d8%d$<`_oxntWa{4MV&B-5; zYBNDG(CL;A6*zDx)J+z2M|RR{NAnruR^v;CN6RJKUo|o14yNM9<_ivq#G-^p7`D>H zeDBZy@I(|1@5(q(9p?Ggxi^t92Wm9eiqTHwd)XN*YZnkf={!52@nxpzzJxe<(W-Zb z!1=(4gdT01IrxY?|J_*8wOv7XuxbE_JuX-oSB39kp4G#AR%+X^m1Ldu%a;WCO=R!Yf3e?a9FLN{-OKj4+NV|QcNN^m{@pe*qkLd#OBaO z9tk+_#nh=n=g?(~f-a=?A|p${(BkV9lNs5EZB_#M+^(-YGED~ZH>gPd;8+>(-+Q5B z!`|;0IN*z@_S9jcClz+Gp4oJSEUD^dU@hV44FuGjX1g8-P&|(+pvXk*_)Fx(`39Gd zaze5yNtvjccTqA;fqi6N^ZRZYJ7FSz_Q@?l0fy4P0yQ(D2PJMyJ5W!?7U6fwNi$m& zb1uUY;K8V!<_-w1Qei0$YVYd^X4-=%qH zt4``2@xXY)lgTu_s~_?HSm*%8Nng@dg`rCSM(dImml0{Qcw8Wqv9M@&0M~e0fUHld zo${g(zIUZ78OvG8;OOlbv>uYmk!tL2KOkciPD_MiiXBpmwAl`~);~8Yo&HZk7n*;w zQsp1Y92!MLokWD*0_B0-?f>@J7zhWVF|qQCQ?AoH*7~=WmQLjR*Q!E?YY=@8O#9}0FE&_+?EZYoDFn8X0FiS#bD)JVlXz=&3{uDw5)$_8Y_NCV#GB-52V3Hn(o(J2zwE5q~IZ#~68Q$wTiVUb)^S~#E0(K;o~lbW@g4{IaReTiIl%pjl# z3Q)J%J&_}gUoy0LT`c^6qfEC|K zx!ppqw_=YWkz!I*4U8BoT(#~>9IJg?tD~1R6&)R?$VR5Pfu$}sxVV^}CY!G;38t%T z7cXGK6OZrYI~LKYub=1OD8XR%%*SmY-Fi5JhOci$P5)AV<#g!JH1@AA{qz2Rw^)&v zKJrO@`V6_hC#=K-3?mG;r`#z{J`cx;fb}YBeC=Q|#Tb55~u~l1q{`htX9J9a!#ieLDDHAdbE@@kwaeU zz|h8B(<1&5JvD4-$n?#vV`(T7Ya}J^&>b|c^RubE!uG`HSeV$WhOVoe59IQm`PP!; z>6Xz^nh?Pb=*JP?siz}^&KvmdV-{FBZ_Mb>_|E7fQeDoH4r5XLlIvKaw}6pXDR&=n z(Nf6G=W(J0hVf*C+^XsM*%gBMFVN@I^(T((HO8z1%m(7i_3_S0`a`+B@#~ENSHv?2 z&ZPID)nn%aD<8SWB)?$dgB zQklwA(UTNy`Go(8gfFiCNH=#rTcEHY;O zgRKIGKt|O|3J7?l8OsCiF_|e6CntaWn~<@U7tR(R2L?E)L}KzCDf5%m+3WBZC4kU1 zz8q~djv;R-PQYB^PDK$|Ub4cH`W6Ti!ACU{Kip83-xtGCn7FAi5AkC|7;{XMJEOv$ zk6mW~krHR~LniN98t|kvZ#Tvdg->w+RN43+?d@K^I%R;8k4We=Tq5{wQ%}qX#|pGQ z+)k~##7ofT+&-6vnL-K>WMLs|tgTH{Mu0EY7%q?ZNwU|#h7r?+lrsv@z|{go2W6dx zXv7Ec9#14#-SAeRRs>-+Vc^4Zlkvke_Tuul4+%oGhE*liKC;YGi1n)?R5=%x*E7^w z0epHD4`A2q){0jXnw^A zzH+6kpYmlAfiOq^5sGBF==7QlQMD`_=A}t;L2S*IWs43yv6F4QY7=84; z6yi>PaOm`5PSKgm`4BhAvd-Kta8p=BVG8X?9&}!i9L`RMV%*_Y_!yJ?c;7`c z;yEjMLG0KdDI2jOqCZBKRRoC;rasRRF;e?Y;Xsrp)K`cW*L|2m|sfai}2whrZ|=_T#x4v zoZ->+6?Sb`;t;W%*8zAn_Cqq(MYJ{1+`gUn^RsY^x^0vDIusIE=A<1k*yC}Aj-Qxf z66jLr>-N%r4y*rC8u(wIJo`7OUa889yFo$|PU2Us;aKtnr;^%=#aA-~mBEzi+l(48 z-KTF(0lY|OE%o8>8XX9N0}$0AUjVktyLAs{W1|ioVrPFWk7_S*UvdR^$bTmGe)H+* zhkV$a)`G5LCHEI`at8GDz|46QA4d-j^J@Eka_u2XsSdi}w;zy?s#_W&6m?VmyiXeA ztAwJXp;^BK6U+6m<3e~hwEePy!-7xsCw?e)MwG5kevDG_V*rvu9j6XMd^K7V6{73F;1X z2#GQ1a!VXB@VG9a3%zSy=3M5UV;6ON)t?a-tzg`Njw19*z20NCpO7lRz^jVbZhQ0q zZ67pwS1Cwz3Wt8mAT{7=hpWTl{QTw+H1ide;IWxlbF!)nev(4!0(G(ndM>;2XqO__ zF>mZOy;2`onInk*3F%J7vY*azH~cWVh=x;AJ(Dy3Z~IgP<&sxBi3!aJ2O2K=sObY!Sj11}5dWRS=Pdp#h(1)2}Dd=?+Nf_>P~ z{wY8rbX}UZW;mn&DSe|3ZrAv}U(s*SY&t`i$?SH`?2el;1@RF{Qu7X+xofOKL+Vc2zyO~PonIzGDKSW7% z&!ijSeQfp*W!;{~o?*3@^ddqDF*fqFdy>7BO`pGs5%mYKuMeigOy=-0k{RvzHJf@V zFgoUEwvLNlF>+}^xKb0@i=&V+&%VcNMzv&$%!X)D&B_T){V2V8)}w|&bV4!s65+zU zLnAME!}*z`6!h#nb0a9%`{8Cf2ztVX&EEYOJ`mej4DpY9{Yz9&jsaWQvQZP8CMtGy zWH@N6)rj#8Z7&A#4nFvzvC&wbdCIEDY&pYAm1jAX6-S=lgv;ZXWgWi=^V5=9YRy8y zHb%I&j+(QvY5Gl7#!YM>rGApg@iK!SHWz07>+KXmD^=W)0{uHyf+ai&?8`dHrCpX1 z*seF-f*}g-Kh#8`Z1%bn*(mrFG9C%kq|LV~k@cQWN8H~*Zv>L_ezMKe5AZfN)VLc_ zJAjFam9uN=VRqphufRLk<7+$+r9-C-7j%=;)WQ|QZ|2`xCJSxeaanf(0&KWP53@Sa zi3ay$+(al!A`wi-(oVGtLlJy^O5_J9a1wuG?*3V^UOl;wQO zidJ*9x!{HMH{iePehYj5w&pr-2`_YR$KlQdj<^I>Dt+yHeKh>?3ZKg|}1#a0r2I`GjNYZIKZ*nKS#AoWNnytT04?B-F z-EOWIo301Hl74hJuWvPLH`*(koqRw4i|;*+Kq^7@%h4|`K1~51zz3JFU{2kG+poDS zYpzT!_$_(KpZUk|&P`9yt`kCUd%>HV#{|~PQ z%_nIqG48KCI#W>N?HAWmO1Z$xt%tU0@++-}j6 z#aG#X;9z8*{S60mjlIRe^!*R#3RSi`;yg(sDAUHri;O^J+z&hB4cJyRrSb?AJ#r8l!EeTb565?^1H!b&}82TgoJuw4IYa;1@?1 z4kT4YFmeEzwyz&gs^6jUeNgpsx^z!CJ^Xc0Q*84A{?8KdsR?@mMa-TFkEI>C!Qu5P zztY*QkCHE**`>?x(7-wxMHzx?>Ff5{gGW)ZBWLH#9D`CF{qPl!kV;B4KY@f_M<^GiH^8tUlBw9f@gYdM_5<DEiQU#g)GTo8JZczNS_!orjDc*Zc9_s`7p zY>kvdyMUnBMJM$0$A54XCJXZ|rQ_^7`9uM^=3aqc(^!AD{=sQ|&A*I^cM-cBaw%9g zbl}mr)fD5E9?XAlH;dXi`+Z7~{nmfG@9$k0l~mczC)V=D+tO20 zYN!Uw5Nl3g>jX({1#fXA_Z-q9+%BN?ofe3N$ndkY=<6mQQL(|tS8S5Z}mM!m;h!%11b_yN1e@r9PmH)NcA$; zbHB@~2{2l}Zplb}dL4B^J=amn9~Fi;?`n)%_a2IO?510cFo}|oc^FZIv-6e zBax@*yPI2ZhEbV+!1=B_w(w`#TuRaPM2_?5IYK8cEdeBYIw#Wl!SC1u(||BspBM z5Ej_sQdWp$%71iX?XTwcnJi@G=O3auU`vb zA94_^NE|bE2dL4L5uQ#lo`mlab+<;K$Ki`$1o0E5Qa0zYasGPUxIxj}*U`HsoRWE5 z!%$dZQS_p~0|cF#2{@}eM+1>hp)zG_Hho(D4&P{xBo4pAYP|S>vtxTJ@l*;#Gr2=g z@#SDkrP%LI@0+gIrp3vr%Ztk{CXf0?^;4s^`G|3FAW>67pX#;qy=uqw5+Si~Xz1T% zJUbJ*NQK4ma7r3%yN7VwH7mtQie&PLak)2KBv+N0K1j+G5q29~O>^r~8GjhJ+;X)z zwXQ1wO%J@z%=~Si{F>L(veo02eb?`H)odcs5|&$&Rpiav@0Ur(ZE-VXe`D-a{HW~u zDdCZywM>$WB$VRJFGyjT#?%eeiu=#J*3m7=iLh{W+&#BwR=y94 zpCsoT;!!91G{{?hrLNgl2YCw`Gsu4XxT^nKWuvyPZRFYkR^9(Qc~w(2UAc|Ygud_# zs3ZwTFQo~2BIRhCPS(y;^67jZyXpr{`dZv=(GMKK&&r}1#C>hnx}=o-Q+%FFl6$nI z0m_#*3>j#3M)*wU@rqEu8A{P3+Y#{YwlZoX4&hovyUbkiLA`NGqLOZ+&D8TX2U+=& zvI_3lGMNX%)ldNqyPr1F259k!f|{R6Q9JV)RF~I`AkjVP3lUX|1mt<@iZ$7xhp7+E ztSc<}b^ZIwOr41Q++n(1>(MZa4F(7jDjXZiqab>)OmBuGf?S<=dFcH@cmOZ$Ro(s7 zk7}@rWDyho^xm%*v&*+|wsQDuz7W{eh~l;C$93CCEy{0UJUW=}VBf^irgt?pL$-q{ zT(lTEp3%gziO&pnUH%td6DA-Y7bKh5L8*QT(Q7cNCG>sotR(Z?M&coSnwa^<}Q&j5L}b}XWbzm{6d)X}FV z8gqH0n7S=O!du#?ufGeGw()%G^eDKJPBxw)ixO5=`&Hx5q0s=MpNP;J%*^fK;0tX9 zS3A!@$D*60A_n+Bfl20H^}`v`p62fue<-c)*>Ah}der|1hmjQ;RDcJv#5;L)^PJ~4 zsP;D)8vox{CRA@PEx*2Pv$$&fgL9gHy!5a%k?$WXlVtyh-IZJLp5=>M@Sg8~iiP}3 zirBwANfi_NgtHFFJ1C*ql{(dTDp~Cl>3lpELnNAzkQg_Q$Ng61)fajTXQx6yuE((D zmGW#R-IrjBjJ^lz!s1aHyEk=}>Ex2FArs2KKHmD!T7h>?NfoYDSHhO~hn))X%+7r8 z98{{#A1vR}nCm8Sxn&f(zi8QwHmUWjNi>+mqFt(*oDeQZC)gVqf>ejXpuGWXy6~)I z8G(3U&J}AZTcn}Estaef=7OwBVW5&kF7>LT`>WQ)Ultk3 zCqhLF%9{WMNVqFAD4jKttl$ncO`?si>rq*yle?1b*(3P`iw%vtB8$G5hr%a0vu4k2 z5({C9Y};&tO5~Sp+&4Wczhr5yKe19%q$KQ{DMNtX4-aoFzv4tS%(XU{uSVW$G57Yu zGxt1+2Vc{qekt0JM^qk3;R<*!{<0%?E9c?W-mhdUP&vwxrTl~Q>l5qdp|bwZ=(www z0^fs_1Y$Nk5PXNO<)=z^fL*yblLhEqL3;c2uTOusn4pIDb#i3XM&r@JlqYgkHfp=x)`s9o95h2@zt2(<=^{-aa>-a*uF5%iM_hyUokyW7$UHL~*+ zFFr-(JZIq(?Wf;5el_^_R-FF%-CewOZdQ#@zxV%UpwF{jNufh_n4fV|q6tf2U*ts3 z{7k?A07zEW$)sd?9jb4vKe(d);B5L@t~CD*ig)6%ExY)julx^A^&gyoU;A94GhXSJ zLY-x$d;RWuYOdw;u%ikWjHJcHLmdeA`pwohv)o}ma-Pk(5nrg&?cT}ySGEuS1Kt~V zgtGSBN?2UK_AqSr*R|goHmE&wn56d8Id$j%{4==ryVs9V?w5kQOzIUUhF4ZsHlt7r z4e-sU1^<=+hZI>_k2ubmA7#G;1BDz41h`mVTDiz9w~GwCjh5_9athG@o&GGnW+E*q zK~_*a=Xe#kt@+P#nAMEG!20{%rqgSBKaV~w+9XA7Ev!<#DtuVTdtR`$r8z`W)Y8!7 zt9ue5aq9B?&Bw|6|EL((4*ulw;-+-TkIpP#@rG{8FCkx|WI(=>6lZr4$44hQdNB!BhEUvJl6zmvbluD?d%|IPVi!uYUcrs|Myr)s#bsy#o6 zJyRiZL9e9`-yfn3SNfgAFzRDWEwjpFOYk}5ebRB@`|j)G>5We#$G6U~q!0RNnTzFq z4~=%QOxp&nSR{E&NNt-x;Qp^eg#Y8%;(wWtw+QdoADs2sRR)g(pAe~);1$!u)vKyi I%Rlq~2cE+KtpET3 diff --git a/windows/deployment/images/volumeactivationforwindows81-06.jpg b/windows/deployment/images/volumeactivationforwindows81-06.jpg deleted file mode 100644 index c29a628b05b1e395cfb5e5c8960402bf892239d3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 68397 zcmeFYbyVBkwkQh4iw24WD+G5EENF`bg1b{J!QG11ptyU`;#Sje zUcPVJxo_-!?;hv8_x?F&jWxpWw=!)_Sy^k%$?wJA8yGZ-eh#)67;rc@20q3=+V4XQ zfP#;WlRpL~2KL>s76!)e4J;meZ*O-A0RdMpek+8VHIm=P%|*b^%3T1=FDQT^^~lfN z%Ek%l&18+Vb8wXgeeHM$Vsb!8gA7H~1=Zcc1XHXZHKNRpMSubxLG|3@bK~Qa0v+R-zOj-`rjKS78Vu`HVy$U zE&(wi0U_Ux@N*=4N>!up%MiqJD-7zO2_zy| zVNJP_eEyH%@oMAfp<#3yBA+V4tDXAQ3F_94B8Mo$cH#jVFB>(US?T==`jX3KWIq_G zdsJnwr%LZDY=};4Vw!akr%!Z^Lm4nHkOVD`T1OV0lz8_Zsj+g(|oGk z6tC~M#X|82Pp8$CzOpO|U?hl5O!tn>SekZRXmRHIlmbDJXzig>odQO*#O zFJsmJwBhz_U(-rZ)5GJPp6nU(jdO01FG=WCIOY1pIlA~CY{D0b-$10PNB zr(9BCf2XGVrtlE-uzC1E$#PHgfB5{5-u`Vr(EVh@E@~Uxb0PJI1C1OgoyGm#=}Z{8 zX5?bp!lSKr2#T{b#wD)D<>=YY#_m5&uT4=sA!ZLaJ_+o^CW?8535cfSjhm)k3SZ z3o5F+_}kMicDb6zszz8{`34jM98JC}Jp0JDg8gLP$~KEv_vRO0Uel;sKYyxGt<-}F zxewq5p<}?EK%nP;Azt{`=u4H&7Ay6nWConv>Zoi=4rPQn@vQ3dCz8ju!1;jr0YJt% z`@4_q$L?3`Lw7dO@jK=<&B_qCD7MXVp0E7tbaMYb9nQbSyEd;_sU6o4Tex+&cv{lU z}BtE`f4oSn^KhK*Vbmdrcs+`T%rs5UH^LZ zF_1yi?IU^khC2ppE1=^wDWjE~K3dDBVJ3$vALYm$Cz~eYwc$JNCl`en*N;t*r$Me( z_L`#V1-erGdM~5BN0zxc^sImQbm9@i9fR;GlQOi6F0|R^O-+b~egFX{RBpQ*v(JwXdyv>N6O1ZmCj3Q?BiU*SOB&6Pr#qcqVgXWKpVYm!0X{9?RU#t!HH++wzx7(#nSn1m`3?|5@MqA2$Dqfc)>Gw6>NC zXg41<)FYy`OV~h~7$+#qX-hPAB*2)qxwxKBEu!hs9;3xp!;*)wjexghdwLGx#l%lK z{L|+|o5);TE8u%9aLmgWT0lvh(zDW&TbVj)gT+cxz5L7N`mFo)lKZcwCp6~RB-r3c z+-KxTDk~QW`zW39F{lFiEc1YNq4pGIMomC6?GNtx1_D5pO!O`kwn3{XX zJu5);S6FV`E93dIeO#_6wGoJDiFIQGtz#5RY~xRFL!H#@K^;dGgQY}ZqC+{!&rf7R z#d*tag3;0@Ydk%VzCQnrk>D;Je!03ULpGy-p<0dI}x!!ulkXUqwjW_&Lu^gPA5PZo2;YC-JW8S;&;1CH_cN#Mmlw(H?pCgc#LxdhC$y{;iNaQD`yE2KIPS-~C0mcO&l}BTxN>#zKoT zB!xnO(kzb&n_?S=^5@Si$Ldj#u30`*9Nlq!vJmuZ$3_=JU~5vAG0OfqEc_x~{v_{V z@98_jq0tTWdnHoVLV5DLQ!CSAr|Q6S((zB-0)6sO;bLAJGdm-+k%R%%mu;R5fcbCq zU>3-x8Bs^reQF-~n+BPRiG5uk66pwIgo}?4e|ZBZspw2Vmq`oZdzI{Vc{f_p_EawU ztsUg3Eq&PlirqhPs{0`)X)lVmx01*Zk>*T#9~#1U^%z0>6<2b`$th_nn42&KaV4WP zgSM|hJVhbDt+P3QH9py&iYc_YBpQzLFo~w*W!>V*8@1v~THS3noA_llAf7ae#!wz- zMWV>1=||nyYJWvLobchC<|xEZ;S>3?A4^5@9wIUV#VP)i|OV{ zLz^b5{WDLkv#Uj)C*?2C4r;f?xMae0z7VUj$Kuehv5yryRiv5v2+f8Ih{dL4D`ab< zCm_Yik%{PFmvEBQbLgY+9hx3nmIlEg$Lr}77F2LmG~>&B#h+}mi^7$)7CN3+N%`J4 zl%u|#Gq~xlcIu*bgC-OYVztvog!L>Aftf=?7gRy31;~gYqS1uDfVNO2@bWS>gB<+E{+JV!WsqcDVb zR-R~Y+Wp)sB57wo)Dn!9_9#nZX#Ie1P@j3@oR3pN+|FEW?%Z<)IbUfaWT2DrZ3O;~ zGh3}Ok*gcm*?mDaVm#aH#utR^M{tvOeQ1Z(1pOBAe!8X`W?;Ng*t11*&SVSvct*P; z)kTvHcHzrVtfb5_9vumAnVmKLY^-LsOOgDrY5&M^ftD>8!DDcr=Pe|n!noOkfb=}F zSL|uouh?R7U2;I0EuxNS2zcF)EP7C)5!7A`)oqUoYUTHsH+H*q;gNXf$eT zJ;&v7+Aou3G=+MV25P>oXR$gDS~ZDPUMdMSIyF8U z8y!W5fhmZVX>;CB2@_+9`r`R1XYE&OlBSX{il2qb2DOD8G@jFHdx4Oz*op*S(t`y` zDdP}V#4^CBI@P4LO2)|WjhLM!`5507T3g0iUy+q6XzTWdIDm`2QO9sdGrVz3G7JSg zgT71zx+QnwRq}TBy7cIh#grZ#cyB`eG-cfIQJWLskVZQuS#)8OECh2vs7`fbX;++I zUo}qe8y=Ti>DgOIo}BH}gC!#q`In{yd)wQeS^Vr{MHaMXI>=p%*>m(vGFGUZ&kzbj zAPT0YR$FY=kFWQ?;PS-tcE)4?vs;1PS}E#@5Xb;VfRqB9^1b?qp&P%i&Dk7eg{{VQ z;Bp1WtnG9y3|5%YnoB#yV6UC;D6J{Sr}_lTE%v=?Xbyd&#tb!b@YDOD9|j-Ew>HDs>s*nEde)!;Sei^bcJKpurAFT z@Tt`5&}Ta^(|~+^L|InH@yG5dJEBJvl|cgGajr1480>X*6c=p|FR(&z=0V+jA@S&2 zK*nzMdK2yZ^>R!3{gHgbTUM)gKXd%HrV`3M)#;PhljL%|cg{O;-ek>$&7dVAww@8J zUu|L9j!K-?z0BM1t%JSTyTYb6&caLwz~VN%%C@wsO&%StIjh9TC*SO5vc9OG8RKoD zJ8Pd+KaspA6~tfHui)D@uGjJ;-Hl*zK&PNnA&G}>I01j0LGJ!EV!(>aP>dnm;2b-pyWmTCXNiT@(v|K8hd zDyKIFCQ?vBECV`apJ>U?%bZ8s&Y_8%XzlIa7?*fmJI_dOqkd}s#*lkX+5fEeH-@E& zDqm&Ms3S?3tNz|HO5@G(*5h=BrirNJIrla1(fP3KV}Ue8AwTV&1We;8lJ~KA+wsCk zS8419OaIQLCknvfcTX%_FH1rFu&;zoA0DokLquP8=&&W#q@$1rk*uhWDV!5TdB>zR zoBkRUoGnTx_9i+!o;QlH3ACt5h4Pa~v0K;ylgXaSGHozuxqzu96WU1&bP9$?&f>43efwv%C+QYPG_cakToj87?ffm#sWLt)+zTjEjKq5E5g zB}a~{o?YX;JYIzU^eyTQOT7Vp4};u454h_lq?F!M{PJZdh+}g}OEByS!rJBDi?i1U zFmV*xdp$Y!iOgvtpuPQyy%6*@Papz$+R12SuK^&ru+nuX-q98N^zp$sv;oqQmVbS6X1D&%u?9n!`Cib!XgM-jEE-s-|_|-^XQ;J>L_T^O%0bdq_tfmKYyb zEmUq_30|cWt}8hPg=|XqU2@c;?AlwN)Ff~B?wSesGnAi^MtrAO%pF1I9;^j)YbKMT z+`G1YOaF)Te^-SFJV7H@#Gj$p4i|hUltyNr?6!N}J!bvbwXs zcIRDd+rH)3ftw6{mjbz?yVwCYLjL8P^Gb_s&l10Deh;4c3rOkAZw#_yjyh7{sNS-% zl-r;Uxd$G-{#Bgtm|ga&&oS$njl#!= zDA!--w_*BlB!){MlBWYDZSq7TVA=?SGlMW@$Im z*F{ZhMln=5+@!8!%Y@XE${pzlQ_KfG6zKdr5c6Ho{&;H#Hh#Mhv;KA!B1Wvm1}vLd zT`>5u_cx$le*m2yc3Zqd9d>;dGG874z~kHX)BkT0KmSvK$^#8lk%)DXfF-C26duCa zLVdCKk#R3*@b%ryNyEFDo`1^i>)mWu7AOA3f&ZREzcY`l;XF(Z3=s(D7{?8Ke-*t)j zf8$3aYU!5tOefOwM0|!SX*r!$7kU=a(N_x8PJI5jeCvn2^Cw>((wDay!a(DY#6hs$ zGsdOow;R7PwDN9S<3G9w`}wEbrf=q~yUtAKkvhNo<^CI^O!Jr7qu>wUHg+|WZgo4x zmIL&Y8%tqlg*s;z__13S44-?u51s>d35Pm8ZeRR_o)1glT%CUHVf`_W)%WDf5s7s!-mk~MvfDO0 z9(yCdl>Og#fB()7@!x`pj=sLRI?d~0@mm=5Kl$2zqm&^4IvqU2y4adv{ku9z0f9A* z;!*z(UG}SX6~2_D(p+{6d+&0%1pq&U##+>S@)ZQ|hHck7>cHpIR5i9arwiuTk>x<(!;46!XgvZf>uP3|d)%u2X(`hT zKEzeuoUQI_1F95YRpl(lxuJIX7$k4f^ofR99kml#qjm3+2lrBUTIl>6CD4&Rr8+7u zvp_Cx_$dnuKQ4?lObeg6=aN~aDPDrU#THDftHW6Bosm1^$i|hfPT-wTFEAw}H(f=# z2Lbavc73!nUcpMheDJ8Eo$T$4s43kIke7Z`+O)HU)iCb|k#rH~#v*1{a>sYP43H^W}A57d1|{OC$8h50FKS5 zV%Ppc@r6`XzCXx$R2(>y7W4#?0CL_G#()|2VeRF?nn0@as`KL$Pm>pP5q_^B?pG=y z?C(Gc2gpUZLy^P*kUi~H+^cnE)hN}>N{_?IXdh2MInMz^A=ka5@W-tF>V&X#gT@w$ zQ_ex?juM0nY&YP-dJh<3rFB+i;hTE-S*McQFvSPF7{^XDDnOM--t~=w=c5(7r;)>4 zS)*I84{H<9kF9*qx-cw_B?150Z2$3vjd`j*eGoo99FNo{vZi^g@w_Hw%@vsy@-i^N zMqG;Hz?o0OfZeUNl`+OC_uNzKOPm*Z^S7N=QxR>KMbl_?At*T$f`v&wK)v%bu`o3# z&i-4mQ}3;wrYKk_G&FD0)B62LyF8W_j!9}!5AX3?6Fq6~eH%RhuTxGkZvMP297Uk& z7RZo)xh)*7r+Cwsk3abvL(y?YcgsU?WQ06c?R60u4qvZ&=r8@T4KHZSt#}BL4bvww zwMtudCeJ=%qZ(t4PGfr0BqpdOB)3HspA#>-!-^T`tzKL+gMBMah zK#?)iO!(H`{uwwHVcGjgtV~%kK^CW^0uidFpCZE&Rr*#%Cai-`f^|Zve`CPp^r97* zIx!#h`NFOERa=0c_L(gI?nQ@3udUQm8ll5OzDBNo@qDVjVvhX%p-tv=Do-_=HY&$Y z7e(KSis1Fdx1Ic?Vxn$K8x+a5YUxmqYqDOI2nE8&Z<^4yro*<|PrDweR|W96d5qRi z=UxjD>L!k>QbOoCY^oGe>0FyP=`}W4_*|K;EucW?Yc-cWC zMuiKr$h>KR_e98oUiTZ%-AJpqdKIQhD@iOOU8LS*HEowlLIU+JHw7HNyn97uYZh2& z?4C%k=V?~w_|d3+P+(Ii9fzMej5#jdb?D`2r?G7?EMTJS$&2zr*R0ZMQ#f}(o>{cQ zB`$kA+N>!bJezA(lx@r#GulalYnQ^DN?$gP_$rOFh>)LO*Myo*h(+XjpVf!L=tYtj z$by8K-%)kkuT;(69hZK!YB4+4H_#qd)P!3N?)24ndd8A$b6J|wfIKpFfV(GzI^QK3 z>-k`)HlUUe+A9hp{hJ1PpGeE(`aGV|&S~2;(7!%{Y!rM?rqkm-xwA+v;p&wBWYX7u5ZYs!huxHf0Neto(C-`ofbSM%&}hpoc_>AY6#&+&5X! zn5B_wSh@AwrtR%herO2?5jc1Ox(#xKy)xdS5>N>*)f_|7w$pbI)UZoIdD}o{uTNBH z9oU=7eq+3eh#4GW3#snIN*$IK>U?RDwbfRbmXIn?vzO8FgHH`P*T5HAVNR|W`gSx{ zq|B6i=0+i}XmDw4I02nbqV%hll{1(}=-nI>tgO1J_f*_Yf?g}(*F}uF{D$2SuRt%k zxLvVp#1gwl>Y}N1coWq@tvH-kl{g$I0RmX3C zokT)+KY6{C8h_S`OshT4OS~~&c`6BfrCN2i0{LO9uK|KvB+)@I7Q5+jlsRCwUHwN4dIi zDY*u%sfB zA9)9z3Rb2Agx9PovyF8E`Pbt4oUHnwrh2fZ^ao|}kwrD>y}i)B5ATHl0$z(|CisC> zICiN1&j^@}Ac6AZQJPlrUT33BYNsKlHLar5D|S1>bRC;6On zPLH9l=kxV`Da)hN2k>sL$*B#hl*9TR0vgFaECXu-M|*2U`pFfQJ)wsDEImhAPhJhm3F3f{fm9;Ep*o5jU#QOK}iGPUVPqyGs&%~f82sY!Gs>*+ylqr+iq?q{`7rpw8p>5h8t3+I4?m?+}*;K2Jc$-U`=XG7hn=) zL*FY^j++ckV1I+(X%zjKgqU8MzB0NyyN2m9x@Em{W+9bQ(6}yY+9Z+IMfK~jqa!p^ zWVbz)Ty+1_eqW5CfMkOJ0C9>}R!hX8j>VuTRSw(J-8Rt6V1qFGubu%NqqamM^6_9nbK7M(0{Z4S`Rs4tHm;v+%=PQY z>d4t4O$t_MihCSYgSy!6RAmFTHgQk%5xTL#5F1@fB`wB@jw<*#I#@r;?Du zp>Lm(2t=XE6wX7-aF4Mt#1X9UY53FnIl&DC4&qFRg8hJq3DX_(#kQAD0i+$CE*bk! zvtZ}jNv)rdjcSSTdk+J|s1xpI(1URGUpiTQVe1$9Ji_}m3^JxyDCB= z0c6WwaCCUq$?7oD79l4m?%6j=!il0+Fj;i;X`ZWJ>N9tcmW5BKbTucmEX!!8+pb|| znDF$R{AlV3%UOF=oDR(*~gezG`xj%=hA3`Hp`NFjL0xx8PwfTn`!T%Uo@2Czhch$U%>96<89UW?F zc1(Soo&-tQVOp)sdw*Gnj&7!<4bUze)EyBNaK{elx8b{fp2TPsm}JwEsuj%@*XMBV z%rmYZ>!D=7B%matkB)uW}lU-eY8rtW;dH>IWaV<1WS1@YA4fXDa>!T7kV)O3~)?#lHbAF*jt zV7$&TAv!YVa|VJ-w0@JJGj&&wo)N*E!px*b5F~p_U}|+y?hqHan#YpkE@=dHKT9z5j?; zHOc<=1y|PqWT!+w9O00eM%N$AG8*QR8T)Is$C!`0wfS)7$;OwTSVWzxfDAWfvFwL? zZQ@G|MQ7W;Vj_3eQl6jrd}SI~?P%%c1AxKFQ6`esTkK13KXNd`BWqJzoA=y~7vzr} zN*NSAOJ5A_N5)N){^It_&YcI7j6u<7T~Y@;y3>29)K^U_qSc-AYUt5vedxzS$NR3; zi=M)Up*lr-XK1-ewA?2?R5mgJl9jUl_(F-5QN8Rye|RIzg4}C0(LVNl+8}eapY`>J z>AIi` zaL^@~dvx#(pUC*J%dS5CqWtzgGhZhn)ru+`m)*hQPuiS6(!C1M<&0F*{&jjM++R;GqslTc~P?Q0QhFHD~m2}!Lhrv zOsr;XHuhNu`1`wA__@S35}C0JOm=;E@w%q++9i2&$^&KeOqHN=B<2~rwD(ww5<_*J zHDgKdz=|gGe2#2Yvv#vR6Sn-GeS)Q;0`6m&9wutg4V@XOQ7 zQqmPsMCGriletMa=&z?655*jzuOw8O*T?^*Fh(Ue6w!qN6Ue3ixTRRw_>rrUk5cq3oGz$<&3bJXWth_rXV zt!;oV4Hzf(X7NQC3y*2dD|$qz6<-lO8kfuQS$NRo>20tz)7BU*KVLtFCQD%=R_1qE z3(z^*3F>|*VO%>lmf#nO8?m+yu2Sv(VsEP8VL16%0sBAM75je%-~O1`0CYNSb^ds| z7F;+=o#?l9g?a7qImw&weCuN<{PZneMAyPHeZLgx?aQCyUj4o=_RtGj|M|<(e|m%Z ze;TBw{`UQR>rp7|v?lI+RXmQ|k5``Ha$+cV(cDO8Nb&CmDbN z2md_p!$XtzuKpLIQ`Iu+$NvWw_%CQ$u|gu`X|nFBRw>Q)I~iw!x3JgZ8YP(Bhafx)_q@u>e3rigKD1UUb}FKo z%-GHA7*3lxRU)s;2CJ{LGbDC}O{E;cGK*DI^gd5NMT1RbIsMv%r>`sc!1w? zt2$m>Btq{sIu*yK6l_4>a97iu7AzHUKfs$vOjFuI4 zTG#QQK4>7Ou1U>-qYlFdxdV8ZAAvwFq1xwE~AQFH(# zH${1xYZ5%2;DV2iI{ydZHMu2WjG?gVTK6vV#pLuCVy(%huS^Ta0Z&w-zTEeV1n0=n zJIcE<_sC_L7{F9G2=(q#P7M94Un7~LLHX>{^>k6T<}pS!%&+05no^;h8M1q&YAFcB zE183iyQON{nTdC!Sg5efPI`zC%UaoG8>L^^q_AmR+sfJmzR!4oEq7w!BR6$=AAvTj^;1D=EAco zd@fe=QnamSa~;y3-&j`BEt&Tc(^ zM?lu4q_(XE(&0E4qU6^P4w4Q;j?~o~c)M`K0NQ*J6a;+3E7Drs8Iq9t{V)Z_C>ZcdWpt8eOv}pjTznUf?5V^93g9Q??;O zE29-QsoNBS2-vNsUW&9WX1!)?=PWU;>n~n06>4F54f0$rFDaHe%7!hzs(1B5`(uY0 zR0*p_2~DvFM$5@u-EWcO>GqPymzs5TPboorI2LH`1D{?jM9|{Nnm%~SJnC_1+uk!i z{Xr_KNm1d_=GWR~oKqPxL|6Two~^uR^5WRzm;iH!<|7w=d_Sl+$H0s1C8`!nfQiJw ze<@+nVen%LnpZf)VbVvoL zGt8dk0SjOqP07K(+4)HEO9e+CPVuQ%4}s3?(^qpxMWkn|5HC=!$`Qa!Q-U`MmoEaO z(S%MY>lDv7vMocEUv`%kMfC5nOp~QEWZtOymu)9Y!=2ff$HV)gqorS3EfTNYD3ZLnXZ`MUQFI2f`KFyAO%U3_=;Qeh1H)#_Q{J}Iwz-dnD^M`2a7M09CdlS|hn`$;< z`v#EgSM8)A7RXFIfE8@x5^>@4jp9@5McH0P&$cXU_AdFRx^oiRQ#_JoPBJ>uX^ojw zsqF!%x7_GZs-%!4Vs+(9WzC$*OAJz33C4#!_WbA{dn zRc%*gJw0Bj-dZW?TEB;5TvG?jQQ1@*avx4c@nyVbo2{c?_uxBcu-I#k9WW_3aR+T$ zW-b(|L~X@4uBK)C^5+y6Rk4?RcPcq!nUmNHo@5J2ajb7t9FvS;*Y&Mk0J=c0S&J{n z8XRiYc~ewo93M3X_gp`odW0US;`I#jEO~&YqZ z(rX{E8@fiUi6ZXZPzJ0VsHQn>>zgXnI?mJiid0x_^L~uj2jpJ>7)wHC8x1mvInp_m z2jmLol!uh>@rv>caL6WIluea@K?;=QwzVsfCQCZeIvnIM+hhnoZIsz}o+l&8X-&>e zeBYf58pi@6Dc0{o!$^A%k*;S~K=hp&>+9?BSB-{dmwvyN7)jcHDE7KNy>21|==vf= z5wM7hW|LI0=Qc4d>(W#TS+GmxSVJ3#A+f%;gmCR4)5ggW_V z%mqAm^HcB{HlC)avoGW4b3|cF3)d+ufA9wEAeOU9I{Z?`V-36Tz~1mj*zCube)yNvo3! zmo!}BCqf_-X2iCNu~VtpB(7g??S){%fm>dicQ2dzwCpWVOYkw10^`qnv67uoyhQU<-AO_0TUOYcOox{<~LJg_Cr7*$YnVv2Q}cu6%v z)cgR}mvJ_>>Acmp>W*%x3DE7A5(7BO^=NXzel*-XR`#cPJAhEeroGD+!+V0NOVrfE zIrH=!oQKp54f;}rHx1O=Kkheol?3YL6~#vqKG*kwXGtt^FEREAec35Ls%n4zkdH@n zwhMpa0~_nK-A6ubs9l>X-2;i=7!^=Pu?k*KXl0sDsq2`xqA!Z%gId^Tg}k~*>wIYY zfsU=kEs^?BHA`|MAKt9`7xB@@;!`Z!FZ})GqqqWGD&`|J*hjdt>J3JAl7}D(1;@!s zHDN)I8p_ft{ez-*Q|H&s38}K1Uyr`2-7QJ}zV>>Bnnl=jdWE-jMumea2Y!EUb}!Z5 z)=c#!QDGKP?Y#+xB%JUNJ~NBq!~v`{!`rY-*-Gl2RYAK^77^S;78Aqx5IvEA1F`$ ztjprJ8Sb{w1$P&yzR{4{zMTQrpfxhju<9$2mr!+>84s1#nfk!0Urv%~5V?=(*nR1h zH&UJ(WSG5NnTsB+D>R8=pCjtjT8g>IM!(CnqSKrmp5lRgY7jf@hAvc602$iyK^ZAX%e#(KM-$HPhLujWZe<_bv|b z;J1G0Kz$BxNY&uAPm3*HjbC6{a)bzDGm%b%9t zM`_V!mg7E&_mcNs`SgrD@mgt&=ae+li!d=tC*fvsCz@#AD4OY4m2_{0zD$3 z+jw&^vS8(6d{$_`es%!wT3p&8^{wN85Eknf6W0troUrXZS!zd0&iaI~9F z1g(C6((KPX{mzWi9Io{1Af({9u@gAfH4FQx-UR(J99We#9fY&I+9A;%FZb4vrZ|y5 zxp>Y^UQIV@wn+rEtLFEyAdFSrK4m^MNr$33ORcF-svhpiA=X?Xh@F9Ds!%Lsq1zCf zNC*uZ#du*u#!$v43P_}_g<+l2_mEtqHTHGuzBNvFyeoHf@pxOoP`t@sJXKORw=k3v z6)4fdE>13AX+_fAHsr6K->oB#NJ-x-7Z$_|2R^Hfc_Be`BPmd7tI1n7+A{ca^(pju zCkqSHcW8gOsrXZF)7eMqfiW|Tduys~*nu|tO`bdgPNhQ)uc?N{rEK-ZTPnAkZ#+%( zyhLMF3_>@5B%Vr_GV^mAkI6qZ45WyTZ2kFa%a^4NXnhn4j-#k(v0sV{+^N|4?#Y2P z*By&ZFn#1%5n_w5Eu@&_crQ^FKNu`97+O7x;%4P}?qHUF_b(WZ3NbeHg1!5$Lk96N zAqL+p7cKcil+wvy2_-=G zV2A=KO1($OF~=<2+oWxFUhd@a$6RdD6}OaByd56TW$<>AV$Ob|Kj!nZ5YJjA&*45x z*j9xKJD_nZs~H-a8L!^qHJ-pnGcb>J+-&rcX;LAHhsB;(HCqL0hI*eYF4=MA1->#F zpfbUd(pY^tMHej-jJ_TaP# zuWee8inQ%p0RVs`jgO<}YO+CQQT@F{ikkP4>8VUyyfE#XdPriVqcIRrzP>|mvy-$g zqa=fHa`vsR;5o}KtqUD%nXaEt1GdAP zlx_xj`s}mX>?^9#j}u3XC$ir{l$Dp%PiVT*LSx*wv+EqN9p56v<;n4#!f5Z+Y0H>b z+cYthJ6pEYmwDM=>BE$)R9bkQCyUj%@LV^_O^fOy^J;w>CR0KWQi?89RO%v#smSq& zxj1Py1g6_!F;JMq83Jhr$Y%}EY;s~ zfGC%jtr4F=Rr*MW$1RDI&HH0MIOq1V#``DpSkE9uZ7I0oL zMsV;O+u+Y4ZWALKtu;Up6cnElkGlGC1}aj(_DCej8LBrvlb>Gt;^H0E>qqoMPxc$r zDfj5p+J=RNwyH?#M+_?fArhF_Odap{lQ z2=ESq{B4VdhV07|0W1~MD>TzlOwW0ecPEB2Tj~ZD)GfbUk3^fC8yLRTXpXo4;!iPf zb(uS!rd}eN`?~ro&Z7n?&-@pP@7Kh=?}gWA;TgXO;`kR_F{@z_lE+Z1tT59Dd4Z7j!1iH8SJ6|C>u zwrZqGpLA|)tf`4jL%B(Jx+ZsEJ?pZf$MNj>got3Qr%nLZ$0;##70~v{RTxm?JvDQ6 zFK_i|0>cN=$F9)~JVb|yC?TL;fKg2!I|muODD22oowi@bYsYavn|+`}WI)6w)l{LN zy0tOK;J`TD!pN0hjo;ebEaIsBOXvY{DtS^-T1mhGS2p&ChzqsseI}$lx2OeBp3cYu zC$y`cMXG(XjEHtnJb5&=MMdbn+q=gWPTl%0R=w6O%K;JN+}*JqQtb?0v1=+Q!?=;b zHL)VE@6hSCpT<>w-wE92lSjOFs z+gqT?!r~_TrJIhVur(L}0Be2@t6M*K5C@iJRLJzIhzDo5b=H4QiqG7P=?+Z_Vm&8W z>{Ux=f83Dw6EVW!`7&%P>y%vHs6K2jR9(U7VK*-K1RT12jp>;CO(;M8s!M~IppxEo z*Bl3H@u=fU-)o-Bc}IkS#LOVc0^THEXgSuzIeMX;cJW=`Y{_PmBa@R=wzL>GF>Sxr zv~W6xcob!^G7^g8zIHJ3!i`v6T_>Syz(h=rE@WoC+**JBw6f+p)xi!a$#2V^^zg{7 zd>&wls5g7XK9O=9t+7oTNhh-L1Y};sLWX-}bj`ZiXJ(%ouFqT0trv>e8Q-@2)dU%M z!ZE!?bF*U5(SBu_m#A&QFT3g2t%}r*Uoey#c%vL*2&_;Q_a$c*Ey;1YELf!2m*2Oa zw#)z0*{G~BY5mzBodp9BNhMws`mz@^Ke463Pr$rq3Gju8WvSB|CR!2R&--7by;W43 zQMj#*7cK5myto9{;*ek^xNC3=6e!k~qJdxm0>KJ};O<^rg1ghAEmB%2QcC5pkNs!- zW8a*8ZZk%5vGT1ozV*&IpP6}oZ1%HJujhSy;`9B>N(`#a%`hnL^Xi&<7PiQAWMmcR zPA-aw-+F0h2Ta7bSvvkUkgUvzlDtCo-S-^oq=k%lg=%)gn=b^6PQpK7&`Ii;R1JD| zlS)6sK3ks)WwdkWcJ-ApV--4*s)NtxBk;IW3im z*|7MLK|QB_o6}Ht38`gCWlin&PSS%nphahrG?D2i-Nu)(|l*(jA zF4R@aT=UM8!;k}3S!?x1*wODY!DE!ecwhR(^-MEU(KpY9;SMpsBlBLx?cn)wzcRH6 z_kt?JfJ|Kkr&4b_0R;&%0Kl(1_=<@(*@xMoyunc zTMMwqE{UVd(<-?WJs{q~AXAD+6u@-bZH6Q9s64FmKUG6~XuUz4l0sirZ3z`Z%rG zI*`iU?2r$+5WuM4{zgo&b9zev z3*7OxVEoFFW+WJiKvhB@VoT*r9(b*Mvu_PK#B@;_(Siqh{wylKt>R+WuxzxcI}lC8 z%q1=)gT>1$mS>lbBp76j5Y0R-`z9giG+zC5;zONJSG8qzi)D+4FEMLnwhaoH@W<HDt?{+#X7ru zn>#DB0Du88VwBj(o`N^Q|Ch}JmbB{8L>Qd9N^|m27ji11LiBiOHN^hd$WhNQ*@lChn$^9 z^+pM6%MSH6t)aA?OV=lf_u|4{9O|9`7RRF{WZG}zPD~3F}4meH!KPDo9pc8f9k-5qV|7D{}nUdDiLq#b;N&Gb8RL*#Kz8f?MWgdU9ns zcnN4d?TV%%Om^A$ht=e6MghZyNx%Kuc82D_3X9RvNXFV=Ap1d-mUF74Wcx*nK*L_l z$>ni((l{neb1wW<{^wvhy}O*v3sBo&og}7e)oF9%<`i%CYdaWux$ryY>xOG4R05o^ zpxsbQF^qJBa}Lcji2GreSrl4bRZh!(UqS*zytopGmH6qlmp>n02t0sW{vTAr|6`Q$ zzh^2cn$Fa>H}+H6FmFox|ByXJ1-4tQB|jE_UG1!&uYf6lmpKZn(`%KT0lYFlj_D5wR!p+<9^XH#VKW+()@#+) zNrQbebexey9GA+0l27!cn8iKHLV|55iL5wKf`Hgw{UC>OQh6uvQ0&T@rlJ*1KmE!U z*&6bQY82{~WI^Xg8`*Sj$~4GI4N%>To(FBK+rgnU{A7C3KPozUqf{vNPXL&14{h4J$Y za+f*$6hvr3JI=f;c90N034m00mC0Kpp^0H+C6MHzK~dSHN?gkrZ@W{DoMVtRc}@TL z``s998dIVMjqqmvIBt;R0Z z^1a0F2qtgP5VcU(0y~>P!s0l9=wrYELGmu@*g~{A%FFqOvzumQ;@tXvmNZ>r zx_q^Kadm#HzH5YA`Dn_a6*oF-%1J$qwwR+;xc5bfQyZc&&LLm#O}QI9;FDYoE2ZPH z1UU!E%bxdSxJM4P{3&817;(Ae7PLSEqR+RfVky9s`N?1a^QyNO$BHHRkW@kCosMdj zlh4CV>v^un(tG|U&7NCf4Hv7IoOf^fM}-cLNS^C9GrIW~wtH!JQ3-G$QQ1IO(5!%%JF3yr8P9xn{?YRq}0C0Zs!_hBJ+MpRDK6z{u za=8l4Q|qa1oZ&LEx6~>;OIai%2V5;CeikoVKsRX22P{u6>u@TOC+xd{{6FChh_2%t zNcK_y=M%gmu{|=dMMR7;9KUk&L%93N?1HUUN{&c)22N39-kU`jh|>~@>kM@#$tA!t z*r>wvW%pCYFaZ~>xY1)Cd2M;;AOZwPDnsANmOqNmUz;g?h~_i;g=r4@d7GgmTCBZSg3d| znCl*kqIW%Il-`jmk^}CZ0m1LscP_1_3O78r4pj zE~TCt9>M|5j(Kt_);J5RIt7@O47x7@L!zX3g>md}M^pK=U#q;#lYCQN;CDi2ub+0+ zCSexvJwisfs42Wk=Hdzb$Ik=hNHFLDl-pL~~01G)Ud!tyb>k&Iqj*eb%^l7DZ_R#;K;Coo+!TE}ZK*r#^ zuE-EHtuusdQ|I}6OaLCN*=r+c9WP6mKeCm-g$gC1q;DNGD=2N*z=%kp7JRfL+i=)k zEo4L?o8V+w@g6$FMaZK6DoyMg?o07>j%aWxPE(}OiF9Ogwz>q7uA*feXp!S2g_SiD z{djSt{zx~aM0%mMldL`Ya!s>pV=>V%`M^25pw}XS#VV=ai9Vf?^|8}cpgtFo>-PmQ z=AZlV-^hN%)ey)gon>9s)i>Q`W8}lFb6r*zI1UUqAo`Zzhy9&b&$l+2MN!5p`6!<^ zeS@ex?YLzxb1xsN5mS-z>7$@f|KY(A_+{DC&?j3I=wWq=xYJ*Qx@*)1sY`Xi8{JR(QXGTokw_-y^ z8Nvb9#-2xK-s2O?rSMD%lm9rO9UL&N9E?qNj;Uz&JY&8Oax6J`D$H$!=X> z8PhLSPVqfA+5~ba@|lj6*iD$g)fH&Q{`a(-B;fes)?YwQPH{6E6_NN$QhtoRosD#O z%*iLWsPwaN9v-F4FnrT0A(@F`mj5sp@YR`vQ*tm8C7xWWWVKlz1P|0`nmTKY--{DZ zNQ_*)JSJWgzl%Kyq@@Q42sE-hUzXh-Jr_Q6Q5-T|mV4nHJRLl;o~O&Qqyt)T2g6!^ z$e@_OZsp`GTD&gU9r`|ujp+%GYA*V=RIEBVABD!IKVVh~VHP5leQQZ*;A^u$#!2=i)3i>h^emW3tH zyC&pfla$#YWSNrj3E{AKIuQ;xr<49g=J!FHrmK>OD7d@61j?Dho(AfaaH__u#Z}|J zYHr%;?RG@Z)p1hr+R(0K^k`YL7RJRp=~Z7`Cci8~T+SP0{Sa-}=m2g`NVP4bzS>`c z5i=k58&Zm35o|(9d5bI=owj*;PMY%LC~y%G@JpISj`){?emTme*UVHC)Y@?C`Toj+ zBwkD#a}zDoo@t)>bLU)VVISG~W=sU)CO4M?EoeBunwp*%x{%BlV7-}NB4kx*&(4N8 zXmHPi2imW{5%=o_JD1fvjsC-0YV%)ljQ?ct$z%Z_XC}dZSSJ%o$1Ow5+PGYE!qOPP zc_90C{<=j6JPuC-N`Uq57%5Y{zq-#~b&fp8*V8Cc6>gY!9^M;=h2?1u4w4HT@9~w3VM5-P*}r zV#uJErgGId%B4c(n5dn(CNMBfXmzBGr%_7^T+}m3sFX~unX#H{q)>JW%!rx(I>VY` z<}5oxLz-0C2H$xfR}53-F9n>9g8g`NvrfH0*ENWw+R_yl?kHj<6>AKU1M!FiWnE8R|2#0&aBE>E%4w!e5|g;)kf6UwnuZI5 zVgexFvZd!C@A5SOqjmbsi1SEHcqc3V@MUz%+Af56%-1%{ZZVsFu`2IX!OZM^2;rU0 zxo27dg@<;GT&SF@v7EP;IE6k*eves@`!C&vk;{%0KFB0>->#6*Re#8$9ms6s<%yed zShMZ2*O|$(frPB?jIya-FfECE1zt%~O65^XUTs#p|&|s!i%eROg7Avo^Do zSQOg`>J-qZbG}YTD-NU5t%Et!T;s@Wf&d016g6ClfnDr4lHb(i@}`4-zL93c@wTxU zdxQ1MKy@C7q2a0Sh9~2Zn5I7Oa{~wo+{+dDu@+@0=k7I?GbbK4LmFWR?*#>6AnWJ5 zE$tLO9NBETo5{ST2(v6fSwGcp+{q?XLbu}y9fMyTD4n-aF zb#l`32E^dUffGncK0f6#aw{%lw0x^s>cKD?AnC|Rbzt_M-Ra;!a8v1JXWhh~oL6n{ z+ol0-Gvg)J+lnWp`P^cg*EyH^F~KnIy;QB2JlyW)Y<|&EQ#jO_Atl)I4TcXj_tMr#A`}iC-ALbo66{Br@FpiW~Gj4(|%<4qrAkuLiNX!$c=D;{FgaW zc|JlbE8TV=`u^KY8S%(Heg{`!%xKNUoDbGlcKkSTj)&#@OK$8XPTm~{`tm=4HUDom zlK;e_{r~r8M*x=Kt&8@hF%-M$o)IF^c%@?&!&`>#fn4w8BdUHE>Up%8HOoyx?+m$D z_Uw!{DhC~`K?VoI`T{P%O{GkE3mMba3-o1j?G&r zHWf>l%``=tTspvsdd{Jy*E2j+OWEW9uvD`;cj?Yq3=JNkojJ_rhz=z2?$r6@T(I_j zb6rR@Fj-p8o**BQJS`s!jaQ!JxUybGQsn3*)Q3GkYNZ@RL`$MxM}?SDei#1mGj2UJ z5ak$nSCVkoR*~aQl*igr6gA87*}P58O&`kQw8;1MD*a2bfOCB}woz&e2-41yHmR|m zuE3!YOE>s^>L)4bn}oTgRaUD`+I?KP-QJCMorNwMOlQ?GC~gl}>;W?2WgYEdV_#zt7WgTQ!s)NZNKWG>DJIO9x_DtA2 zod*HsUi3y-aefC1XS14wRZMG#IZ`_GXB^60Ha}LuN!$bQmKB1K8^GE_!;jT9hzD%R0z?D%J6LXkhV8eDzMUR<|0kx+afxEkp4AWWp~wKh4lg*^T+` z;AIXC7f5$X{8fTqJ5L@>S9`p=zCG`Zi@*vOu!Gmwb&vY~V9XD(px2%EJOxj~DkS`f z8!YP^5P^Q@g>U9`+wA=cQTMp27CaNWG9q`9ytXX4t}VOo)s67==yvT1J}n|vZhbay znn6G_y6Ng7&C@cO5QHrB5#f0(9aikY^WZBn?0{^Mxswo>@GdT`jRvsB+5o?AuTLj& z#BKZ7lq@r+wV>EOmc(O|(sXqOaGP687r+;jnL!SlR#YB`LM>oPz@kUGJ7kN>%jX1N zs8cOqCf5m-`C_;wrlN5NMP)kZH7)+&dgfZL$jJBMZg)NbN_a16gzKaZETuU4kAqf3 zt;KCQMcKcR_nI{Ea;AvgkrlZ^)hp7k&$0R%O!FV*OWcoDaz_aJ!|I_^mpH=ZS>zsYR}?PxmwOL#WnRXQ>iPRA-~Cyi^Bs?`HlJ$iH#eiY0d~GGnT0CxB5JXAh~3HL()SQ`5dT$SKTwQ zb;q{5nJz2YcInb~e$8!(z1KQXDuW|3UH8(3?0(M z=jZ89?NZ^hyIQJ#W{;z5(8x;@N~#>&b}!PFRqXD6D=Yv^Pe-J}(r+~=$Ue9>JEd6~ z2iG;;Jug?Xr9EyfEnU^K<}K$bDf zusQ3?83-*_rT@dixD~|}(=!{LknN3}@R-^VRz?%F3CRNeGIP8EaT~l-)7C^poCdiS zv--*zR9>Ed%dbkhKNuf4yIhO=l4V>o(72@^KB8b_cmKr>L|9>|c9ESy=6t2eJ8N5y zCry_9$D(Xr~x&=-p zS%0Nx3$0jj5OInUPTS6WqjY;X^G>6QCirs? zr0K;8dFO@oOSieH+Npr9R_VU`Wxew_iKbnZRrCO!wtPQ|RfC3}2ru zgjsoA{4l;;Pl6{ymBI7pJ!ZgQ1a4)gWWj)l1c=`?b?)=YyA7XTGG0YeOoyW8=E?nU z7l{&=c$wjEz0+BROY=Cr3@oX1T7Ib!BJFyGp*8^IH5W-2er^EVUZ7HTRS?}Z`jXMzs@^uA9hM7~A)V7Y5R3W^IX49+N zN*iryT0@yvgkZ^783l@h7I?wSK5D)FIetAP3~SE^72GwrIT|VV6Q0E z7qS&8mQ&1-r^>fkn#4bcQBBQZNCNVWC_RBdsDv_}y8155Lj;Yx4Ilpc>|EN+1(K`O z)C{_P`Z=WH`F0RY)nNh!uaGTxSxOixICpo%ihZj|qW z;kamX?k3IH-^u+$7IiM+YV!=E!uGU1P~39a$z`cHh@*IL%q-tz-{vgG&}v5kRe0*# zAn~!O@2iipIT&51r}OIWv2D&$pZqpf5V1_#y_|CP7@a=gW*%9Vq&52R>uBbd=TV%q zODh{p6_W{)_~ss=^$$zOCFrn0%!$L3(;$XBJROEll>bsfOZ&i+dN!y3wN)BX6zKj_g`MEEzVzXMNz{(lbI@SpurNI4I@U7@_c z|M6w^&7%dIXQ9GT&wholZXJF_yk33uJaTNT??Uv9ytL!hr8Um$t8<0U$xZHmSapw! z?o(4E_w3jH$Is#Y!#dsy3CwN-{=>3iRlR+}c0c@~K^d`oKjBUE4{NdG{IjTc#@`P4 z=yPSITi9!dNS>iv#2WQKta9k~jNQ7(!WZ9g=cOqEX^4+KQ&VK=x=t94rm%NuNqt%d zuyYs6P5JIB1$|-nSn&y^Pz6H8v%rD&xR3c~o!f{k15_@ZGPCiy0$9U-ydCRq^8CN! z2oEstvZ^r4TDf1*FE%T{o&~Y~T}^s%IrS|q4Pg=n8Ke6^M3NMs*$1dpS{t-oY~ac` z9M=Ybt?(cK46REeN2DRhyUy)0?=sCMJo^|JY|-w^y^&+_@5Y1HpVx}SzcXl~eJu6E zRT;1Lhfl@4YHd?a#W{q*#9G5NfgU40`ze*}Hh+rcTAdI{xy!?<-E@pjgZ|AL!x)}i zJNP^5K8uRMycx1Gg&gRk$TNL`^G&+JX=|1{lXOFUU6Ui1Daln1AXs3xZ^Hug*>3u9 z*rpP}3bMMI;An<=83nXH000cu5o5SGhDA;{PgGQx-2IMgt>ls^2-%Rrb|tA-)RR1v zNtaM*I<}f%?%(3nWh2d%E!pz9m<|3$XDUf>OA_1Y1Nx`YyX0?%Z$M@iqxVuftDA(} zo+QEUNxnrc!HP_G!CJbJO+XRg4Ni?_Uo*i+I_jc0x3r2Z1!Lygw#s@N5-%;EP%0LE z>!~r>qa`XOuBKh)lt30W5>2@w=*33ir#4?Vcc`7uVL;lO7!A!g*bP{QnVm~tYjp@b z$N$%H_kToI|8FC%Z~h;SO02u%KOc4fVQp-^E};l9Bz!&j&;@6D@bM-&UqeeA{ePiUbbYJNH_+_=<4>w#(iQ6XVi#umCU@RwC>qxj~j707hi z!lVG~`Ce!v7{tnLC==RU2%grFD%P%q&TAn!S%Ch=IZCBm{EE7J%GHXN6?_)S((=C= ze)bs{dBZ0L@j$Zv8f{NMhJ;e=?nT7r2nc`fKv{^(b+uO?-Yio$ZzRqP4<=-@)^kA~ z&<;k*=c!a?8OH9MA1l9qIQ!w>+~FL0l}z@+v0@%@HlWcbI><7!i2aC06N@#fRl zw>>Z+q5*d==w0hc8IRnsWC!4k-_b%R{c-FU%CrRxsJN>WzdD85YiIFev(j+*&uV=g z=w%;s0dWTvyXgc6e9eLlk&>!uudpAXc=#NG&FP=>h9^;=I{4#t5|wmZ-W$CJ&zs z_a_M=a;o)0@{Om*txrHyS<=nIdOt&6GEy8t-o;(8qVl;Y z+!Q(4+o&}5c{3J?u%a<-;hn)xj6i2Px?gE1&d#bGoxiFjT-JH5B`m%C(+0i@LReQB zcTWhc+CS2yD>>4RpPee?C)>m38K+3kI8P#?B;5$2y={JZPW?1K6EJ(TFQ>+?1wgv^ zhmC$g9f(mq~pWzG4{2rWbTwl{PQfh2ReI(C6+*$X>yKuI*7O$3{w z+!j5VVup}L_R6PCGsl>`lZeT^-{#4fJuQ1zEK1Tfi(#?tkwl9(?9GJ7o{Kh*!|n+G z=f?YB^~&fU)}N=qpRw7$!DFbOsUOQ9wm^&MoHEYeCxXb=-w?-9-&djkpI72PHBkH) zKK!pI|IM)?uKs>Q|HJy~`)oczp*-f<;mzx+OTT-q8D`|`pY^lz+w>X#16w7U2r|*i zqU0C&j>4*b85ng5$5&@8{`Yu}YK12WT91?@ElS4B=8=mao7 zC1xR-G0#IV+8`oetCp6I4m{oyZwxid)h5B9sd7zQLoQlT8PEgSJF+4lXm${ZbAKCqcboFox)K)SS7hsC)=~=e;<^{D|^|JpeW$yPLUYYIR?Zxs1n&!!)#L;`7tIDL8tjj6#XonUW zgW2`y)b%6W@uq**9DAv3ov0g}p3teJmwjnwlb!-tTA}MEurm0}l8{+5eSlWfo3Eq{ z(ah;&!o4GlPd6P>n%S{ssS+oteu)n|N>v*###HvROF1JB^pq#B&zg3D;PFz)y~R#M zVxNrs-83XcAT7 z%@8ebdd*)i=pDdJZD9gy(1YKrlOk?w@mt219uV}5Py9!lqTq0yiuSa%P_ohMoHTYy zNA6I~l1w`h%l3K?t{>f+!*mMr+rHWWb&s_+rq5kjp6}=8R^#3)??rHZ63~4lEpdnc z#B&KUzD9nx-fA&41!bn^x2nffepWz8p8hH3dg&kI!kn* zydbsgV!n<1^adDx(RxZ$)&Z0Hq$3+i%sSzfq%?eD_M@wL(So?rXKF9` zvtKQ1Nx8Z-B@!&Oo>HkBr+ehB+tYH|3KBWd?J7N0eacRZAi~v2?iMu{cK{aQ;oLIP zJ+9mivVL4#mggZo((bxE94)=d5ck_MI6b!kibNTwuSG)2KF{w`B@@_y(R8_ANlO$5 zuszaJ%B7W4g-yBr)01WHV%H-E@UyWk?gHvlG^W{Duxnj5QRI%z$NM>zb>0uA=bo?sq zrAgfQ+`UiW%0jC-KDwTCAp)pO?+-SHt0PwKYS&-Idh?FXe{S~KFf9nSPTVqY^fS&d zwKBnYtnOP5=MG(LdBn>Zbi`X*rIi-HB8I1`DL)#vm}_i%ck&$Xul zYhWda=eEX`03H2dMccL%3fQ*tevjf+l;EBS)iUr`=XKFFhd$ewQ=dOC{=JiW)U7`e zZtsdIc*9+D`zXff-pmn%K@S8hP=nq*3ICq!aL~z-`EA(;otYO`nvVQPVvFO3yH`f> z+1To24pvBaokZqlmgR?A$v}pDs$DQTB|sg2kSz9ME(TLy9CTEicz`xyh&4;xKdh2cHvf-v0OM=stnWC+-g1ej_3$T%Rp(9e=QqeNbn@}P zW7&~^5Wn>g5w`)P@RmUR4+}!7kLA%RB}HEZu%Xl|&Gx)mc0&TA0>NSCT-7y4Kn>n| zn^DVcp6NUW5vNIW+9@sAdEvqLJvDqCoJA+yU|y{^kHYf|Ia@|0ybUF;J~pj>uP0}2 z$4MIS!Zo|?2STA8oB#jFreVcy9;%~JG=4Ry7Q``AkXm7Oq zVuw7p??NMm%*1cIm43`xXsNOHwyaJf(6Sl}ZKboCU&1JJ;z@6*c8uH)wL~;OJxkkZ z6uverJ2%7#Ds_~4+R<&vG-WDD#bw}E<8h4FDYn)iGP|;=Tdlr?rH5$d#(Y6i|7;2P zhn4a+`OBX#drbS~i2Tt(I!|B6M03vVK!E&8B(_a;cv*_E)`10~YDa*rD&G?F23cAn zj1S?U05+Mj^dbJGctaLg<=%^E&NR<96)uvl`40bgCJ>k6=xt%R^fubEJ%86w z6DE~En7(FwP)Eb)-T*HvM67>lW44rgpAWnRYgdNE+8A3vYdn}*DIT-%>eQ!hQRk6Nj%V{JBb4&2pTsc!R=E(P`mJf_bmSLns(PLY%I4~^HH=A~g z&XuW?kv*I4JjOKn`&FE6w>Y&OkwssnvUrs_>v${=y-YIpReN3{y`(v&>F%)qSg_i< z(kI9+xi{_?_}6;dVZ6cXsJcGdE(uRsQ%m4k&t&8dg{^ z??A-Kx#+MMB)P20j-&r}+op@Q^O~I6%!9uCqPAoWLav>`33;KN8|rV&C{%-SqH4D0 z-LnU_fed4;z6j#N(?sxkm&9Q#_2LF5sQ%edTz9}LEm%EgZ;0HW<<-1W&V19$4dy^j zo;58)2lXmR=}N24dn&7h3Eo~QWjq{}F$&4X^FXIYJi5L@oWsmoO|<%=iYwqZ#r+vEuB29ft465c-6H}U*JT<2tETJ9=D`*c__$) zt}URDlgS;MI=U&sB%rCx2lo$}@d*w<;v6QA3|1rm3ma*2^}=uS%tE+jA9I zae75s?9NzPg)@L;B#TA;Tz#%V2!(__8RTHt$@bduN3D2jME92UUKU;5FHxEa15*U& z!ogB{{bqcsGN#C6RdFa_Q;l2oEpi;Wi80uR3O*(B6n`qTJH&ZpoEOsp#6iSZHG?h0>~FUj?^_ta~W;!al39iVd2Neg4hN#gt7zd@>eYR~Rs zmkAqUc!STAkl46G)wq2OzApAO_i$h(45Y1^J*^kzKTA?9jZ)>v6(I276ldxaN=OK7 z4m_l;>xjR$thhPR$Sh5N59-`+#bgQr0LY?;XlJxa|IJQ$e75sDmU$ye3jF(~%&Hgp z`VNiS70T8}%XZGv#sP^>cNZ13r3b{IWyP~L7{YCYyrY4fZUVyb1nx zVk@`t%-{wxGW0V!RslitHF^3`(Gxuwd^V+3>yT0uxxwr|Yw{zZWs$HW3RcS`BPN$V zU2UaN^3Yh=bYuw2jAPDazZcnrnj_#uB>3u=)okrbgU$E9k#t@@Nh5D35yFCp51O1= z9e7`))kr7@f&c3%i9gcw+fX+ey-oL62FyMaY)KLWqs zX&8&{eC;5+WZg2WUDY@+5~=eJYO26ADSFZbOygbP)IQ&_TboAS(E?Iy? z{Dv2wQgDS%nr8iIR4}KSUWL{)#{e!x5Y5C+$ z*_`$i&|PW|y_wj4lAWssTN>*5V z^DM>}SASDABWo-x;Jc@<{vwm7Y$Jtz*dRW^Xx$fu^akIGPpOBbt%gfP0S8Ow19jZ$ z<@{Q{LWrsIL%FB<7kR1Fb!V2jh#2YU4I3S80y7(YJwlG5 zMe-!;cd0WY*>+?#`O^D7+IUYzD_if(6*PLdHgUIU8IlYw)Bd{=ty?Ws1bc|po5d85 zPvkfK=vK3j823oI5yKYYvsvMph!jnqh)9|EW5f#H&NSfg2w7l|4O@gfn>z_S)-qmX z2q+#i(-#>Wxo=%*YN>KrKW$KNa;8EUo>{>JmR-=4uMmcvqZ1gpP)kdP4{ouA(+gzT z3g%gXT)FF=sO00lb#`Z;v#aM`sFsFZ9&1?7eFSkA z|A1$X9Ddb34s_~yL{W-}7nOJNAD|d`BflwjWHxF0VJh}bQoi;=3FS%p)rTRW4K^n2czVEmS(x@rvext}+7Ve>=oHCgnYC%#$Q{xt{ zQG63MzQ*x_jn&w}*V$>+C?qdoESv+|JvEfT3L+NtNzP-HUQA{<)Mu{t;4`d`|U&BhvFQ}W!XZIPN z&(h-QIUs%Gwk@LCI$ZL^6DLrLfIWxuxoK%Va_gfxRIw4^(Wg^?3^lV7^>jG2w=IDgY;2~@t$k$W&*2VZ6rxkFT z-$4b@b&L|0GLwgHh6UM#raM;==Qo5jHI*H5uWZ1UeIFvd+|8UrGO=+EIdwN&6Z{7^ zk20|>QaQMVi*uc0TD4fyrWi{wx^F#2u}7dG&jc8HQ-lTC;zjW2v(%I3hY-1a#u__- zdjyc2mnEm3ALiwMS1Wz*c7?dcO}iZa+mUChL)!CH_mTL?M5UITiX+)AsrTcfmltGs zbGkYov^V^+^gPiUclw~(cwVZD5_NyiS>z+TUhX%H@)4z{q2mZb>|q#9m&Hfg9CV+RNdpz}AmtDX&*Uiky{t7^ zhjRy;R7>OI+Veh()%2Mz1--Jy#OkramWb+#47Q1Gep-k{+q@ijYo(W`8kSf#Z9B|7 z8uLXWGm^J>XGrxl-%!Ah!f!iFDawmwkcY^9@NYj?NY&p((_YSMrOUaV*zRN0k)dh& z0sYwlpUIai!el0{)z;S5$}kD?$;_6@7;~yt8GVox$`ip!=SbP9ZuN!N8Bl1^a7q6n zW_%#=y)1tzWYphzGI@GcLby1};r1oZks*~r7Wl#@cjlE!r}yw##s*4CpK;88Zg1|6 zsx$G32^_{`RE%PR6N!sSKXSca$V9c`;C?I;8s{PkDRr{j9@i52hZR~-w_xj0BX~$n zH}W(e79dcU>&KlOzF}XRcF;LJa`iUPY52$j1mBzM+(hhCuI&}*Kk6P(*^P15pW8^; z#Sqll!onH@Rf>k4P;71Uf5wl}gV@-KWf%M!y6)6r9$L%90IM-aO)dF-y~(nd8Jzlf z^j<&-dK?V(%vgXzjE9Fvv3^%(eNO4$DP6?Rs)O7Qwb(>TUQbileM50by80Z)p3;zd zucCzJ+Qg1)7(BM`Alt@=$T@&$ zmAHUhxZh1)t|7LG)Aj?h%UJ`lO6u_M6X@r2otUDM5)jlRnG0x|RJ1hEr{HsIS ze2^r|#9!+H-={(|wmMG9MNdK{7b_u9Kcr_(V9DJ(U8Vwa{NJ5RI^pb!|>!_01E?#_UNn8%}49$HTGIDEN~Dv5-EABOBr zp>s0Gwon(vPGaWfzRefU)DjM#IgR3jY{p1f7tVK+`iyqJf4`gv zn-qfd6*G?9Oo3v|*r`+@S^u!mHV$Z!@L+Mq1}HK3jMA7@G(YR0Z@$i4EW10mLeXc52LxGrfscq zxLkRvghdZnXRud0aI#f%6Svd0mGA4Qk7TB-(%QG`t9h#nI1s=rl?sFP(XFk$OxkZD z9|8~{=21Q1B8w0oGewSY8C?GWg+(N4jNIe+Lq+CkqcXS|YeN#PxrSePs%+Whl~@xs z$$V0yW^>AXwYsWNYH%EMbK94mIdYb;xEbKd-S*$udk?6l{w;qL6%nLJLhmJX2)!4j zgc5r1p!6Dg5flZa_XG&NCv=eBL4{BQNC~}2mnKRPMbzKp&a9caGxyGa=HB~e-dk_I zwa&^qD>)}C=VYJn_q+H0lrbWLv2E#Tp7$ZI4F)&Ql5W%tIxRtXsw?3$nLdt}o4yWo zkJv4WK8)w-PdZX~eZ57n8MC;)T|+%;`V&=N50}2SF!8Kz#w-ohmOL`z&vM?e!2iiz zo(m&dw+54xmBi9pcwC#=fC>G?Z2dAK?6nE!1UmW^Dh`>)&88bSEIWo+@d)v~rRT)N zUVV|DPyhqTnqOWtQ$r4qOqvLO!NU@kWIBmJs^=4^`!<7KPE}WP{!c870F(0_OnrqH;M1^ zNBMGnxv>dO*@eYk4B?>O>AW+x`}`X~=GW;|lpNMGee<nB%ZerQLD*OqF}>!)L_BhB?#5u$HgMkdvPW;3mMrR%9SWwq@?di5 z_vs_oC$bc+G4NJ7&qs1D*O*@=;rqJt^lG?I4L?5>eWtjKxlsuTdq ztUR>h}7{RMDu<4ULePhIZDFIoT8kT_&@a4^qzIP-ClhL131ymA&m*f);M_?WLT=Nji1v>>ua~JTaHD z>pkp@xo{t5NN%dU8`UZA2@%`FD;tZPCz<&v!G*m`R1K#w{ZU4+c2c|}*^zm}AMyv* zyL~KQTHLzuT2ZjysiCob#ossv`>LYi>eEI~I+W%|#A_zG=s>}Gd|tLsr(bx#)mOVE zhEa!o*bfw)1(LbWt6ECwwT@Jg+S`0!|k#i7|P;qld;>%g}bdw;5HbjL_y1{zrRp=Fn+eG z9>zI>%|i;FAIh0fc-L-j709Ds%pj5ALd^-pa@7kMKlK^PlJ|a!+Vbkt(uM-dY3Fob z$Ja{?!ggSXZMF+VczFA3bh{;RAi4j&z!ur$Te+~UewCBQA=0Ja6-CVt9*J3$1f5J%+PXM%@o--r^&4$A!2}l=>6F$Xd~jt(?iQT)_rU2J#yM;&b+qlliFfjc zpG;#yOOf5-@oVv{OYGnD$hhb{cXy*0e(~L=H^e}$3J$kwe*|0Z5y!l@`D&dg7t8AC z%jmVllgTG*F`N&{qTt+1XW|b;b}PrNYQ1=Hmuax6qKwAl15tXjOf-04zRDekU>DC3 zepq84=hC2)9JLY)9f%nY{g%6=0N+i~EuWYa*8qBKY)`HXSH^Nuno;v7v~-~93$<$7 zusfky`?MAp&oN(Bh-#bcuX>ns_cBfWn0oTps`&)&gCYDHt-=Vcz02Vgdw2)V(alX$Mbj{u z^bG4DLZ)pkamM~MIN%mF*D~B%4ogyz|3pV*qiza#Z>9%f@6+s2Llk%dN`HrSvuKXl zGCp#bZmZ?whl)s)vZoDy0;WH-e6OPw@ryvHAS=?iQgB$qk7c|nQ;a9l)m(aNgXIvl z%~|?a2rd5%0OMjp(j%BL4UE@J-4u9y5oUiGAJYL9p0<<5fx zY$1QkJvG~|#@RzYScq*#O}x{{+Q=tu$;*jlua#cz@-FHw;sHsY3n*i>L*BryiU8R{9U-gZuXOOv6L-P9r# zjPZ0L3!|Y{pVJutbPs@eQh~F6#!l55IKbAq<1GpSZ$I$GOQ{+(^t(41%e8*R8cnE< z=H}Nn%RUpQUkV-LdW^}D>=Je@D3!h(HQ(*`Y2GCnj5MaBoR=Ln{?TuHD8PoLB2Pbl zgj;A>s0%rwZcMKPDYe2k75~6ncrZpkMYlYqMYYW{@gp#$QD)IbxN&TNnhCM#F#$8*{1bYT;M{eMHuWlPRn{x15e|d#Vi@bk74vxnqp$hQM{`6 z633HJBv^=ypcScl(UX={lIPtq1Ghy>&pB>IS-wqd&FV{%Fu;T+PK~dVqLWF(98TR$ ze>j3olHFT`Gr)pvP~~>co!X4)7l_0Txc91y-95^h+Jjr2N^BSQ58UIQKZ;ID(zRv` zn=US339`D6)osF5`>o{4$+M$#pHh-oE4OK@Np<}|UMY~T7!s=@7?k0|{W$DCC8Mn` za6LVeR%ShDkAqD4e)^Xa8sDak!4CljIrR;(i>0kLY6pqhGb-c0_kRYnH4V|Ek47f! z6*-YKx$iYBr@itW)`u$SXM{1{eNU0QLo~7p;41G3Z`SZzp?nbgW$;ZafoO)>ahRd% zjl|2m_K#Q7msClmSil8CjzUy!xkU@givi9#sA&othwY$Y=fD2A> zW}ai|70g(Yn5^-FX#h{p={~svAS?z;mKoP__)(?uaL;mWYtpchS&Kx)d6?zcYtlqa1&`OXH@n(ujn6MMmv02rv=LKP(RpDn5)uyIXRg5 zveJgleIhVv)3BC^UrEg60bSsCJ#kHCM-6vnT5;aW9vlM}G%c6dJ*<@ilD*O}sn+Oi zvtQetGs*7|B*%LuO@kK`*CS1B>Cm%g6JQGdYE{y-v-8Eh@$z%6Z%AeMS0@v8XDIT= z1jY?eZe^IyQI}bwDGCLkz8_%JPi~ldQE0;(7qJ^_O!)}wpK{T_e!oqJA0Yi{k2Dz# zBLTtp_>)|Y+NKvjOZrRw*d45OE4<{b2zG}c8Jz$RCHhhP-Wm|tFl-tWH`%}EG9%*h zu&O<6wel%5t=Zl+f+N!L`)Qlf*6$QW-I z0rA!BRK4_$x7A@_$$|+BpQF?cn1n-U_3AMF}&A*z=*wu>s z$kWnf$e9kAH^;soLBV_7b~-tuhXO9qkW4SPL2gyRw?IL5du^N7q&q$#Ta>*FR_CdQ zrjE){e-eY%@0q<_`o2shBJGWPU?Z|Q-R$Retrb$x zImV+ftmW%bMR~>{IK$^o>SnEBDq7Yk5zA;amMl}g$}!>+nry`g66CTO5S2-m$8{l@ z%~wr!#kl98&yKv))*DU&^d4B&TSHc3TbfE)^P4pc95w3cU? z`T~hmq-u!#HbstER?#$o-F0Tai<=Idg9+XWW1H&_m5LRPU5xxX=SgS69Gh-My=)Ka zKxi7Swt})lv7TuKO^=>h(nN*cX}!VOC26oGQ{S5nJJiw2UH*JTBp2_-FqEZ0nY(g# z*qeG_-t!TcqbaD7exOA*p7heB3f6Ih05G(kbLZqqH38(BRO=~OM2LR;1d}1;0NCBX zR|@iZDQA`yKn^1qBy&K6=SPQYj=&X<66RO~@m*YY*$v|2Gm zmvAKZnMGwsy1#AgN!Qt~G!EOipY$$%IXfd>GdZgs~05Y zt41jR&gJc=+m#4S_AenvAh5Ura{|s(Tu{7k>I2MfZj?jf!`2Pf|A%?$hkFfW9qv2J zjZ(BJ+G4grqTTeSIt=$f&F7K~Lo=Pv-W#pFRntGlCX-0qmvep2hSPhoCNyT9dqziP zd4yUF``R5WmXr7XlR~|tFe@g&dgV1#7vk8lB{37~z(8 z=u?9!Ec2j87h&}71byBj82KX+YM2e_cw<1AO!06nm+tFy_cjhK-f3RcqQ(n+?h7BJ z&vr+%7Dw}qa%)9I&NsP8C4mon^HQvx=D5D{IV`r$@pM%-j~Xs>=ruoJw3L8tutpp; z&MuL|N`{twH8rVQa)3B%vsSt8$h&tu!rshW&g@+vFB%yvdOq)Un^0B)%rU=yWu0?w zS>c<#{U;=SssFkA{R6{N>Ej%}dIfM%Jk^!Jz?a}Z@Ztkeyx{Nh0b;nsE<)6C&p6T& z&V+l!bip~q0)wEy_rZp!%2p5vgiDH`;xQ^-8gz#R3<)&V_>LVOz7 z@e!vgz?#bO!>EpdPn8+bC92iNnbasp$5410f>1!8#svRQI{5E!j^F2%*ylOPR4jt| z;(ud<>G9hfJ4t_OcNzj`a4;d`qR6@j5#hCv=$PxYsZGg!i?^!Ekjh5j@-Ea}lsS;3 zrNT4=nD290LL_nHPeZq_x+WaZc_Bom8-?qbI~lj@JSX37WaGu8PnHy*w$hdgcY#tB zzHlF0>q&S`>xdQ~fB{eemw@?1)sm=<0bAROl9%B;nhvND*D5B=nRd@MH?U&a z?UG4lTt2D;JMk}~u z=VgG<9!X5SbsHVsOI^ZhS+Df>4AFl#$fEMEvo&h%U;M^iAx^=O{2TuS1h<^bojAV1 zsq^z`#m_Qifxjck?PPd657N#)Xin^)|va$hRE zz;8SKej<-tj2C@3mxtf3rOZ|8pJ)W7`=lP8u0VJ;8IkWpJc7TE-;&I)cxk5GXN@6a zXUcEoQ&p_vbF*}_-b~(Pa(ee!HO}V;Fa(4#ACt z8tOyP3?oaO_)UTkE^eN9BjSkCsVBRm!bv10wza{o_lJB%B3L_F=`1helNx&Q(QHI` zQi`HAwb9hP^FJT9`EHHx%zJNLX3ZzfKDIFH$y>1P{3r#;(K1A?x@>m2d(JgG#4C(~ zrhKJ+bC9B#oETec8O}F!BL^a@8L%~Xx#)UN2VQ8RdDM-)))3fNB-LZ%)gaOi;R1An=Z0iO7Ux<1%D5K)oj|B~|D(lp*F9I43NeA!yXpSES?b3Uoumw$}=Lf^P4P}d6-$Ut{Lx__tL9|6G7dAkQf3m zp*VPE1v&K@b=k3g1B1Vut7r?<#Fi#GzcsxjRo-|zdZ7)MmrT6VbZV0Fv)^(g(}rt7 zs?@%JzO`p-KH$(n==YY3$f}#cs2WBkzKTVJ$X`Vb;}3NwX&|IcRPF6~sw<#YMj$V3 z*|tPgBA_M7{V0|=iS%2Pul-9Iqu&`?hmyt<J3$xx{tc%%jCwAc;oqk76FAQyV^WCJ)NWXCIz~$E# z;>ns;RZG!sZPl(#2d6_Ep1-B0^$#0S{JsYzjYay2rt;b&*bl zM0hivHr~+1qt7i%$HzSwWNRQsRBr#grQ3GZRgAnN+I7tuqOE0E-m~CpXlqqVq3aq| z=O$|5Q8?s3upbnD)IXP`D&@ep)n>BR`27n$;lfkMibJIN*xG@1eb zwYo#Xez46=HG$&wUz`*=xQ*9)+O1h@7fvG8TWdNzdHS$P?}&q}Y-*cQl2Tf`Yx#%Z zti(|LT3y;J{^qzPj%^0-%Zx7}IQ{^8QRrc^TiOP~)hW(THJ7&P$@m@N&8kFV*NV9H z@FaKpnahGn`sVyMpE{2;59^+Z5gw7o+slCB55;o&9)UPg18{koO?5V{(Po13+3>W_ zyn&pY^x~Ot=}7U<9tlaWGaSglwS;x`r*hw99L%Q&X+`Hl^3vnm88rr+0dWRL&uxyz zjLZ0IuA9`?ox^rld9$vzhsAJh@Ci^726ut(rKixVFg*#q5|Ic-b=n zyMa+*Rr63m;aax1VSa|`sN8wF6x)w7&Yyy7s*{ZB7rtWabZ*$LzVaalx_#RVl9bgW z*P482hIn3)_)7zTfA=FE_@=uq0AXSJDzR|uL8fccxb2UDX1Y|*HI_T8L{S9xzB7dMJ^ z4co{Es#rhkrqRKrVHVW8D{qT;xpV)TPW?A`d|y6(`B3aT#GC&6=Z8!;Zk^|McWkA9 zE567N*(tdF^ZU0=;B${#TS9@Cu_AhR{=j2>scU^|Q!Fd`758rrJbzAw`U^Lne_y9+ ziznlJ?rirqVVuWzwl%JC3b~^Etc&voW-4?>F3X?xchIK(>=f(A3m@Jm{RS`$^~t@D z4O>{2e-}cN@+gg^f;og+@y$bp?~o$;w@(w-!b--C-u{6%!ZMpBZ{|vt)EoHM@7I5{ zQw&d3c6uY+!NrE$UUWjQF$M0~@Q#>Ao76Q6bFKExTxsd}6DyB8P5wd{pDk;ye$hwY z2AA07OwVl@iCIiOoa20Mg3Wd8Utnu#bIu|!2dee%8_*jgz#1bX5Y*i+#bt}fLIQi# z)E6d3!{_r_4Rgge#%KijN-^uTPFe4}~;nN({F3fv)T({fh9&18$Lf}WaUx-Hm=MN$XT9RJH^r^SYyl2ZuRtqo*;pG; z;KoVs8 z0~ZYFC4Rk`Fu&h)+3h}*&ibJtm2s1;byB6ih9cJqcsBnF1M}XJYrJO6gJBr z`@Qgq9vou#6zaEw|#FwL<2z&im{T`H}1;PIWA<7kC}wNtgv{=n;)u=*Prqm{p|m2`v-KjRZD*i)fyL;>KQUN>*=n# zE4#20=^o!0fsGFG4%=FP>JH8eEu6S%`)_(uB{~RskjU5jhFIjBV8&*+?@Da#xQ8%( zu%)67u9Qiax%-P+gpV=(b^Hh#!&24=iXe|mC!4$Gl-5A3^bjMW5IsUObHqTANr=YW zVQ2+~nC)rE9VMOn-HmV86D{UR_Z(Das^l0dfuejp3BQd(1bUeAc!aCXD>I35W;KnV zUjCYpUCvf;Gl!=klinReW2;n%Q&i3^L%f}}aZ&lGevU+UJW2WNct(yX@}RT zj)2JnYp+d6f#l_8eqp`99K>&(K+Nsd(4I!jc4IN6MBPVI#~(yZ{>q#$;`d9+2v|+` z3p>{&tv7Nh0;|QOv=)UsnQRW!u})atoIw66^9d)N{@j%I&w}J@&a!L9b;Ce@M{i8v zPTtrjQBt+?3s1z2c-0Agz8a`C#pX5pA9%6Uux+ox73XF^7bniooi@ z=r#vHjx(h(wc#hxw%Lb_2d&@2AeqUNVG=r}&-TV$__JTCw+LD}ZW*g?BF4uPl`lq)-RoiOd^@eY zT0ytbp^zQv({vt*;<#MN_sX_&LZJZ+n{JFs`TBw8x0R%D*=tW^l}Df(ghHsV)i@dh zbl5i$t10LDf2G_0MYd=yGFOE7NmI>aa?oz{+IQF5HlR<_8uL-iYuBGK#<_k>z(X3% zbe^{A=GD={ASjOJRLeZUw-G@GoQ|iXL)3N0-j$|j%)gJfbH3J;%zrVeE5kb|zC2Z` zIe+-x-B=A03iyI^D##E6MJ;Y#-NLW??s+mStZgZ?oLJ=b+x!fACT#AtGj+zORen|w z9Y3W5cd^|TPmuvaoMgZHkM2!`S034ANy5RIG{RSTxIT4vU2l&ZLo1plEpbojZLVXLB*C{5ooE*` z&61m{IIU-E>60<8$FbJS&YI$$t55@1^F3vw&2G_PG<~{N!vNKL+FOZ`q{vlr=~t3# z1d(G%q}`5K&~>Rm!|4kv!9x@~OcF*WpPTv6+~|P`dLQSBMdbjE1jH*y1xt=(!fI!l zmNlSa<KS`RJCQcmPIrGQv? z(kqc3Nf+1mFoKgd{}NVrUmS49`epmlk_);w23sGyPw7%cb`-H!1unu8|WQ+ZurrKMM1l#$?pMH1=*DKn_lx^!<^kSd{L* zyM`8B=z0x>okRp+0T7kac=yNKtNw>3XR$_cJ5sMPub(Zk*O`EtYRhC&wWMb)INl`# zp~Hch87+B9Juc-jmX#OcL(T>%+D#&I17!S&+P-9=_H@|l@9k*M7D8ZlKJUW`Bv<3@|ma<%V(COeBi?` znb(h(iGA_+82fn>DTsOe*|OO!_afqdLJ~g+#1Y03;V=*i)R0(w7B2`kI-Ef` zX2|v#2=o@Sd(t{8l0?EKBG=cBrL#v8xcq@fU)O9g!`sp;c}PHXzlb;^330YO)<&5y z*lHz`DB~goDgok{?DnTMEwAjIyE+bdYO4=L zcDL?Yf4W0X3dqc0?=^v~!IWp;Zp&_hxvS^v5+x2J8RPdJ29)1Xr_E3|rc*OYZDAu9 zmp|xfI)0b*c*YriB(}+&hIkI2D(j@d3Yz#r;WL?q;y=)i$BqJPd16l%cRX{jdrG5d zh);e931#W=-qOC>?8{~-^{ZrBFEy?XYpH6RZ*Q3PR-7DS7NKZ%-njc8s71gmT|S%L z0Uyj3b7G#^^hNCOfmheRi94K!29?}?G>@9RmUq`y29PMoNQ+&&_V8<8b(JJ+gk!n zDwdq?Nj>@ZgcL7g5Dq+}EqBwI?TW40F zr|7!$MI?t3RZv;o?#v-^f^2?_&ar4+<7ktW$Dqk)*gz7l^WKQ^{0#DyMN3qjl{VHd zDcS)*t0vXRbtwwZxjhEK67HDhCslw(2pVbQ?$l7zcocXx{>jhdZ`}UDG|rY0M%LDr z4+XaaU48GZis!gGzT72OiBYsrJAE$4G+;j#pQ>c7w%6y!CI2&?f+cWZLv1HsSN1TT z^Bu2*D`Eq|z5$MFpn1@?7F6k;j)r1*|2!xB3pbIQoRB{lt)Ak>eWMfHBnD*(80miV zE&kTD;Y9|EjNZcK9m;_J5AOv!xxKV8(((`ef&0nF<2{*=r0AWr4$3$j<;Arcpt(!J zSXI~;c#iO$(EI`q1g0G|!4CZ=EG!D-i3@}Kzc+VZ21oyaCremFQ+6Gj`D>l#=RW&$ z+td?gvu{rypBKlUhCb>DdAzpyax#+pKRX@`s%_X-hx4vd2yofAY=5Rxi*nY0akVlR zw5LR=5w_LYBs~iqJ95pt=0uq~4en9T`F&85P9FX7K$RLr_&VZ03($XH!Te{5{J%xd ze>9@G2_2r8$M8XnyO*d%%ygrU>CY6S&!wVFzI;&0_Y&{#^7%Sz=)Qr%3E}Bpv4VKF zXLM*iq==7=7=?PwZFRzlp*SH+`Zs%#3Q3mnu#5NXcBLshJ-dE1K#?gi=A|EQjF%|c z+0WqiMG3zZ55K%E)ouvW21tfLt^)7gXJ-o9;d2Zo?{1C!=o4(lMB~u*$?lL?#v2Yy zc;BEwSil>s@9|*mW5$=ayVVq6!QqZ{#J;tq@9mLFnEZo*Xc0ll8}&gfw{gKv%j=Xx zC139RXGG3wF(OGL*Uj-69uE1OpI{!D0*zUPqRF;~iE9b?L?L|Q3Z6!zOon;4o67^g zR5FkITc7k+B~-`#e5&CV<1ic=&~Ba9Qo`%q0#d`8)cC@{gyVfNK~}yL*toTL!O+I% zAd41rntQS1qMKzopdN@@IfO2R;J9W-AN_n36_@crN66;lEc?4x6t+&{vEZ4z<}@jK_$cemFzZBfJq6}z2gmd; z7-*adcK45XF-CaDE!k6fO9k(HM)pIv&9hIWh#_b1(-%_Eg#=4=+O*hR&foI+|1My={MW5s&@hj#XhljWK|SAq`jyN&K~VK*%n zbRsMqf?TzEMkQ?}#-Mc=&S48^2|>N=C)*WT@$j2fYc1p%lvGh|;K)X^n$C-e%urk% z5H8;l?clmw`lj(HFG*vBtn5xxZ%uuNno!Dev*aCU`v~Qsr7@TO5vJTqDd+II+whr5 zOXkMO`=>*qw@xWytsUZYEgP~mk+~8z)@(a0(|A||B%{c@uJj>UneNYVupT7ZVx}i% zd9b}~-qANV(=y6*O}imof6y=APxGcoaoT8{*)`4J>N>in-KvqKLJg>D?ICkX51^TU zE7ui4kw`>kA8-;0O2j5`5L>L?rt_A+C!AWid12w{enrL8VW$;TZ_rjzCO@0tv}fFw z(IVs!X9(3WKtrq&Ba)j%zmS7{2zSze%=T44tw`EPrQLYeb0foSlDV{hKdVyr9@6Zj zl)wDG`Ul>3?x;L~huR~b;cM}itI7a}CZgB#4xOARBW0&Kqeb1g3N6#o{b}ovW{WUh zPS#c-RE#`iTy&Ss^)9lLoMIwMCq|K3S3Bw8+MI z0%QhsHt)BaQ{T-EiKWaj=-3KMkIGE3^>o0~GouDoY7llD<*NkU0Fsg%#BAFbL0a8u zp=Cr>b%YM8;GBg;biU$wkRVPs`H%xdf_PS#gWc=~; zTC$PSbaAOdB5SK$q?V3aQ0^X@zACwXyDGWY~Y z7Fk#Sp;J)<8GnD66oqLjcoOo?8TT-!C~5hL7zLZBj8YnEdqkWAfzoi&V|x{t1uUI* zj06YjQE1Hg47?~}!%sN&MVT0i0Xb{Sm;`T?&&%#taJU%&5v7*KmS{IoQPGE+@T@x^ zN;C88qTi#>zB_*S9(;@X^ShTEb{`@ZZX_Hf3DJuG)Y|{oMEc)${(b?x;(xM`|Mx}f zn`U}r{Pnfao))I`0!wrl{X-KRogVKgrjt!CnsgXdg$rVr0+s7&s=>q`{M&& z>UaP=ttFgAk+$-Y$WEuJqULQH8F|zu)y|DMMk4p@dc3`YR84z?o`Hp+vql#DhT9W| z$aK!i4;w?M;lae+&yK5{%DwEyCy+PvW%(4_A}^Di z_5-yC&*Mhg2Sl#WWZE)~)E%MVDyrklr}b=Zq6Q2)EMQp{{O<~rceJg(|8fz1w%S}I zNc(1!{`QC>VRnQvzST*r-3Vhl?@XV`MHW7)slC0jUu5h^?x67)wkL9z$Lg%~&2mnN zCCgp58$CfdvXCYAhcyJUiFfY_^ej#394JF{e})T^Zs;~KC1df#mpR%_I(}`;E2eb) zBYVq><-^~e9DK&H)~$YPQI#X(Eval!akq<-`wGUEQG`(t2SvQ5%M_Yj)}rx%IVi|AymzHZm3&`>|+=1cfuZKf02i;hQ#A)qBXQPC7v33Z=sYRQP z&bsC4#}bYk!p;^uSXGY4eEInqg`6|~8}etyoqOjbAjjYkUi%bKDU*bkP3>iafN#}8 zX0(pCL`O`lqY~GO3!)VbDFeY!9Pe$k5eP8_LN~7T-j9IY;IP)+>TnJ3F5zV5p(R~a zoBE`H-8??4paw=a>ZhNAOWn#dZm(m&DN-ZQqd_@apN_*9^lwg?8@b?c2@LH~ceWI# zfTBkKdKE^3;V~@4!@YvLG)xj%gVs3sE&9f_c(|@dNr|IW+cm#$G8UN5k<&WrZQrt5 z5I^-3IKzQoaJZwjOid*S!>Ok&Q@`l0c-jlm+?U91CE>{gzjJSmDS=b))&_bHtPI;& z_zr^at#R_qt%(86v4HlUH=ZKx!H9%LTARuf$$WLs_LOuJ*6K^Ml zLC0k`#=*SA<)|EhmtoTTAKK9LmEs4iB$9V!FBV`mAav>}=tb!tc=G^=j=;-!hOacg z8w@D4Shm!Dss4diO9`17{tka*@bc&`K)mrchd1u=k9Ys*k*f4qx8pir#`!j03HHeo zq$dvv;4H1eCTSan)-ou}tx~P}g{KLYo_nc}n1!0@pbsLK#cAl6Ou^+GDU>}kV65*9A6yt13Urv4ip}~if#}?Dyx`R+c zx9A_1+Un*7Hu`>i4L0aQR#hB1N=@--_!agpS7&65^%=X0%H;1)h6~h}(WRReCD^s|4 zAev3KNUF2ylpO8-(-J?o)`77mH>1=EW-Z+`73~F;#qubRWL_Xq&y}d3{`)Ea&vKT3 zFk$|;{N!Jfmj9yf`48bnZ)T&vAIbl3lj5IGmI*`LpO4?<2mu$_`~G?(_b)H;Z+PeL zm$KCV>wno_;Q9XgW&Qaj{w@3e7K(e5XBovx40=QQCs@bL}TAZpi#&{j{t= zONX{uXE$h$I~4qKOl)GD&R0|_EVs*~gv9TT=B(cfXU_xS?^j&v;qr-=^P*;AB$ibl zxyF)q8Pz@xdr2l$0#3qQb?;=udg0gpp!An>qwMoUYI+tQZfD?NFJSGpzqw!vp zoLX0#sE-Rco)nV>=oim&lFT}nn;yGr4@_@TFI(QujBD+y7_ zrBjD<2+Am61Z6s~l*D`VK!%IfI(bsW-8Oi5& zX5-UO4i{f+w@)b-2)>JT``Dn?g^}FZPnJI7fsF#D&fR@cl{kdy8|4-j#mUWy#9N?~ zcml4s&lCEA90V>NUcPa6ipL~w&zdl#o@>q0OzNbHj^@iGxeG$(1CFH(Ob^lKa^?xR z9uz{;V$=hvLw91B>K06*uWg^9Q+CG* zfZ?C9{7l>A3igWgGdBRHSnB=Es2Xzf0=!2pB80yM+|$n?&hNaW+VaoG!Hw0Ca&mZK%6qcv9L?L-@FdxxH?<0!sb%-xBQ(wZQXK`%k+)tm(>znOm86PDrXVEFHy3&B zSyj#$YU~0kA-3RIV^=E#2GZCoa;4D!nw53qVnyQSr?oA0YT+XoNP6)dp3a8bmonz} z-{d@3TIK93+c6M0we~g6G(A7~I6tn64izZOm|@O%)gIR`f|I@MEcin zz1uT=j@5@y_#wYJI#zUf9u^PLiQ3Yp^^`7k77t!Bcx|-hQeQ~K&!a)U)2fFMvEv|6$pz{#(Y+q71ls$Rfd=}@~vhM?(}ys0PxWJ`NZ?|vj?2ji>@2*RkR1NvE1umK9b zUdzf&@#m!RT#en&%rD3DFH}PX`GJTT6C78;Yy0QX<`8#TTvSu+3>wVYfIz_u&!@ce zvX+os!~Q;a;U5+KFnL$^-wWiwqX2ja_ZbRl92A$Y5L(R3ew%ee&g14T#g0+Ns#%<) zzBSH*jM49sa0}b2Sz}x*VIoB;J#F*u;>_q((;TfJQFxPte55(i4zNU$Ox2erL-A`) zi?RK!6AojZB=79dl@(c;jtq^3Y=O&z1&60z9k_C``AL{;T(;!p5xun|XTO9;X=cU# zX^$T^f=@o2rca=6Mm`1OZXNP5u6vcJzKXC|cqUApvl%r^h?(+l{qYTVxUH9y|N zrXPW3>Myh!wS6_zJjH+1NaPa5|OwnC)^)U0i$x`(%`B%TQCHN^A>3LBSJ` zr}J{w92;EIONh--*u5*pmi=zS+CxC?n^e$#cm9a@O887P?&~Lqc`YMg z1tye#*RdC<#VaVtPCCd5$#j2xuV3VO{y-*ovQ*=(04NuPR1Ja z%#&~7sD7(Y6&CFZd$KMKH!8bKG&g<%eC(U8#kK}!6@`>>x~6l3N;E(q&47pWbZO&W z*=goO17*)x9_1!1rOUuGoXkh_-3A!%Onj{Fr@?ybYUXr33_QSS(}3g;mLGccavV=? z=Fw0-Co>MIwwjPBkC&*D3u2zm_j9;S;<~7KT}qqNlb)exPG60JVgdd`EWCxqD=D zKP@li**I&EFTtq%#-AyS+`DPeI`_ zvdNbV7memKB$ai~$PJj%CLT@IXKh+$|JPMKSMBcE1BDjcxRgx8S4$rzpc7_ zU4IRvul8nAk9NA%R@t-^4(oQ#&}E;udIH;qEk;vf4V~)esN<&z-01pm-!Ktr8+)E` z40bYg^4Mrk$^gBCX=q3uXBCztWT@=_=A}a#398m%+9u(8%euL(BVkW}F1WlkDqoU( zB`$l`?uuA10M=>5l+$M+#YZ&7P`CY*E~WB<}J?*px{CvmB8^* zrm$B*XZMYS^^L5wIXXgr4}$dqOFXia3nm?PAm5$Ki__z$w3BcU`&mM_u}30H9K!?~JM%2NNBGa%i!ioN&53 z7>T+h;ldT?;zqDupdHvPdzH8STOSUbnV(ecFac{uJ_~&+7_Hx*^#>Y_7jV`d$w-_T}?Lgg=UsQmDo_1ng zb{~;U?Z$^CqG8PS2LoCKm6{PCI>_)`e~7lO6tZA1)0-+V=o_{kxEo*&vvo?VXdHti zAvt%-1$Kp3C5!pwb9f9Gk~;=S5pmcqgaw^YKg~pzyX_O2V0=SGTs-kRi4|YI9EavR zq{2VAzNa0lHSG9FhBr~a5n7XIt$dL@cF<6>8tR$-X(0Fd9^KNkWlU>>o7tOt13Zl-wcjJdg*JvieT zNxVO^_3$T6fvcc>*f663XYcGT16I5&o+FQ4Ghhb4J;MEdM5(egdsue*n7gSzmg4TA zM*m)SJ<(Y{s{%Ice$9VUApbvQhyRd*0VS2z6bRM8;-`^o_aFgU*ohW zbyp}Rt$x`P@D#Lh=ePgBkQm7Q^GCF$L5qccACAaHAfFoLci+sj+Q+ZhhhSgUDh^V# zVa}0%;F(7xaKqw1f`2#O`M>dd9{ls~sn-~VXx=ygB2iAOqU4GDf4v3qAMWt~d`hiK zj6J8c_xqAvQ*V7fe#Yf{0T!eP%U@6A(o=vqJ{w86k;<+Jws}gttHKzE(;f7^mxP|X z^PY|6X91+DYb|QB@T)}ctEa!Vb=L)siX^&_N0ob{QJ?sf-+qG}XRVW+vF9!(LE;!F_QFz+*@mfIM9$(Q}jHdGxcm!du_X5MzzH0p0> zppt@n6}E5`->RjR%m8VFmWDJNbV0$?uNG7*Y#fL*8kp;aoJPVL({@SSC;b5JS|M)E zdA3=mTh-6~51`At#>snt9m`Dt9eBEuUA&N>EWc@n4%BbSK(=GA<(zzdw>Tr+P$NSv z@L@zzHGK~X6C!e(`K=N`4HPnDe{Y8E?V0^bR0nlhqu$Sv0Hqk$9sbI|6Dh<(s~dF0 zOJ(c@|6$q+-}0=cq480pjav&(yhk9{jG@<4_L=y2)@6oC{8)a>mYuZ_|1DPl#~l>h z(p*t;@m7XPt_;1&${S%DT6+@`sjhfqTy1V;edUtnyxLDr(N3brl&;ZLZ8%h0FQe(~ zGj5)`ko3S?*hgLbBUX0DmbLN#s}ZEaD_AiS35q2%ta z9)8mvk`NQz$a!^-V8I)l(CJ5k_ez;%q>N@NH8qXMn2%xwVmQ0 z;yyKR2{d^4nAlZ# z*@N#fJrxQ(F_@m|fnd!Zsy<787fM2dd#?aQq}b!XoP@POOPJ7GK17f0vi8@;Szb8u>$+wS*7skskugwn; zVjWF#y!{moxrQr_%ZAVl8cAj9Z5WFPCWkq>#`mBkj2idUFQi|4{x|12KrP{*#O`65hZ4y2iY@;#=2L|{ow4X zME~HI9@M0PC}P9F?{$y7YRWRIP8P@P`SrT8GQop+M7|>NRyqR68K9#5T>=2PZ0+FT zXKu2y!Dp7n1EL0L={PNlqXtq%ygLNNWXF`GPWcxYc|DVrF?K%K!??B^ ziJ#BdNxD!>`GQBttpiCKq!X8T49U!IB|iC1$MUt5ZQa&BQ9~Ws=r$C6+LpEED=|@{ zD7yfwU!sFn$vUC#oiaHUqM}LBoY5z8jc;iaA{P?B8i>5iN&->7dQ5`JBC(JvAL?xol?HYPsg$Oq7r#YV0X~F0#`qY4U8QOn!z%6qI!2rckw- z$^2>2$?4LZx251&4JQ*V{`k1P`^=9+q>h8 z1vY~nE(5PUGz6ir>?5Wi{e^xcUM|tphXC(hP~TVPOUa^UF7A?I2BP4Cl5;8g%VXR^ z{q`JZ%gB2bLA*_BsBx0ei^K2tCic#W-8;^wkgLBOQE@k1pvWRGvyat9?H7Bd6Ao0z zqyJZX-yIZHx9tghilCr2AW1-IKr%>^vq{@%Bwf0);w-9h+JpjiP z&Ga|!P#lDNQ>_ZQmkLq1)z-~Ba?*+0(QTTyYnGLyMr-hj-ktd5C5j3fbC`VS=E;Ry zcdQvTm~6f?S*sFitx)!E|0ar0Z9Rs|5Tk_we=mL!YjBbiWp#U%X=m40k%aNl7>>|N z4C(^3+yQ&F(y%5sEd)k3*2NU0n9Y=+VyDhCBaG4YCKC*Ax3a0u9N~q1a3f=#Qn~9Jz4Q` zJkvzEkarvh{?eEZEooC-vb@#7GcCSd*A_0HDk2Rek0j2x%1$XgD zS4@?;a^oZvyXl$7C-!3>zR!5O$HQYT8;F>(gFdONL*a2#upku z@an)}QmK-SKJ9CskBYd9m#R7zxzgvTlj{H(MDX&a?k74m4?<$lK|WqAXwN8O(Az1K z+LgN)S*$`xvLf{>D)bvdtvxV!@h+c7ST`#K{EI9mt3}cGm}mPY5V3OBN64+=MgCK| z#4V+8^XZ=?eq%blMI>I)HPUPDYmIB**0?kjQl&Fi{s#`zN&f}TAmQM%grmvy-uq;! zMPJyTO+KoQlY3Cu6d0@eY10lun5Z!Gj|3(3L(paY=mykL%FVFD80VvEZv$;z4#$f7 z^}|v%S0usLU*N>v@q(`=Ic7Nj7NHtjsz;8W4 zb`XkSkcBDvk(E5q$d0(^LBlU2l0S{?%`4!d|y%_hHA>>mWfO+if z5{a}^4ur5{#N)eRn3MF?_M42Vc8ldsqBNWu(qWZ#FHygw?Z(r6Ws;?giLqkoR(bD> z1D@~gCuV6@HXL!En1<3!K;_{yu{%idG*Bbml2!bQL!Q%t;jk1%0)(s4AH;b(^;R!F zi-a~F`a?|c8rlBK&yoq8Q3&Y}hHEdVx^yfOUxiWm3WXcSa9cpPMh)g-ckmVR_Qh$4 zO1?5?Y;spa=y>8V&S?&^R$6SI+EOhyYX+tb6o`xaQt)u;_T4Fj-+f}xgip-)>8g9r zhbLyLSyIeQMNd@k`ox%2c3K!81I23t)b_$4v!TLF&=c_FAf1B=x2+?2Y~(C|2rZ;L zI~z7!Y%DPlqkb&pF2U(dqnsj>f6Otu^o_AUS;0=i3ooNl=_@I;$}^0K=D9Ga->qTv z_69C6@d^1q^K8(P%Be_?qFHPs;MtK}*>C;Dc3q^!u5~vSx&$h_H~9>iKQebkN*p5% z*VEGDoA>FSXL?d<_4`6IMj#+Dn7B@Hapb$>X=U8`onyKcFaI=m@(HE9!y|!HU#3Cd zRq=}euASImhqw6lJhol8+=X$!;nP1UO|m+-tHW?=Nq*Z(Gq9FUxaWgOgVXJ&2U7jj zL-q;s5rE3iT4@lkJ2d)CG%y%)XvOSMU|a^i$sd5qlHrybU2CUn0cPIX3e;&v_pbsei7on}1Dw z)W4WHl2nJUXrM85_NNYw_J}&{RIvj%sy?kVZS2;OcVX1lAoiOG=3o|OqBAzSZ+KzT zpPiSxRDAwEMNUPjNB8&@@L5!7Z0;7h>JHTv$vvfMD&!o~C4XoI6YYN=3F2{a{#kli z7}WqMlgN){FiI-B8^g4yAfIE+_Wj1N&2*;l90o)_-yX@P?XM4Do6J3Q@#75qa~E zcwzs4@~u_`KHN%hO02{)-&-ffHHEIZ5My6 R*}bk0mub^kv5$=A>;ART)TPR@lJK;F!-Cb=_iWp4(}|1&0nOn zO(TbqA=Wm)XJ;Kg)#cmQ{trm(VN;Xc4Xg~HJzhRPeHAEWb8qhh$V5W^FHH4Mc-wyk z30|=agEBkE2)grU_QbHrR}!C|9y-)vsn}-pUc(*6Dx=?xJajAp?(ds4jUc@BJ_V4d z{w#-oZ;>kTkPia}8&@7$WD+FV9s?Blr_ZXOoA>XqQ{>)r51x5=OdXwkO*a@s8S^8Llw&-&jHSzjl{ zT_T?EwJ2?fvvHp4|BOC1{A#_T`)`=6r5fs1jWv>zb#@Mn{$f;(Tjre8LSSFm5AWI! zMp0*hObikEW5?&@SRWc%o~al)2hL%md&O2~*bM~xnj~PMxh83HLtCwFdvA_2s6o@n zsEsz8Bj1>)cEugoVbs+MNiYcq8bBNmUzR?*8<0h#}V} zR$}n5k7|${eC1tWtS@gB!`*FOEyh>?IIWpc`*>tt(N_9Y+IE`de5)c`uCmoDf%>*@j!#K5F?P-RwLz94SgwU4yAa<#uz0;s zf$T{Y^SpMxqxyJ;T!x=aVDkLR*+tqRISu>AK0Pi(Hy~~ptmpTbWD3b1a7&4E%vwdg ztc{5FpE$PiJl$SjkjL@qBRiN3tov#IPD*Y72D89bx8K|}IjS4h@CL5{h5L)<-r3t8 zUTAijyjC1OZP(orC?OQeSvrzFgbeb*Qqwhm(fb~|qhOgY7U8uVplUL`QJ?(w!p~KW z>}(+d-8!g@3c_gQ)sO52bB+V=kaEPmxL#3Rtl?s?Xdz*fnyL2bz-lf)gdxQyzh8S( zp1%0&UU`YI7b;VMC05mCC&jcEGr21PG?(6_=9`M7LCVE9=dyhr6^Q_ek?S*(N=T+R zt`{#d(}MoAjs3iyG<nu-hI$Q5Dj+l;et-VVcKX6p8ao5xe;1}!r9K19)k zsF*#?dwd097&GrbJ%O_2^W}#S)FI%lZfmKCN7s;)5*Dlz*DGy(l&Nw2l+D*;7C%^e zaIT1WADdqhX$!#Dm`cz z^6&3m&@f2#&cIkocu9zR;m|FVLjH4ZV;`ixVQ0+&qsfe5cX!u6-03?tZwW6-M|g9d z%dvV`tK*ZZH$S_d1gsdJxJT{Jg5B?z_I>v9Zy+>o=E)DG1QgaDrcWXv#UGe^9yhaVL8ZQu7VQ%~jDv~AMIUZo1}gYb3gFE(%b*CqdO zN&$8?#*6gd>{)4l+9SF}X_R2RV6m7@^=s2ipDD3u8(uAi^mv5Vv;Koq; zY;Uiv1WSoYi8T0-^LDrGE^{CYU)?>(*^&|9$}lN_qL)jn6d<%loHYR052yJ#K7 zyztT0^}y4e)O_1eu56fVR{bU1*R1tOf&)FTvW>*vTWy}>R^6L+_n01>{6=H^!Lkkd z@Xs}$y1{q{O%Wf7>o4tBWPi|y-`n?QJeXeUi9@jY47x}U{+(FU|2g8oHPHG($MK3} z^)z>1ouWQ0mif|OGk!@*#}25L18e4Os*4x|H@-0uoK71KS%XrV^FcGfjRA@7d6m36 zvEov-5-APqT+%GXPN_#=udqve#@wR%{G0pg)q}F_j)})k>P#agDY~!`qw<^A)G@1D z=tGVnwCs3sW>7N5mJTs>%bAF>oQ`HzvwbuPs*|obh5;XEOC!6w@Kjsc!;SIGvp1D0 zd~LhL4Fg8R#{+}DyBCgE@NaU9q0|~1OVsA?B@#ko+&IUxGWry79fcg;8XljYJXN4A zI((Ak(sB)=FWDQdPaPA){z@RD3ra7Vo{UUT#p0KaLPZ(X+sur?MDqmn`Dm`$(KWCn zo;w|FY#fJr*o#=jGp3LphEU6@dU@*eCZ}Z>70QBjqDYc;7rW%c9kP90G?6a!G)7o* z^6$?Hs%9^Q_U?n-#L5SEtG{9NUvuX-#`}J$LMpP9-11TdOCoY32m#bIX|BG-1(m|7 z&ppQy9@gnIz305muAJb;f1B}HWP7s4GPz_4$d!>HadlBEi|j-XLVfP69SA?NJk=H=$Ga;1gw>pE4t< z5r%of>#B9lsFYXw)O951Ud0#tUGFfTJvTP5)6WIGO(zb6Zl=^D+=wUFhygaLJC!t6+Cb=Qxc3GtlbEXu6WBM1;e7$ZS5))_3sD3m)oovkwHa+<;%p+nVu+uTj0zdk%M(Q{P970DSCG!`oSQWJ13O>3#OF3y)Q z*E6wW7z|s`Nq{MfPds_OAl7_C_VHwOvgu=fH(cpW13DNVPu~8_7P~?1^cBfP&f4Ba z4u?$~%MZW&&Pz^#%iB1BCMlhkWPg#pI2dbwTYf7}fP#+T`(3&y|72cKW^qTFd@9xI_DB*PT`wva<`>{-kMB&Sbl0FGCL@8uX$D28R$& zXic;M+H+wEtZJ8<3;;DyNiZyX04155n<%Cmx_l{;yO$1ZDv*RJs+HKVLC49* zo75${A_4w8ej9{{--fRWj0_w8IGJ=J-}Qp!Qh{$arD(dbW2~6fJ1tP25VHk&#*73L zCfb96UsbZ-?fZT!9^~pRU47_ehC@SiEUT!iF2hw%(;?#o{ zef_I4&{W+Qcr8-l@xyizA>f53LdA(_+U-P;7?GzY83i(LI_ z0lX&j#tWTp`f{dCxaVUhv9a0MEGJTKK}}ad+1VHKmUMG8sLODsp`?Md_(WrHsE$e7 z`a}_#o(DHJBU^9$6L0y@Mz6I(YLZwPWk_mFI@ern#)0r~WL`J^{nA%0Po66hn~Fad zVutPxly?>jsGaaXgEw2nFRDf5j%N!I<%uz#6 zM?4RcD`S_k$+4j{gAr8Z&^wFVmG=vCxZ`M;dhW%8g^#aDL?o^Y&Ka+Dy=|eNI@Le# zRHT~w4q&4GQ0gS^JnQ)oGcGJ(klLMN&O5-e!aI3H@c=LY5ZzY3p^f~c`RA6CKP%RT z?c?iDr-%(RxNwA-h1opJ+@D{y^f|P$#o_4=2Zr#2YavjK7lT=TTc0?QwgrX^kD(;o z#D{)1T3OgLu0BHgzO|ZgGw(+{hw{4=>4UD(K4F}glXyCj=#|fzC+YI6a%t0}08ufb z?pErlCgHRu7m~tK&$r1V4>C&i8GvDZADuN?hSmvG^=?igBAd(&>ppj#cC^mJVc{5y z4$~vxVCf3Ddefu%0G`YC9;t}*^pb3j+URq{3)>|C=6SNfkF4wF3Uo%KNq;t)H}RTj z6i$;c6oN^-SvPNvgNOWpPzQ^HaEJS9U~zXHbWZbzlh%vF1JCm`WGc>7&S0gW_l@L+ zia$ZIXsmG&T&w|yOyID5{KRS?jC~?W14BoMj5p_qMoG)+p+F*dc3&IxPDWM|u7dM| zsu88Tt`S%uJ}Xf;WnNTD*&t=`t!+e(YnadJ8+P68`=;w2)yW?7?@0kR#cqX!IR6BS zcc08!3gB=fbuRLtFGK3`d9PgD1Q&$SE9i0eukSZi^zDpYjK|00O?Mnn3^ge{rtwF- zS0wezN1?iaw4dA9{y}pct&ZPis~;y=IcVwaZ9|3J*92B|wGih5GL2|ftL*E36KcQ~ zy6v*J7}ab`FS0@wrv;O)g{Ax4Oq))@x^Smp6;2Q%cPhniwI4+fyQgYrjT}XNUd$cM zx|Sv84s9B;EcXs`m{csE*w<9`e0`GPx)@FA3=$jZ@Z#>BShA4#!Hrom+0k};@rd#c z8EjbwP>aQW5EBLVfQEWppC5K)%LY7_46CPp`U>c=meE=a1kd*J*8hTXJwGeu?E|87RSkjF3 z3StS!L&qW(IP#+4w&1j?m%z){lT`(;x_y}fQUDQ;rY<;z{mU6jC)b?k-s?mI{$aRi zA(pNxw+cifTUT8G5}gYBh?Jxv|B`qVpnJ&d+a$9=NZ>h2VImV4h0F#;rk__nIAo9Q zbw$TbrFzKPr|F=SL~n!akoBFAoB09ImUzu;HFZl1HrniqZgD%m_FV z%_oq?>&f8mnb*BeY??0;#|mp%(KQovsju@qJ$rbJQXa7Vta!ssOKU5#T7ND;nXEj< zh>$z1kk@vr>sV6w?5$HjH|y~@&g8dC!k`mfbB&piOGzdr?VxypBbxbcaV9LLBj=h3 z$T{wwuZ%34Rf;>QRPr?SE$MDm)tj~?x0P+C$-_^w1#aeK+9nv8=o2AC?8&aPkh{A~ z-4>6T;1FeV#xY4Bz;a$^`qC)5=+K;A+;7|?19xhiD-(UR+PFLBLv7`*fo+`)%8EWR zjAEetFIsy=j(Wq+IBc89vTM@%vWg$gYZfHOtnU|0cV>>N0Tgs(!1ot!&lYjh>gp4VHpFB`n-;Kwfa5N`{bobxaJXO) zUh0JLfw94&m?yL6(aD3NBFvB{Gg zn&WMTj0A5NLr=6bn^OI9>Yx0Aa2FEHg!@+tyIbd=!nB#GY7OzI zQcB5iUKMjK){5T-AtJ^m4AT)N4MMs{iBDJro(I}T_Cx*rWYsc8lMKl$L!N@Q2SYF@ z`7}c=?j}Jx%hHQpFYv`d60+Jrh&?)}Gr5WdnB~)c~JAGj`+iHMl$g zF#}VQk@#uheU#0*_91686mS_gAn*S>=0f^#;PL)K;v{{o9ORWvVQFNa;>37sLL#&F zZyE#XpWJ==N6m{jS*)y`L64so749k0?pusTt+8y^P}(zp>S;jmb@qBJcN(5@2iP8T zWPEF#n3H9&KR-;^blg_p+s~B#LAV&OGE@9p3+>iNsnXXqN5%g!#^&5TYD>#yUAJ0# zvB>JfL@rZ(;)U)4diB*t)%{ALf;`2y%YoRSJCIr0oa0-+ZPy?R7i5&{xPfP^9?K!Akai|?z5(j|osN(m*9Adt|p z&smY2OO*adh@X2V8eTyJ2uTB3q5GM6P38bVRIFpf{mDchK$_<1jz8 zMVP6jbC{>IhKtB8-Rs&Rnju&pEIPpPdI;7F=dT%}Bl1_}nn&e7(F!8h|H=~JsUvdx z&sMKnL+@U{K}!pu)|gpQ@aqvZjivCQ$AA z-$3N3H9r?uO_;vn-`YB=>4^Nzso>yX`Cuh^Z$CE$MGXy&KXm|saz`9;{-L-4#}GN3 zzv$mJ=%f9e{V+ZO7;oJ5KQ%f!c?SmQh#Xn^FD_tx{-O3i?5lsn2!;OVtXS-y9q?DR z{sA!bzuNmBD)zSw^+7AZ(Ei?me$MD4cF{kDeKha*p&bLf{Vct`z5d>dcip`My#3w1 zeXifJP`xf`g~7Ra2m4F?l^+V#1mXMx9C6NQkiL${kp_7T#zj-V`lyjXNrTm(}-n4#c8y0e_cu`Bz!}e=7TDC}4e#TGmJVVS>;u zhJN1I>wk4w6Z6k)x&2S|{Y}>8pWCAMPh}O3j8XV=VE@fP{~dJ{J%1Me5w=H_e*``n zcNFb@M`8VIlkM_fgO$zY^-=m9`!&H9&361BaN?+R;^fiu#K}`9|AbSgPyH26pFVTu z?3pvC&z(De{@l5X|2rHzapJ_Olc&y|K7H=eg>x4!UAcS&SFZe(>2H4*|E2c7%l)JF z>optu*<-24txp_dXFJY*>;(I&4{#IYmzNB*BYed^5F6UUF8JHnk{JEHxA z!glP)=F?|Ro&AlC?ewuD%K7tWPMWK}JtbAcrSO1^~r8?d5S5{F2FkFx9Id<&i$uk$v9`(qvQ%5Zx zJI;PXk>kW|bCHvdzA2SXoTvZD8vyFT9^_m2E1&Yib8!Pyc*H-wnGvm0B3SZnx7;~1 z%W^KL7TY=dYn<)ki6f`jPq4GyVq32>hikeR8~a|8N0p-G>%wk`R}aFky*Bui{#j^F z!({=YNST4>9c=kd*?(@jb3;?3Te^`1Qd|ZGKlMb&xwD`+00U670Kn)CJwVz;&&Qag z)%pe1x#guc1fOZ0YJ}Ih&UU6hA0*R$1k0Uq`Eba&D>QM%>P%)~Syd^dqHNGYkS@od z)^fP}Rx4A_uPbK+@$p6BuZ7E~^1ZWp>S2zjcr51h38A#aLzPnPU2M_3hB+%`gSv(> z_x`ox|D)2eZ~Cq-`pAqg?8o8PU&}~$uv>|2ho0nuwPglYQMncqYE^*eZ*-WiRNQ?A z^u%RuuJhfwCGVS1AT~55@_liN!&U`q@%xAMvAR!=A$Y3tOp)}qW9<{>c>iMq2jKXo zMW9OHvYOj_rcOfD10bl>_bsmn3M> zVVF>*ivq7~t(M9Q5^D-~VFSam&}7XQUwx zT4=qWcF~w%VLBHLbE)L?CTb2w4g;twllM>O*UiPB3MxhVAV{;+n0R^I<$w?iaD$>2 zY!0KQ7v8VN_Xtc}^K~jPEi4{M%``32M`hdKAr?US!OeIsP_2QdwsTLST=#lMFlED* z@YrR#y>RR)2$1D5ObccL8v*Lw%Y7j9o-d>t-^nffsWrytpejl zXujRcb)^wQCU4P~$>-mP$>;^1wQ~F}?(m7f!#cl^<{Db>$0S4#^S?tUN{dMif(V$Q zp~ajP%+yd@O+IB)k{ZC$ugJPQ{Zfu$S+q_mR!z&Z?$lXt7=HzKw`wswH!M!W=+41y zDJ(SaIdx`74*!hR4u}5J|0p8=4NmY)kMMN;s=Bc5y`B3%{@4z6xbt%{s`wY%yJsYC z`-A&`@LMT%XSc4{c3BxoZ_=7w7XMO*yPwa(n!xG z_o+z*t797iU%u>{&}vT*trCsAoQo`X@GMe;S+ACay|YR79}OCo45dkxIa;sp>5XX4 zAKBA!#)-uGA48IThIY-Z*ZY~P&ogDwIDxt8oo~ZuuD;@_WoiP<06OO;3O{^T z+^~oKVk@5c#kOQ8{P-6eZEIS+;QQORAC4@y!U=}H`jW%90DkyWMK=49{x{1`5m-aa zv(4okuCVEUR)w7ucEU=~zA+5k@sdyo&6eQUcEKyJ6KO3}S00vB5r6 zHR0{X@1uVGnf)DP;)~L5RLuP5(m<#~U1SErZ=T+oV*8XsX$=`e3;7c{r>uH57!Tm zq|CpIF0@Lhl@noAmn|L!Yq(OxnkREza?8zi_iD?ZRY}$U=;S5<76N@!CFIwo((WtL z(zpg*gRZBqJ1h&r(=^az zZf)flfb?iNEYZ7$3GJpPC@&AL;3hf@?RUr;w+&paWG<=ted^POB1wYWN~)DZ&9=~f zbF>V9GK$#fGIAe}63UW=!0$hIVfAPZ5r=+oWNDn&`;BSo`uHpZ9DdQS+AT|+PAn5_ z+S{tZ)~1f;SdQ?}8gK9J8{<}tfTmY%f!xw%v8Fn>zSUT5=rm&-p7H=aJj9HWsc(xn zw&sxwL=F3&-L61<)|+p;aKT;TcSPyVD8F>6f?<6?b4`%4ljd2MMKVYHbH%0)suuLQ~ya#>W&$8I9#n zHv6$)9|EqQ>I%lkNFYb9it?h9pom1$0fMuy)+G#_8yWtKB${YI2Ny( z6Fud3)%Ukaup?d*3N-w(<8Ze&ZehWoLqQSBREqDV$@sj*w4|y)oF8@-6TKU@F35!S zg!)DMWqRn!!TmNm?FzTQ_6H$0@a<7aAgVo-;HU_cQRcC8zMU{vH7winPK|VTuH^*; zHslEj9ON*Q0?T!OvkMPCOH|7=ueD)@VkfE**-EkvQsQN$@0|&9Ebwo=EiV?(eGG{I z^`#N?SVS=oNqNBMs*Uwe#L|uSP7%a>l7%6z=W26~RIr%}29Xd6?a2K>z^5FOBq(6= zE;2^$WF>kBPZ);xDk&9baG#T8YLu2?s_@M6tO8<5=Id0F42o7CI(BzzPD9<t z>w5CE%7?D7xnE#f3=Dzi`T zFB30t8by08sE0Rp_Z&RHkW;ILgdg!Yph{?dC@Vi4SC+a>VgjtiskZZc2T7|~K-_C6 z4SsV*N=sOD*~_xxxp=orWMQ6JdMD6kjFsr?WQX7%G?hNkRS{@+<+lJ8GhY}5_rM=m zziJ?xm~vURqI?FqpN@A%Jv={YvS4$<$oGm^ILU(0GUk7E@yDpF^YdgGuS5oSu<^hM z;09*rVMy2D7~L)FTz$`F>Dk_P2kr%|qxryW-Mu1KS|U07kv54`H8ULO5j$AEMxjR8 z`PzRsIg@+ECIxQqE5JeVb`uvmsjjr@QjIwlcZteGRlPd|ORwm!l%9>!CVs|KRmVk%HAdJ2vsTxTl_2dDiU}*-T#yVsv3s1jd0b^*}z|>7T|O)HhC} zq5*P==b9DFzj^;+GmK~roQkq)DqnwpyJ^8d%1~}yhB80~dXzid{JjtQZ4pGlLHr64 zKtDbwWTsA+2NL#yMF(%F_I4#478Idzha;$RzXgZ<_1UW3_qDImBZ|Wx#Nc*`bI1YL zb}0*eYK`^@zS8y=UxCuwpL^mF--`j&h%KUyut=^>500Pf!#ldi#!5;C`~C^F;OS~1 zbei;9%f?*Qh??1vu7LO$#4a&^3NzAPGOCXqOFs5aTjbEsFM&LwMlCeIqnD#PsTX|U zTwDt$i@6o!qP2dp-2?gq$?MsBJ4E2eH}>} zyOmkSr4u-#JKB+rpTXy}dF7b1ixF#`OZMbvJiIfO9gdwl-16T&eEZsJFS+-}v+^d1 z&V|P!KQBF-X+QM&8|jwu_qSse`(XTQIgcX(6%UHujATI6Qb{m`#xR<30ns(en1 zjA{m&TvJ?eh^cLFl%pT}y{&;Ngh@wtP4nzQE)|0(IemCpZ3@BL4v|Igg@ z`v0Z(i;j86Wa=2!o3qL*;WH3Y`GoO{?aj8#Qda)XVQ<-baBt25WKI9@d&B%z%g8gk zYu{f-9yWxV?uzbt_eRDoJo$HoYXwox>sGR0>M(Rej6OR5TcK6o3VGh(DP7J^B_l;L z@q$fIrb%N#R^ygUc(3n51LfTTYOBXT_+o#Bsx;7pZW$DOsra@1w9aa*uF4-fS_Yq9 z;uqb}>$euKO!eeSxL-~PTmILD*#G6yvG(tW8*{oPiE|D@OVzI~tmwLg^5SmYwBOX; z5j?dqH(f%Qv%WkKp-@<#{{Ol~&Slh9>i5QhAjNeZUb*qZYZAWl0RW|9^T(6WBg58;cco#tVFJ> z#`9d?v!fQ^OKtds#>}*pQ#^wh>r(skQ%pd{)w=cu4MeswWAI7W`Lur-n6pyV6?O#r zN+y$Poe-OBh3_d(-=t#m28{yn@MXcT&7??O`s8L35V=JlUt_z_VZsGYRL z$1Hex$a;{El8UC6=6l$>7eM9w$IJ#YnGzvUA-(reY+ynBtw^?kA$`gWZh@Mh^bu( z1vytR$YApGD5Cln3VnR`Bm`WKeM`$_IXqS*;jkSeNHPexnG$Ep5uNQ)GEigh;x9tx zwS3#93jgB%bRnR_wUz_&Zk|fQch|FzxCfFklQ1qrLx*E=b#y|o3cQ6u;44KWEg5xO zw;3H5xkDPX$({r$+#%K=AmZ~zHZ{B8!MZ}p1fs*SSYM3z9)%|7Vgv+IOz8m;SIpHd z>;8+0A^2!ZYwK8=Py0T6M+Xh)x{P z>IU@AbWJg#=eA}u2b$rE0cvzv&l7eEQs5>1M?fKDbQQxqxY9iaXH<>*U{ZwlW<0prH9OFnx0!OM@AQyhn z03TkUT^fid!WinbOT}j!nz`0QzQUmr7Znq7i61Tv26M)`g(*kA0V`FSZ^J&Zd9 z0^_;h;MDfMfFkCdS_Re(CcTFGrJS?(vtW=0_6~{|S)!a+a1myX#6Z@p_?W}_w2$bT5Hn|U`0EmZ^p57AM6ifJ#u@6id>=i9b>*KEF4>-WgsVMJF*zqrFlP$%KW zi*D2{6d3S34GyN{_lenUZsZY{0Ne|vH?2Y~Lchtki=a7v>86=nJFptVzP5KalEC{_wamZ;_I;E`7d176u_Y@Nsv!0 zjBW+hOktl(3{+5qGnvdWicEy}M)yp!5oU#)>ER*Iq-WvU;e7Bt)gfQIxR&MJ%PR39;_M85IeaV%lfqhyFhTY<)aM=U#sM;302>j;8X4WgU+f7;QNv|XtoXF zJk4IRDgVXlfRM{$vN7f~A&GWqnQ1|5j1%q|e^(4I78H~nj>(9v50$1ZH;jX1xHs>D zzc~_%PfwA|cu+0$G4g1oQhaAhliRv->LEq~D@FXqRPiS|w-pO|G|TvWWXx7u z$Wjki9hq;kUiu}*>>TiM_;%H0*uC~UKU9CIW3RXf1uGzV@T{V2sg1C$cN;3pM!`Ij zmRRcN>MO~S5t}qS2YOYedpv~@1XCwbs4)2+?VnRm%OiAvP-Uz!`Q zdUK{Eut;7uWMkc-j9`-l+)QPB;p|sdLgRLJIKx&!78MdAvj)C05?wdU_wK=?eubqE z-h7|+z4^ax>EwKM0PTu)HToVr*!Nv}`cc7K__O{q{?|eAGm(JaPRCztH={Ofx3&Hf z;5_=56R9C9TMgNXsV0-yfgOZHu!DNS&%`q3F2KNsFE@54y%ct3uaq7keGTR*ym1zj zph%O2S=jXeURPe@xa6|s-&=3$!ST&nWaopn`lo9l-xua>N0XKyKudw~UVQCUmHR`g z&^TqTJf&vzR1yvQ3tWdYgjy)Fs~-m&`XYcRGr3|Xo9o$n#7A@x%q|esHG~;QKQC7c zVO~-nD5-}xqAa82ix|>n3iNriuxx*4$wenqu)1XsjH(@o1Zi4v7BIxhMYKpe57pss z#cw?wt-T^xSuO6X`tkXAj@{|@S?T${0)Ygi3BJ||Z12?H_rRdMQhPF0Ky1~~(143bxal&gMFBD-Gfl_%vV zY3QnWwzic;7B@$kr}-(*|D|J-zeNOLJ~VCzHE~^H`k@=o+^FjV?5vQBvg8m2pi)B@ z&_rIwT1LvHsqSv438E8i8-rNEk@V}Zb)7O{eIG>6zWL}auS6gtJCTMe)!ii2$NZ*p zjqZc!^EFbNE-$iE2Nmk`a62@L?Uy;L5rFA|-t|t292CV1kCd?lcqo}?TIBVrS-Yy& zy>Dp3QDuA`$#%rDSFjON*Mls=IjQk)?I&5@=uRGqtHUFQJgH6iUu+%qfFI@Sak*oM z7nt7)^`i>po@3WWKcK#L+#ubKSCwEep=KtHZvmu&D7Nm@pXPR+Ma=B1JpN-_7n7q+ zoxQAZ(UzaM*CG$W$n#bwtvAdC^U>_vP?kRhp0_zE!PNw!Sg!0s55&ilfmPJ@Hg8N& zz-V4g{x3F?p=jW=3pp!GD=4VWX^9&!W##j3a8aPpXWj+9UhaLx5Tc;iVb^Wm?9pIn zmSo1v+qos&l1~9-3pNT?zG6E6VvCGx_{vmsYAlK&X~_-<8GJkU_MMbqT1u9bRa-&) zsFcp*Zkv7f8eG_P)r||eXv@@+&hNuLKVE?;bDEj!`8mBx1m9J}&QS4{M`n=;HFQNC z#lvo$uu(xE1~Sx}${c!N!x3O3B?cbV^s&hpv%pHIZaWxKs8*~gp5nZrLSQu)(7!4_ zE8*r$1I60Dr(Pvy$(TXDI~g)^$DA}^<-%nq@Hq&Zl|rl;VzDshc^#8j7t#%Pq$NqL z2WHN9^`jdaB8>ySdN6F{;rU0I`QCoyti~scMEAAG#G~(v$U&$sr_slQ%bs@oEI9=s zt*2JSz*njpoSx?uW&1s2D)IxmG2>xr-pfON-rD z+EO3orDrRNGA}nb1?4MUT?A#i@ga+i)2ci?=30qsRb0_Eg?URRL($I}oDqpcvuug_!DR^~i*EHbX0N_n4wd(oxAdxhYi zm>uJP7#gzIQ?BYXCn84bj-JCdvwv~UMETG|FL<$_nT_+;aB){1nSF4`DFD|Bt~YDE zW}KoWM*%f>kc%( z7M3qE^zyensdw8@IPz{P0mUu%{K?ZX-~$l5jITS=-EQCe`|XMQ+uz|kPs@MaN;KYi z1cIQ>3)Xj z^F0i^o}LmBcj0}jWSCbACTG(NkHg=EJ|7`RRp|k(@2#1bW976o;$^M~5THIBvugl~ zxf!b`wC>sQxB?ns3t!(eb@_l#mA&ggPN%${^xONc%2Ao6MwdMS36boONXdaD*a(Ap zZ&--GE@wq0Ps~xUDKy=w44_0e*~(43?lATt5g5p@aGi&l zU98=uz}J6nudLc~uS5y~3e~d2oJl3#Pyk2`7U<`c8A?kQeJ>M|_KGN;Hk)eX4;L$C z`gO6B-@T2>5-+whSy50v9I(&1A%Anoh^vO!<|c?LB)E5!&) zC?`%OEwUoC;NZ-uMC&^Wq27UYR|Wy0IYKVqGdd|UH=1q4WjinDwAIdUzL>YvWTAXP z5V2JlsT3q$%O7tiB{n{2VwyG<8;O2^(pBxLY9YnPg~`SZGagagTejOr+sEOqqOuFP zv-^>5Cm4?t^0kDw`JCj0DwCL^nz*sj+7Au6hzsc1JEq2NerFq=sH6a@-t8rn45|uH zsz^nJ6J+%zjR7qx<6SJhs<_G53I*~QzN%LdZ*w3q?Kw4_3}kdnIx6PRO4^bZ21@4Z zFR-e;rb@zuLMypVnUQ|{zL#mzwuYrJM01;qQbPXD_7t~%ozu{g(*U<%y=H?!85~OH zS%~?v`r$;5Ur>Bi-%q%$PX=>r&=9(Iq|w;Doum_D?dd za8@p=VyT6ESgSC%N&b?aqiZct1s=%-h5^=7oyIj1gGlxBu>qMj_tR{lI+9<=`;Yg- zg2hY76)6_%odf(lSLe9j7QGn@!WSDwod_(AffY#R{Jx?N(F+9Xv>}67=S)>mmZcES zi_(F!psDZcBHpJ28mJ9pAh;29W8`ze@9|F#yANNwd@aoy-kN)gDqt{j;>|ji_zVlE z^sxGsE2?d3d=U9=M-+z}q1OSS6*sm(f{?oOY<{alp3g)5`Za2X<;OfG(%cs@(DPg!wCgxHT47%rLd~B4JMw zOr(~8(wj#3XDjFMfgclWi#{6?;8|6}Rv<%qT)TM)UAeckAyA}OL#O2Oqk2R#NJbaeJ(Y|{c(&l$#V zw$G%AT2e>2Y*KKs6Z(gExNYf3T9(+|`v3MZp2vi#R8ehv)g;1>_~kv5IzJU=s>$lD z0~Ttg;p=DsofUdv>L5_*hh~y~a2jvwat*ioFbcC>s{Hk`*uHu{UkY|(qHP)P86z(Z ziDvf9F+mpF-BK2n_vS1K%OaN5`AAF9vLl1N?DLa%>GPm>KiRM7LS3zT$l-~v7Dek@ zfZd+I*tjvR@R(`6N>tm+3UqlLL59hWZ>zz$cuT`0V$K`NqVu2Ww1^I zhL-syar(eUqof=L1^tj&rr+nktn1K|4SSg76CWR!Z`taH4f)XS(Q`6M^P%Xmy4T!p zQa5SZugaYCKiCO7NOeQTQ9;3!02VUMr_o4QqtBGHIR5cavCd`G)L>8Vqlk#e{wl_N zyJKA4+&P3&)qSJIAmsoJie)HN*44SR)85kZjztQYdU{SE3wttOEDsN)&1yY>2Yi<>GZ`Rm`B z;Izue^=RO%r0Sznw)0OvM1WM2gW?82u%MN$7_Z$0)tN*M4dpWHT1x7`%DZKHw#j5d z^9Y~0O*1ONk~5&NK!rCdcR94Se2lF7n z?-M{GhSM)@*CL_dLG6rnjtrt4o`1`6+f>KyAi>8WwI}}|hl)EAe0L&HW!uDe2Nv?*;z`iid$XH5R1P~DnURRc#n z%jF`cox5K-Vm8;)>8X1l2{5Slv`VM@YcRVcJ!xkyrrkjBl4tUjOYVbK%D&TcJY>(Z zT;;tE%T~8j(wV_U16vNi+WahW6=67r9(hNPaiQH!wOY>m zI@1+7ukrA=_gQ#Fp(h@W+&vag8x-G>)b?<)L$1vo)BxRmJ(C%6g1keAw&@AdOf&1$PMTqcQfiuivZ#FZ29_xXjuiB%) zN$bGm0!=5oQLeB2P;;XC%jK7w@5*V^Ip3zBb>JCvv&Vs1kNd>YMn(%>x$ zu>naRTtv8IIq>AX9Tk9`7@yeTZ~2pnlntJs`db>xUwt(|`@W`7tzq}_JYzC97cGh3 z$I(0?(%QfRD#voEs5|ilSmZgkaMdy*r6Jp{SF?hJ2bfrfJ#L6J%tXDF0|nY~d0tPZ zg+o@3qhLgOcY96wwg3?WDVcIF$syHq@;)+Y9}Mg?Tfc zQj)~BuF@dZz@oF3u+#c)zUe{8EJt0-)oBYoDt=9%fSRz^(0uio+mT!275_VEP||aO{=O9MKAA z@8GFR9o4n0fE}D=dJuj!4sTyhE3H16R@t5o*ZTC5uxOMLG`D+dbMEbpzkj9weS^2< z8zdvC_2<1Gll8Mfzb|*vem`9@FYecFYp(UAt}f`ZRbMoMnNaULD_9!Xt%m64hmpxu zzQ&Vb9(E1IzUOaiV{LPVp*1V5!BTQ8j)1bGtvQZ)UkN#))9cx7PfJPd!|A_gyn9!? zY&^qxw+QSJm<0v}WJZ2reHfskAii>vFk|{l#IV>NS-fc~!wa!x&XS}(M% zXR6qSmgjv7h1Sm7C#rGHZPmH3>^1Z;%Yk8qv|ZfeIsrzplXV#c6LdawM0L5MCd;SsrFjbg8knbW7QD z7t?srCsD_c|5`o~?MB<%sy@+>He%J;MByl(LvbS`0;%d!`N+UZoBO@I0Tys0A|y5a zJV~P|sgv6-qSVwdDb19svPCeA4t$whMjxVQ;JG|Zx8=+Y%3u{mq+J(yQHDysi7kcZYcCiAebOGJjPrqmT8GGuSw8ecA%8RS%#Stp#h_xUG7%^n%+hUuUTRoaE<5E5{)OoMZ?`?UswD+ z+6FwsiFLD@a<<{BMObB@0_#b>9&hUbajfK49debZ?gA$Qc=gBf0ypXL=P1hL4{?&IBSPq4Mz-Oz{(SQ69 zCzf_~lPkfalCus5s`UfjHGQAH@vmlumuJ?{CH!k4DDIjTqtphD~cGgCMb3ypn0;&v)z!% zYO&Nu-#QGY6wf&YSp8xXKGW5m+NQ|tS{qS$^qDIBCTgf>CT#I4EF z?vw@)^T*vW3@UP;gT(iR{RyQt-k@e1RuK#Ldrrm2HPcI5)(oZ!<`wI$B%H1mNw{T# zYGXBHasq!6vv@51aayYKFJhhr4yzLZRX9C+C6%Ds4?GR2)p9Y!^6}Po>4D;woJ0qd z6wGhb1}=b%PxFS99q|t zT-~52;Cs@AWfnCY{G3o&DJ!oC!%S1giv`^)0YTECz(R>QMItt#aE^yQ1BQQ-uecCA zNammMO%7r9vUblFb=+J7J&WLfk-ZlSyVq(7ey^1KyTxyV6@`q0$au zpLz|kx-a3&Ut@c1&2@`Z)`bl_T`izB(2Ed5FK6mw+2On*ejZYWK#`#ly)i&1`~h2RJT z#8h~}BW!&`M8{YU|8pWpwkhnAb2$-1wY;AbLX{tGiv7d3CE3{` zgEjV-)O2v7yz-(Twx!A!syAL(-t|2Xqg?xo4fv#s0p!8Au!3t%Hx&I*?HKH3Bsc0K zXeMwrNXNAG8kTw0R7u<`;+14UJI8RQ^jdZ$J!YKzvc|aq196>^x*&>wpe$MIjzMH0 z2+Bb($l*r^&$PfE^lZ2aZk{q-_5oPI%O2ObbXmG{qfBz$AKAj7cfW7ViXMuYM5zI- zgCOP(B31*X#%Q|_kM+LlT@V0aV8xfO2t0+LL5(*HKb#gPhI)26?Z}6{!8o>6mJ>rG z&Pg*cV*#`m->ydGM8CT67-}kEbV*u78hcS9EoQJRl7EnYX%~KW(Z1G8Ivn<8{ z1Up-~qa@{+<;YNU>8CSSW%Bg&ivc|Zm6$BdZ*~wMks;@zZ&F9k3;Rh)z=!cAG%R~M zw6^|~%hghlCE((}R`Y%hs-xBwEZX)ZIr%Fh-*1b}k7O*k)PI#d&j2zewD^2E(zo~P za-f*>v`cP#*cwvZES|WkT+lWHfy;h_4u6tlRfWm2SQoBXji?em!Jh``skO4oAp5V< z%&H&rzC7F6BR`n&%KdM4McypUxy>)g8^kTBa2H=y(S&Bn2VTM;hw$U1wYXRj0?@3vo zW$j;yi}c%;BvCWuXq>q05{ljc#o`8?|D8+KI*<$c+0NOL>dqh+)mkB&G4zb}MQsLF z%KkJfa@fd)lzjWdwWVo^=2jQi&BZ-B10EY^Bj8^y0$>&|@|1UGRSpAc;h)6b*4CQN z#A`~HB0BvCkWv;jgu*SJp{9S<(rd>0KvdJe*et)^!F?cpXovfz+ERZx{e@0$~+Y0LHH;AwFKrtJ# zAgAxO)|NxFWgjhN;LdlCna^}O%9o<+J16lEyq+WnzZn-%3B~smv08g%!P%ZCN^SZK z6-i#H^2Q}KKU^U3UGFcBN>uYI6@`v7Obp`DDmlGEejM}tdHjv%qN&n0&zy`u--MZ} z4-Zj8F5QIi@E@Hbw`|(FjX<+4oIcZoIf#C%Tje6RlXW$-RI~J}U<80C>`4O%9L$&6 zoYSIcJ62u{8k@6vcoD5O9dC<9u*$L9nASM(g;#({8ExNQ^=BfE>P3ES?*oSG8#xx| z*yrCqSzWjj+w2i4?bu!b!w4C1fR(%$fMtv#%|#eCQCTt@G&NOEhI>>Eq}g_SqL5`} z9xcyOg}4`SYSO-iJyP^-|Me&XasZF)(ra9YX11$f?lVI@7Gz!TTgiCAx=!~mw)97y z&S9DH-%Q);CaN;mZ*+^N(#K~Lsrww*Ponz@^ImS3I%R>egUB=sbF?sR=Id5*V>V-Z^%N)G*F%$w)gdji{Xm&M0`i8%LR!>W8t5ecrsvN>pWt9pdZv12|_q z8!GfyCLcXObR}{`Ihyet9S(f#aO_UNlf+S=FfAl*-GWM$0bL77NNCKTvaNJ1pw{?0 zbjegEcjpHV7zHbC<9AL=#dX8c{fltwD35EebnwXRyiPEuiAHGncAy|py5YIsnLoh~#nHG!47eB~bGmAp?Cbq1w;7YyY(ILL|;u30khPJ{Sm`le*D4Ky?< zae2U-+fKbZ=sP*u8MtKBvy-W9e$iS5b!<(*8Y`GKg(+6$JbE3S7Yzk4T#WMYui*Ml zz+Y^2ti&p8A&J(JrUlLv0F8GOT4NjY3Eqiny^WM1XNAyLaoZE>$|E)m8zi*bX;$J~ z>7}|FdGVUstMS+I75Omy_$$=R`o)S(kfEk;SX`B@yQ}v3iiaZsW=}d@Y}X#bM#WiG z4%5r}8wnUQ3(eNHw#*LvZm*_?ua;GQyx!Nt(-wW^MMVU&Kl=G14q~?@UL!M=hiS&9 z5o3O~k*rZirl9}bgxDUhX?&%6%8Tsm1t>cI_foLfP1q$5xtQ4md`@`r*c5L^DRM0S z3b`z)v+MKO_6D1<3V)l#(uGOks53U*JZg%Sy@;`W=hmv~$kcK3d`RU}msLbjZ;omr z2x#SDl7Nw{n=w6*Y={&qOcNpl7e=Ji$Mff(H-&HG3tyU@V-L=>5>zW)Xm##~lnTjtec@NlYCUAdi9-1BV}TyG+GO6vg)7 zK{}T{EY}A|AjPQI!W3h|mPD-8oHjMw4dltu^TZ29=~DEQ+%zFceL?v?h|Ukl43wvO zV8uPnJUx{}M9x|$oxWhXD~t@rN`1txCX=iRqEpE{LnNtFYGm_HZs{^_{Ab+@kkl(o zbPjr~L+b<|iKF;zCZ(QFl$C!C87{7Wcs}~^Ws8$Yd={z%Y-bjg2y<~$1lxqHg;&Q> zgN5LgLHS}UVs)Ie6tl+2RZ8i2h;#Nv2j6M6K!Qe^C9A!CsBj_0?QL8dC1F8_y+Te* zGvBkkhWiCEtgL=&or{=Xzy~*>s?&vPbr~n`cfanX^kaUhFkVlz2VA!oNxlm6O9ajB@kZ z!iz8S&(0TAu+y)bJ;Iz8$_Xecwt9baGF^$!T&~t8P>inrh^G((Gf7BzMCRogZ01{7 zGy+PS*HiHAkUzIpzV~$xL*7zELq&n5yeZQsH@e>8Y4gaz$`?t^k&kjv!x^+Wz^Jxs_a#-ve3(*mzp?N7Q)7>aJ}QUOXna@nYM- z0Xr_1<^+vOpR6_3u=kQ`+I@>vpfoX#32ID0gN8svuY|5X$3T zB7inbc0o^+iZJcyMvmi39O>gy)X!qU_6V$LRWQp(D# zzKcp|;od25DsmG!cSBl!sdY+(zg4FL$~rJ~Fz+U>>B^n1=gUD@`mMmZ0p4KgTg)Ox z$v&iQjlb(g4$(gz6D~advPA`@xRDi?Q3YUDWZWvLP92Kw2_+2E-5)($Q+O$8yg)wt zW`f(<-ek7m4?_r)i2J~YXjPs>OBv9|1EMTZ_#CI7_(lsdWF2?BJ#+3tlx&*ZgooA| ztg<%9pM82KhFzmnPS2MlT3BQ*6f>KG{gG+>iw#A`+}ga?NuM*Ecgh;3pwN6I*x@i3$}jG){_xNGCNwqBjmFJ*)>GmCmj!$CY3YaecZ zZ+RH(vkVJ&hMqd*SQo{b67r9Yy%=SmM@#J@4&pC=nW~OV6P_`*s-{ zakp3}S(HnoT04nVgFeqPCs1D3?>?u^jdZU~%qF&|IH3587))uw{1gC>ZLg+H3Tu;4 zv8`FbNqFBgV8wP{uy}7*eEIKihu1I9>m9a_8p=}2;YkFCSl@+gARMX$QpL4J1=w_W zi>#0pTTCDxZNgwO&M6A;;+%hNb*mk>eB1S*U)6%%1z5uL!YH+b$@>M9{;tC?R~=rM z$z+$Zg1uOtkW0Mj5Zf$12?4fUF;rs?ziXw}{c~*WOU=fXLNH;oawZ~6&M}zr&#_!E zLVr5{c7R*|fe4OhLw(z>`hD&D%J#=mNza{}j#Xm_M;ZYUlEU(ZDu=e(px(06=Y1(n z7&|G#QcqCXmj?~ZFz$$xc$_d(IR?cWZfQj&XE=g%pkDnfT$?_>2$(%pbxSvk;1&iv zKqpzgchzp3A10&xGhnPiY$rK~(k6gAjJTg;-k_`*I>Wqe3^FdT6!EwN?Sa)-vdCK# z>0$HWl9*ii8M$G<0TvTSb_@6nj-Jo_6!hgyQ0!r3T#;9`8~q_vL_?>q|<~L$q`O=h%aIjl6Hu*cawo(_so{+AygpHw3#CMjTN0w;<=0 zv*88R&`1=4vU&P!q_nQ;WY|f34n(6kR)+*~Lj~m;M;B;p!~OdgHG#Ss-^%DkS`Jbv zvqV%>Ss}pGOahs&y{6{j-(xUyYC51s zk+vZy=dX*T7sgXI)mp`gYBoEx#L|K8b=F?74@!%eE@TN7vZ^H~VLMBIYa&BF+dBtq zz5r{3MxM#|Zh7caUHS{EBAnlmnP$bWQ#MR(wCP%=th^k*k@5XF9+x*OVd1P?UsKaE zvD(fkcB<~Iq|OnkFb+T|*c$kaGrXgb79vTq-TREXy!v=kY+*G?#JAl1mf2((k>NxY z^VW!j2K=F|F4EdGyu$Kd*-#vwsa)fSWJcK1gzQltCjU9M4Kp8U5(W`x{W(~spX=W2 z({$JfA$W+_>`1W!(ropa|0rHg{mHN@rh59= zUJ7iz@AJd=Mf%#|KDfwxaL~9gf^L&j=1^)(AI1|nH(^B;vLC zKzQ*B<>%VAHA_CX&haN4H3!^xY+*c zZ8&ZmX59cse89{k+VdL5>SOCt{2iaE<&+N!?VfIlbe7`Y@~{FdINGNwGLq)O*8Nq3 zhS=K-f__FgD8V*15`G@UMXXIZF&33h!@WnZNJp@=irX9}QF^u&qV{=doXV)yDcOat zr-k*)lJc!S^n1Zm>1=-wm$v?_7d9@!d6ITkl*-h#kn7$3C3T8e!sgV-<|YfIY}Mcx z(%k{Bxc>L3A*V89&;QNSC5Dw_-mKWTeU;qmqJyc`8QlBbyphE4t;(Qq5AA33h>yKY z#uMSd8uuVo5}>7ZeO{}HJ~(CG74Rrgwz_bVKVcRL$3)&b|C;I>0dObIuym9_Y0&x8 zb#^bgiq$=ED_{7yE|?UH^`$!>XI^G4Zg=?YC7r2D`z{7e-f=Iz+Mf321whHv^Q%c% zn{3nAgdmk%sl)(W@>YW#nOE6J2H);bvf=>c_vWAf{XuTM^(D;)8C9k!p$u1xVRcFA z^f)spk_V3dt)aL-k;~U3{QY35>={?x*Wl}w`31F=L^uUG$4Gz)_Y495;vLLOY%DQANYfz&T~J z5n3Jw4kP60Fv)ALK7BxyW7mT2O}zJ*t5LE4W$8kpag%18R4#k2Ja)4g%i?>>2=+%* znZnIthH_MO?c0;W zf1DR#ir*ey%iFT$qM2X70Jq%Mf>i}^VQ_aKX01|7sL2M^?` z2eV)24^>#Clu5>z#l52nPMTKOAOt%vFXSy^I{2JP+w{zl8i=N-u2dxZCO_%&a3sVy zV8~6>@{F$5>q(M7S=`b5IoVVDckuwXUQGYImjljuQSj3FTLnJF%MB`Oh?6Q2d=mXS zyq`%pbiF>4gKSX~4EM^3v6W%27S|;thC@R=wqU|N$V3h)${YF7Hm>D6{*<-lYb@q0 z{nK%T^NfdRg>s(%&Ih4t->G1&3M}+YHV9D#oAq1?@hg|6xO%5e!wh4l4%M7ze;iaVNPE*>>!!_Dpe8 zY@Cem{mU-|4o*}KHN<&MB~Ev@?oC!r#ko?Nu0l+>I8cK;&I%_;th`%ru6z|{j`K`J zqoL?#beWIe_o>IVTN=enVHx4OrJ$@Mea7ohY~iG z3QlO5+%U!^fjWcL{V>A5!t}=)oa*|-B=?FdJjX^AFVXA0A)?X3#XtVqV*YWp{7rR> z+Dluz8#9@=Uw+6q7Yr5tRHtImp}J&7`LsPS(x=kcB+EK;0lCb0L1^HfeYtg@hSP)1s~1gs^PB#%|3RM^(?6rzgHhL5 zl#IZ?_xXFEz%Q3lZWU?RA5KOn5SAIqk{!3}a)l)*#<$H^K`4EZF%$D({}9LR(eRF* z60zC=4isarmU$wl(^KmgeSK0)u)3GiZXb6?EY;#$A{>lx8&})v%MHs+YFHIS!?7ed z14#|>=(Ooc^7Tu!N*AWNZ}2lE)uPK0-nHUpw~b9y#tJZ`aoVF;*J5{04ArxA?68uL z)0clgsZTQH?sU+RhY<(Do-j6y>nalK?aC`|NLC7r%(K}EtCH*Mv>NCTejHIyyHBlJNFPiCAiF2$%=6$*X=yRdi}fIXo(-`yvesc4YvDwMKevLsP0YJjG7r-Y zodo4_Mkaw)Po`VtJZ(P&s-M1Wm(m5-3zZ#fJn8tjex8wE1-~?p>vVmy8D0VG4*TaALqvE4 zOfshCTs|qQPj>NIc#&R~Sy?z4teQcan=2cXtElb(YosP5K4^K`CHulky7aurk5#X{ zX?k4GQ2s$MKW0{w6qBAMKq_a=wN9eAkF1HD-9^XXGB9{<+{!W|#)`H#sAzwJleMtQ5y0^Op_Kl(SXNc}FS&a2d#B(2 z2Xt|ZLI2UwqZKIK^E_>^pzPVJj(<;eCkaHahFk5?bH>``x(F=!b+wU61VWMlFdd@J z)$LwXYEy#1>}%Xk@h`kkC)(48-dPaRGuAISry5safs3eO%Ln+86u)mXGJLTcz$J9* zqmVoA!c%)cto0%V{9n-=?HJ~ zILerA8o{05_?Vt7&%*{X!Nu>t`j3>VwGU$w?Op|+r5%99JIlM#arpw#L)@%KE}e>M zi>Y@R242TZ!Q;IrZf zlacn-_ZT$dkIirig%=VWKN7EDt|BD#-iCYvzHGzoL(|&|t)P}-kMgr-#{X(RZE+kp zD$5KbD0_0r5C0|^wsU1Vs1wf#FxdOf;eno3-;ZPObadI%Wp(kI5OJ8s9IX-pyVr8+ z^QJrljmdQ{oz#o(sF4P?S5IGR+%(avg+be6j}Dp5^+}}D!RCekKJ>0^woAK1cn~=V z(ILs@y^J(bLpo2FCQ6imbo!#s(_=s3T088D>|E(r0>S7mei>>LQ#?XYx}R2a2x=B} zLAM~?2lKxVOpdA^Doj?tz%-wJkYnl=YL!?TY*RL6_v8c5WBdm3rMkjXDieujE*ex7 zu^)S7^NNQTQhNOoqc~S`9uwELC%7yxe!VcO^58{^dgv|HxrtDd*h8WAWD(=(v!AbG z?wcelzl>8q|B!%`NVuG#iB5){k_%izKX+FebokPRE-ZLw2df_ZtMfE$rR9n=SmXIn zxtnJB;xtong1MI)NOq zl;IIG@MI?iVLnY&8;61wpHj zeoqNco1{^|swPf0*6j$dQWsf7~j9&3moUe{uejcWgVbo9Y?5> zuK?@yMh;O9N+sup;QXdSd7E(I8a)E`G}d&us(Bu0T*Xg|qCEYQ!BcV^Lvo2NDan$K zE+7>JplecL5jZMs?Uwoua}$p~Kg2kf8h!qz!-6Oww~SrB+vL}XVQ4MEoCg|rP+}eC z@W@>b(AtI6m8Y)G1k4q;YYoEJed$F#>GI1`S~eU(|2d!Y!ND3<<&?AlzlXvZik+&~ zaT-NbChrE&_p1VJ-aeLWgh!8KoGeXeQ1+VFf0}dC<4r~z5zcqczaAvBO3M4g1qUZA zlV;ydPi0~_)xL=Zv<-&uY%U@?_Uq^71uZ2ckKP?{po)5G9tG<}nRm=9OKP`k({~Qy zHF&jp3I1bTi>T!&YG+iV-nSKQ2r5L@+8=wwl#i{QyKGXj|2V?vMyh6VZ7+q(f)y+? zPay^kIbIl2etyl(^}zIMI7>&qvZY4%N=+@{m#wPS1@$imWFZNiWMaA4zKuizKGC$z z>z+v*p)lk;%9m5DdtD}$gmWoK;~kS5R^(7hN@LPs=@)a2!ckIzj4jf=2N9*J5? zL3DzbXn%2DUaj>x+e$z*>ddZBko4Wu_&VTZJA$xi5fQy*tY3QXa4t z-$*UiP5ZJz5^s9YMj?TV7j65MvIoqHE03uED3}U%JpkKGAoSh1m%Fn1$z&nh48oFs zm<7Z}FrfMx=JMxN`o#BA)+5GUsIdh?0kM~f8;Q0dlf5)|x_7>lNKu7E{)~{2I=x0) zV7?~YS?LJ-uy+wZLtU7%>g6#fs~@@*b}ZG#x4Vo{hRWe0S@{$AnKh5p?q5?2rS`6a zAKN03aS;;)#X2^FfJ$ex3{_U$=x!@$Raz;6gQZ%nA?nUYSSw&VXSK&O4Vw1FV{wwf zHl+L!o$h>hgD!6dm6%f}^B#$LSlUl+0m24==zJ568Np{x7LHW!A5f;wv=?YwnHX`U zo;Jwmlfkl4KQve9N+C8Z_*|p$qSD+av8MrhUxOYI>k>5$taNqi%TK)$cA9dHmNtr& zAud$CVuD#iD_dTb(@dHVjjl+i7m;fKDkscFFT|8SQZwq|M?r^+yqQO(!paTK$iV>Q zYj9sE=MJG`&u`gI=CZb=&dP!KaNn+qzSDO(1~EffKyR02rPXB?TxlvlzQ%<46SgRG zQ@Ikl6d3fIu&v$ibyxC--OL#a*2*SU-|s~;>D*#u=xHdQPcPxZA)~-A=M^ZYYrk=C zCNLHTK2&sg3wv$~N`skhYwP3cTIX|hJt249Wab;o4tX<_btIy*@fRGT)zM%Itx-2+< z(M$YN0YswQeYoCe+h9(@!QAjPrxW%of0|s^s+JB2#h?C6=HC#|fM0>vV*HMlsrhRa^`oKP=_RVfjynA@$zr(qIeMU2wcNX`B^!Yrd37~X zb)-G!pJU!r;cM8gGD)*eL}w4evUa2j9jDPn_y6bEJhgm;nQv-vvCE-G#hXsG4Ma}# z4eZQ)f@}20cX@j+=&%dL0nbm_Gn=c}t2c^^SCtmRrfd&w;^k|aAu@{T8zyGy3Jm2^ z@jankg}Ogi1B|x3(vwm3-Lkqxy3&DjGfc@#`MA6vP z*JNZF-Np9njAOc6q=Ta$Y$XxJMJzI+Pr62oh=bs3?_jPO2C-NaSD`qo*)h9Ae5jj$ zE+^6jBxT6V2IVs>W^_YIlsA9EZCeVLuY?HF4&A8(@{jx|ze}$4Z4A<++>^SPs!&D% zeB;8I+%GJUM$gB&D(2~NiHXuY8(Vq^r6@nj!M4Z2G}XpsDhzzBNqz?DtHDBD)SguC z1Z{0jGpXC!qp523Jp%QWdWi)66GEPb9U;3^%-Teg@W~{s_k?C;E(S~VeXJhfTD~t> zgP=RxGrHlGY_w)beisZYe8thb%&Z!{}qX-ga@-4Y@=cX zaT;6MPvSp`X7;jo#Iz25)x!}tt`Qq9^WqG(tlcce4WArIZzUu%x$0aMiSCz^gTcfb z4JN_CsR^+Iw2@jH=*@8dQIP#NpECKEopcv*_^Jyr&CX66o^BHrTf0iO0o8l}eMy*J zn)0!HQ0ZXzk$0o3^V&R>k>KqA+qvM)zKGs^%wvsmf3M2KCr=P(U~)bByH@bKy=ld6 zr&IlTpYv7WL<8N9x1<&1jzMPqs+Y>a#OOMP=ijjv|qk-_a`{v+V$R< zN5jy9=qXDpXGqH44D59NtAm5zmW8?yIvxb&TA8aRt8tE_`)=oS^c-Q%sj1=sP1ko~ z?@|8S>vOsBbR`Eu4Z6j_CR^0YhdUgi6-tox|0tdenz&zn9X}wW88r8r;GJ>yNOQlG#&kjZ1Y;v^J-ji5hF0^o)F ztf|bf5k16gg{4(s$&!luk-tsnBgwx@%b}bb64-}jy254+!|;r*VL|88fn>{?=rM~A33j;XKwem?n#?Z?F@sEIh`C@2S;w`q@b@O`CRqfZhxh$ zSdC7PrctJ&O+Rg_%yKoz7DdZxL3hthzN;X`OxjHfOWvGMq=VnNlwR|Fb92(I>|QU6 z+1YiiwZNI1fP7mX!kqZt$}~+CCpjn7BlGGJwVrT6cPph==JNZo>cg@c!;(lp-W1Hm z90!Q1gte+B2?`n$jb>1b;^;4qB$LdvR_?$op;$hsfqON-nkF$|Mtl$+jyZ2|e~w{95`5Zz|&bhcAzdB8o?PlXgkwZ#j4Bj4jKtjHz zmCZ3}R_2i&{y~0N0PjPhIan0Q6wRuEJLznsYJSeOHDd@A^_nR`r$U(aZ*F_ zOPO;Qi|*}=SpMywco6WOvkn?Zi$Dsti#Y3$XKvTCUeY{s1K?8CJA8sYPl=e8arJtOn* zwu(@lSwUy&)@>huK%|ZI?SGEFut`t=FgdM{<2&qXIAU_K*~gckDIaYUh?k=Mi}eD< z;k@z63dfS9NIii2=iA!sUZHMUVZFaaovft*(gB8S9=2i2%x^1|IgUOX?@*Xp7MBEH z33-0kJ_KJwK$hN@nTk06T)YKidG>n%J~cU!*+``t!5qE$QIxl(on5HG(mXa+&{HxZ^j=xGo zo>nxpeAL$%i1KxEEMM5sn4=@B2oOUw}{>)=6%&3#zXB$&Fw?9)}nAD7Uuj4&u5ypvQsmsa#I&} zk}t=ezZNM+#6ZdDELahq{jwQfZ#xPfOtxZVKnB)sq>3J2_<`ZqLp=vV=GY^KKYq@J z|5;T@qIxp_%*hZe=UWiu4m4FLg}G`*BlDOH4W-1_@m#RVnsCky!Du_!z=K+a?!h_2 zR0qw`F=vB<3Kik@rZM-RtKy20Mj_N_Dzc3#!qs?>PSa1m zdm(EX(>PQ;$kI?g^Q%R!I|hwFTI!~HTE2%P{0PHW>7QkW{|t9K2D)zl^v`3*;+oCMP%@NUh?MWN<{~f;aB@B0C=t{BvI=aJ zKn!bmDhU5LjdQqW_TR!#71@P|c9d8)pIpw*34H|TKXlGc6*kFtvWmd%oZFKDR<4y+ zH5MNBBq0eJmH!+YJrJjyIGW`c$RXlF?0xPA3V%t?sx>)Smdtv(M7XJSdv@pO1+AES-JF1(GQ5ZZ z0AZd+M#kBf&URW^mF$#7Mdj2;=ltJ4*ME!l=+ZJhXyj~y6({(a@tl?$B4=m!j`i0`cDd|bFv+b-r19+O zBhO8xyjPQ+umC|M_4;+0yrpFY1(L_zr%w@f*YC0J{pXDTW%V04*Z_ri*%WTD=$)f? zc#2+pMVU41pRbdIMN%{QhL#u(uDJkp)#a2`IfDPsF{<~B6-HTRj4>2Cxs(!nJSltH zoy)Dbnjiwc`++(kt(jk1Ag-^Do?9y|lgDRA#tpvbJmJ^BV}mNL1){n~L#$fO{kC6C z9C52M2qk}A<2s|TJ*Ou>?@wHW(m}%c`Y}yXsh)cfavsTCF}5uMFDSdIRb9q}7T8mF z0uvIg0Qze$<8fvhjenTFUByuP^(7{b8f!6wVV3USCbwnmRbP$h|JJb+?F{VGl#Iy`=dXo>srSum$zOhzM_SW{O31eL(-l<-7B*0_Vq~x=_cCqFf z;+q)j+QiLk=)7GuFbRXu_<#O$s<(XbKVU&gZ-xGSbbGg664^15{INJ%;fF;^wzW9*$>6#Vcn zUkA^}wpPX9uGF{}sHn9xlhj~JlUKIbJI^vxfv-gbiLq%0X!jFee~NV9X>zQurv#5Q zr-R4_N?z|2_deNA*iBg>aXSx#=Z+9Mi^yTHE4s4au+AqjeP_bwsE|>_RA4X+t-{&|cZy1fKaJu}l^pU+9xC=#{I+m~_F+kY#b*2-?Nr4cSd}MZOdSwC z9WPzJ3PvDg;O1UG1+tjL_xJp;Tfz_p5k&O2K_(tXT zzSOQJ^K4V;KZK3GdB@sR;Qfkp`}T**oOR|xhNwtK5p*nu{S7$lzcp>6lUB=PsFbxW zqen+aS{pr-6aeK@r+pU>j8MBs3R7vRni`f1ADA|YAdU=_wSG4?Msgg)W|=;)Qi)8p z@kdYzk0rfsl#_aTT}>=(e1LS{hWF($V#KVl)I!`&=!PSCG%5P@PuVB=^HEr`;sm*} zFbzgM)mv`ut1S=3RZsEu`Ex;cSQYpx{|Cx^dH?RM7fh=d?F*KpQ zh=cEbKPpmE602QdeB-vDbjU*k3nHaMz#t=%V6L3^6wMx`c!Evxru`f`nRe4L1USSr z%!>yGHu-E%`*TPhImxmwR6NYe9(S4m9|9*O7=?D~EP;o~I%ik>mlkzL^*21}LdP@M zB;+PSl)RI98XZa2yw3oQ^6h!}x9linGkc~-`6E*|NdeGt2k@|2UEX%a?rrspyzlwh z?<3W&4~s1*^+*44byepDvs+=cK{VVXRc zpkq_#cGLF9sZBg#xMYH3^ix*&i;6@E!iw^3g*xbI(`zu7EUw%Llb=G;XMQ!l7!Q0D zI96IyuNv)(Aw4ZwpO^(Fm(R__V#;drs>>i#rVUSiZ%RO^YD;>N1_j;vj6?`*y`++I zi#!u@&E4y@U-AbdcicH7fH#DYlUU$YV3Ov|D!@U_g-}C3R3`eP>;(Ha^6Mn3B4SHG zS8f=vE!e40l{={qro-Hqgkeqtx+=ŒRP8qez(+i^v%!6$F#-@QSsiZI$x2I|U3 zOYB=5Vn8>sXx836ZHpz5wexs~zm$VYuu(f0wX35qoVVNCXpkLAkTRMR&`*+hr7;YluSyEw$d^Dc+r3P&dw;=i5k9n&a~5A zg}wBzd2s%1(igH^e=^{@-#9^mUc!b3$o+F{aqBG5OL1+X2CT6%`hkPzR4Ip6Rr#ot zE?Rbi{&TBw>~`egqZ@PP&Aemj|C`JBfBx~`qYw5cTf-1nS{rry?mrgghqmviOg+BW zFcrL@b#}6?0in?PS}Nzrdi0^{*pu$7b;){G{Ze9k{r}_Fo%-(|49A|R2Y;CPpfqpb zKYL!46sP8xrU|hR*6?~-;?_TKHw&hX@iK}URN<-_x%zav)1GNiFH^6>{ndW2+=-dl zN`A59#TRdR{Qc?iJ(IAJ9)!F8iDfbKpBhT>`TN#|M({1gI%9RYVIZ@`xAIMD<7QHY zLin`lj3pg=HHck1j6c5gJH3N+)w^k6P(1$PWK}@^yR`Aei*e|$llam8+z>+ysi5Z3 zE;+=Z1Ie{3x&m(lnhFIPD_o&KLPO`{k58b6ij1a9&Z-)NCn*64-L(0)4v%^&;zpJo zL`WpmN2mT>mKqWRcW zI+Lbn`|-6&1znc-PCU?k;q}NT`JR9z$E)-k<)L%Esbr&MlOf#>E?$_fDYNvk&*f#t zm$=PguewQ=2zzkv(Nj(*D2QIhiN<8Q6V_B#i|$gN=WHZhabn>Ymmc=)U#R-|k$u&> zL2N{by2uMqO`-PaT{d(Xy40%uP=eAy9V4hTc?}HTF2!}hFEwC!-T67p8}iVqY?H{j zk&$5~do~jv?)C@h25>AHUZO?v-NqJ`)BGo5!=(0O-`be`G8Ta}(6J=$9Tk(9XV_&M zOtfY#nKPugUpWgn?ruWbP=f`;Dx5ayMDZ(kX}X&QEx}&(^#qOK>M-}k8D_&;%47Q_ zy{t2CF;T*TiufIM{<<@GD4Vhh;5<)^?3ay~9(8|eq@u;t6M)g9P>H%e~SY40YQqf%A z6JFlJcDqfmnWnwdyZ=jIq54Z+c=7;Hs&7PRaY<<`pDwL!XQ?){K&#Yr$6w8(EBirW zfT;w#>n-ZN*C#7SY$iyD{)B6q?@xTT9UwHQxocjtuJ-+ONF)M%Lo<@>ofGW9m z&AgZRX|TnHfYnX>-abGa0qPMMh=5Wkgb;S*ZC*iarMDupBF)oLwTng*E0ycUWH&M{ z|BuW2k%^#kqemO^YiNrao77g>KZ&xI&VD{}w%HeJ2mML;o<4;&CY=^BQ?N8$TH_^x z4)?57rk>GQ$6J zOwq!27vsNI%hawQLg01Ji}Gs6@da2=b>c+gN-MNMC-LUTv@J?T8R*hubP$cxN|(+>6sP`CST%Vd-wJKnAQH*@BIJBe*p=-PK&IN zvoQZE+@kHVn5QKq9V>mLtG&%ynnYYm%{y|vxO3}y_rH=}w-s)B=D9(IDT{79IR`?! zYq$M`C8;oZo=A9=;h^C~e&F^FCfd;ZJZpd+9jElxr-(T`HqQx`TiTGIQgDy2v_?Ce zI_fd_sy;q+pKgr`%y+6VwgCt_S zYMWPWqgq^GU`6Vd{6ZazH`qAJNyc`a^iELXQ zKli%YsP(_m{y}L0wUbSDH@0Do>z8s6@re?M2XcQm*cWcgkzP7|8j~#6Q2{glB&j8= zrq%#5T1UZ2d)(+aZRMpz;RROGl!8EoXSxO>Y;OPSx<=Gpn8OKUtQQC8KS$>n2$-Q! z44*dtu;yF|rxCHdL=O7dE!k(^(wuJJQcQSer|Whm^F=uiR6({%;&iz%`W{C zU9+yJuKX*CgN_t?w~i~K|Jt-})dHMHxiM_#yPG>W4vIU)wed>SalmOce6pmC#V7f} z`iUdl%KY)>DI@o}G&@bZz79JK4(lmlm3}6gk(A~mGrs+Ygdf?o3Ku{wT+GV^$Qb1~2)=A@HYXrfn%3lV+Zm3QMX90W4^8XNoqt-N+`bKZ z-FGf(4!9~e&rQe(xD%u93;|o@0qC{ly{ihBt@Nwd4c5MWHkTmL!l8MIb9R8GBGKq0 z)~lwdNPTi-n6eLcp2et`mps3gpGp02B_8h_ZwUIXMlFyG0U!5LjAWg0sHG>gdUm{b z`iV5HLl9t{K_6mm*WYK@g%)4WK6kdIHlwxX$bLCp;H7mms3f7h&2#6gM`soR*8@H0hUmFu&yJumHEEY2PxTl(N>4MM>q+ zj>no;h@Fj_mh)2^D(|n!fBawPjsMxme-$AKSL>{;D_A{ysy}36w?2CaQse^nQ``2E4yfdFQy8a~X{_@$dEcKqyn7+*#X}(_3dxQUX;E(Yy zdZX=alfL?S!FJEX7Ta!>j{I{>qp$Zu#Zqu-LOgHbk=ah^sl%?gC(fK-gsk+d_q)G1 z%U&h7e@$3)y0o7x`Rfh#$KWk3gTBGQ?n$Hzm1`)LPahu)@@@u1J~_0`LJ-#;v+9=!V++6UQD{W=v-kVeg3 z4W{(1@4e|!|MG0(Ad|G<_J25jYhn!|U+VcwUx{QXU%xvW9F=RkgmV4MiE8@iD#bfh zRALc~_ms3^4C&vUFO~k=ZAX=qGFa5d4&>jG&c9Cawp~a~q!u(5ZfL;Qct#`#0Pse* z>E9zD4O9baqx#)ectTm!yncz2Zojz zw}P;@u&;%lpzI5jCZo3rIV;E>degTo88-^(z{H zie8@&a5#Ym|8CH>xL`*&tIuZ!V#8G393_CisrYTN3zoZ?z=w-jMS%QlHvr-M|fXlgs zkzpZEQOmbhIJz1Jv#)9q-m0)Fi2dZ_XrwA}8 zXT*tE6k^8V&#)t#y4Okhy>2gUsYuLBxI%DJTEeSNhZ;mo-nto|Hyu??@<`JmF~e!< zS6~o3j02lKn8U7R2N`u2DY%}5KihT=(b<7pbi~z)L0A7~ z5Zz0n(dIwx*X?M5Y<-BVL65F~zn${?pqm9%bCXYkQr)6ySXAs++y`Y<^)$jkSj6vV zHJHh%w$0vQnL2}D$CT}9xim?N+yND4RGE4yvsV1-gZF}6X=M4&wYuIRC5=NzmY@6y z6xxaV;cd{=j=)L%fMV};t=y7EW5?(!PzFBC-Odo~e5bSFRMlX>`rm*}9-z4;V{Njx`vSt)ACXk31@Q)edZ8DSe%~XnJ6N zV*h?%Eon@_P5O+UZ410q6xVWv8V6$A3Cy62KFM`1N}31-Gs3{B z19fVi`plC2ji>u)nHvajS0dz(U>%d%HwMA$tZS_h64OU zNt36acm1!cJ8@4^&NSI9{(71?Qgf?tWjgrBtwqVBW+TE81zkT+C~$nAAO>o`e0$QV z{p%iBz&iQ+8EeeKuiRY!<U z>8J7x|2p9@jeJYeoD?A1bH{NI^)Ze_~)?KGUfa%R*z_|A27Lz76< z^9;q^)sJ&v1ugcl?-Lt6Rp|fh$^T!kr&=$6ctcXE{UEZ3xl@O$9t?qDh$&flflh6_ z+6liWsS9ro;Xuwrk;Om9Hnk2DeFdN6Y9^AEQfu_;+{36E*q~ z)%Y@l8}! z7$_awkSV!yL#A4(>NGMVipeS`FIzVZci{ukgcW+$ z$5<#%3A$QT9UJ2!){}JM)gqrXU7uh~d`T&~_w!$H*E^?I&HQ@gdG>@B>XgH!qC4;l z1o6VsdLM^@z6c9U9OO~e+0x>Pa?sl3+uegFU78j>gStWKPHsmI9H#d#V~)-}Vg)eR zw@xU5z59B0^kc8i*nZGneS5DABOpilj4ePYzdPK3CefqlVmy)CKZMIOl=*^EoTpG@ zIhy&MB^#B>=XV|+sw>rejM-V1;~zC(iDpNa9w(tU#*6HvHGVv_OK=q)@i#LqNDjWP z{}&6W_3I^BmCqu;5(xd+y5v%Sko5y+&BsYr{t9#VO3%=7nN(Zcb;g^H^8JiHX-tU^ z_C?ODv7J>kHSsa&qY|$kcoIK77*sii0M1Q7L~5dq#B~=`u2@R$>1H!xnQgk8h5EPb zaOSsLIu0u5>7wbG@)?9uVnRMI7tc#?Sgr^TW;D;&Y5bl3U~W+IW{VyMN!!fv+YTS}QBfmA1IKogcxh8~H$xgc~dv7|_JNi&dB)SQclk6z=DJ z{hP-!%?V%r0yJ)j9LE8JSa7uFLP7q%ZB*$iJhJ>qpp*~@`?m8SoCT=@H0Q$5PfahG zmXf(si}uszF?J>IzsszHjC}+LT zY4Oobq$6tr-Tpb7($yiX--m*FcmPB=B96BSs{9tG^3SoI`Ud``;zR~*&>jQ3%~!KL z=qQ-}h!<_2Jt#8x?eXoN*1asvqPV;#*q;LzBfgo$3S=wZws-KPC0u&4Z~pC6a56zE zaP|AGS<@A(cXEx^bjyeT9FvS=Ts^gQ?LV^S$;`zN#yRRU`R278yG}aoPHAyi7a&`y zDf;@Ijs(3|xv~^WLQyPJfmIFLR9Q*yuJJGgLV5N0c@r9y7J@QAUtsDBPEIQ?03tLa znz!ggmP%|L#*s)bUT&?f(a=mm%?s%p zaAs$$Rbtn5M$bXuTCT;hv9957zWs1yV%3&YMM=i^TbuPv(8OY79d0Q4dq8oUPxQ&k z+!^^BT`5L!CY@!)u4$d0=y?_TV>i8K)xlRrTwnbNBBnjIzBbhKLfr;=kwpxKTMg&o zlM@ve+5iRSl4*mHdJZJpdta}uqE728js%y{%JPdXpiMcza)RA2Bl5f_*Nd9)u@uXQYKOBE!+jIM!VT>X?#}-7Lq6LV>2GXH%465g_Q`eItVAb zSI!^HDb+k~wBODRpLD!h{Vr#yPp$E^B;(+4Dm}aqvZx zb+6RJ)X#w+oV#QsMN_uL*FF_z1kqwQcjR$t{()Zh#`#87_dD+hTt?IQQih0};Wzb2 zT6rHxuq#tOk57{lPI+D5dE_a_M+{ohawF*e)R?*4Naa*8J3C67*b*QzuY7*r5iLs` zbQNc9?-r)go9lDRagf{#4<>nD?J4DSKwGxSLxr&2PVDv=(m^wJQ^2?`IMoOG*qjCg z#PUVGHjVR_>T#f2l@jV?BcAIc;8=t)_kgEhxX8mIH)i|ra&u@OG1M+t6PO*Gt|=c& z`dy&oL$W{K{MZIvX6Ud%u%Z@cbP zw%oQG291@~z3R{b978Jd>$H)cUGAQ**u)bAD$`i;ELQQmr4&ca^0$SB&b}eb!VqV7 zvleF4Z0H)pc6_mxCWPn;f`PZU#$$u&~ZfO({QVx5s@7+ z-^K1QCyCGGWU4=-r61-Vk?XvpEn83oK^Y(oQ-@Pi=H6mpggt@~bFxb8da>s#5TsQp z2jeOOlHyr&#@VcHM17G*NAE=*=^H7Uf~QkJWyB7q4rYQmNo;k%5bKgFv8Sh|S2-kr z7XslLhvNoel|?0*s^Vgryo;*@M>Y!3=Dd6@Y|V%#y8@o(-IFg5D$lBBU;;x5^a`*E z%*Lt)miIkjXB-&aXs0FWauRB3nbtYttw|j$FPlg%V!^y68QCF=aLhNfXy;gL_(HGx zt-C2|G3<+PxYG82^Mwl{J3$knqzNYs*2pLnw!Eea9t^7(c-yEQ85BDwC@`l83f2|; zVZ;ul6JnvW&D5UKozQZk6trxph#wh*Y$$8^$>vLOX20?Y(aEp{jLan_@>?zy$*4TS z!EoZIHClN6+%*961oH%R0eJd(UqU(#Qb?e$=#DZsL{$Lz$JCuXi;6t#&m?3-q&04h z&RdIiIb$nwyC4EF4>I}0A4hlrp2^z`(524nkkDSYxJ65qJg3`0aU9V>J zE4#y2gmNS}Pe?xYd8{gX5rd&u(NlSelbO6OnMTW6VwI693DAyFbv?>HRv`(eE!c_Y z&1A`1OhtR*?VKR~kgn1Z6sR$>c61@=B!mBBT$gmxv}<#RpW-MWAtPrqBPsbMUH5k( z7`~KC77&#EWQeDPLNiAkP6biC^_^=YHj`K15yCL70-ah|i{X;aB@;cOa+w6w!i6!d znUJIRiv4 z6JHL6R~z^DA|I*0Y-fAb_2p!P!!QH$e^tmzaNR=n;iiMG5G?024^9Y_d`T7R_=TI< zQW+1=+?SA_;A1%`cK-N3dwZirb-Z?-!FWk^=%i zn#LM-eBOR=C84T*HbS(Zytc|TahdxH>ogIsQh2hRN0bH^N-I$IC=*}5lO8vnbOS4# zh&NEv&d0mHh8Yz@p+|`8vh}$8VyHYqk%YEtE|v0#+tB~KegX=Rnq{*~;WHADtKCw; zB>rfqPmYZU_4B$iQ%~*nI$c0SbN$g=)dlBrPab?gj-k-L=h{SO;xF|?@x}c4G|VmkDV0o&7@5*@pYR)F4cyl_4qXQI8nSZpZoRj(z-zP6 zxx3dJkKj-#c7_A-H>EI1Ux%lH;_0jC5_)Pv!92eW!iQ@yJPC*!H2!bui3@yCw7W-| z0e1!K;~l1wsOzNsNpn|Y^;?bQ_P$r`%ZkRc>V6_lJ`dVYv(7&3Q~m&f7AVMYAk_}W zG}Yl!56;86@L%*zSp6A0onP&1Zi_h?5kWJBeltIJgp}+}71TD63(mrP<*Ks1SSq&U zEC$-dby(y)KvyYF?i7|o32tU>kIqyKj*jg1;da7tB4?`1`HCoTsYM(t^4Qk+(WIpm zY`d|j3hvx%V7Y2eNECV3kN3s8=E=&g=mUV6)7xs#{Mbk1K+kdxhIAp(FIY925|)%n zBmwiRx|>-JFv*cw>mQ&Q>YiIy_mdy+%UruzJMWCD&TnE~9q_E&Kn>8nYOI&S_o;XC z(N(fZ-N$rEo?VUx|q=elRJ_9~u1p~u#1LSa@mzN^Q z>`EB^IBwZM#ZqTHWIa?VLC;pgek6B^uR)}h>6lvUOUR;So8d47J=9!mm7H?4o18#g zN#>(B*Ie}=xPBqrrKX;&voeadLkW^X`krt-ab|3KMWpZ)@mk`Uj}jWP%+S~6+63fu ztBV(f(i*L;Rqt3##oIYlz49B54P$0?IUU-LzNA`{(>62;SWb}dD-U3Ms(QwM{^PhP zX|H!FYAALGBCG_ZCWe! z$8kJNCwk8cu$j1V{(muU=+P5Z12#2p-Vdkt2)t?so5f+H&PY3iJ+$y5g>hYH@0yW< zBgV~XI5-P=NtN4rit&9js%^aV-=LJ}!NMXg$#_=?xO@suXXEW5wRwjK8(&|*bEN7kQF`uy8fudMdxk?}P0R*W;!Pzk2Ht zntHp1`Xi4yKfdm0uC4ZE>go3M7r!>t`;5@~+Fc=w1|B3zumzue`d;JmdF#qRH2m?8 zvw26pl(l}OnliE;Zl}duQgy9fQb~}Sjv^*){&LMvl=8SIQwWXwbX4 zi=s{|UG~fV_HUbA_D}xW@$FA{JJ#NO?VYFOyYfcAz8$((SYRN>V~MY_NXfUEf;^$q z03beO9wDvb#;Sk03-bC|k6C6=k8q$@h|pn(60Nv?^#RMl%lEW1qJy*~n9#6FV)d=as2aJG#vg z!(P{8xc#B}n1?v?i(DUXgNJcCGB6Zs;%(*JBcI zP@iA5g=t?>-5Y=h9Pq9@2W*`~rA+GVk`+N$s$iCmv<%B(exEC&4u8Vg)+poG#^HJ6 zDqNK~LO&*jAW54yVKCC_?e@Mcvn3)bdyh>A!2c|nVL{@XlsKnkWvb*hu{vHTD}I~3 z8>I2plT^jLTALd`@+?~yv{oZ`3<;bJm)|sj}u!_4JH(PO-e0b%C+>2Ji3vxj;Fz9V2 z_n2S(fBnZk{LjPxM-M9l%anpR6XtJX%gwq`BCLV+C>EYM>``r6fs{?Q!fie>f=u<@ zKhiQnJ;$=zWyb#r$yj$%O37=iNBwo$b2o)BNOVa>f0J6#h>lII1XOi?6O;H%9NrBQ z%C%i?-09HW`z^(xV_iI|?6afrT+X4H-7pD0xCzPy{4_cDHqv#>&Mw+kHArC15*l?w zMw4!0Vt>0of_Y?%BjX)!Lbo0m#=7dm$*s_fS#}DjwHrCpO$72+im3(ty5#*iG<^pgtmN18mh?4q8RbqsszEqc)__qK}*HQ{8@P=s=wzQ|=wr-ui-5jwi z|C_MD?T{S2pVy`d>zzuVrHU%ujCOHHVX-<}lmB{rwZ^PQL>Xpspr6bfWg|&Y)X26; z$O6S~L!yz<hvX>xv5l@S=*DH0#seH%f zKl{&T*v+6Y1-b-g_pRa}v7&aewvw<&Ivz`3`V$zD>)87b&3us$dZtDMIT&&xvkrY6O3AxnYn-1GX6 zm?d!&W%8Lp5IY4tw^I)us6nB;7=LQuFk?}pGZ?VIc1bm9xu=Gmtr2}#Kj~1Bx}a6Q z4noNV;qZdsaEQ1#@K(h8#!-j$_C&>9Y6{QYPVY!sB8f{f+J$wL!>w z-1U%`3mYJ$t*v1Hs0BP%iPOEx-674Su zU-ZH$`Z^}ZnMu*O7Z)8~jJw6MhvFB1J2$TTF6$9|X4&Lp-w0wy9BF5yv~%o?N-X{K z_VxH$=ZuYnjG-ZpD=x%TGw(R zKHE@<;0ZpD*%Mtbaap%KdvjXlapb&n_gk0$(S&at$I*+9rbwqgeB$1<_37COiWA-f z@cZv_37ELcbs^QRn2YG(DD()h7NO`IBdT^#i6qYdRTXhpJQn@2Y(e7(X%gN zG2x)Y7G|WQhJZf-^?ol&Q1U+G&OaOTjXJJZmlnub3;03p;G)O3P-4mFy^K9c0Q{Js zk0Uy2GgYhhDz5(HsQokHKRwcayOLX@!fG+`%EQBubw;(_j-1dk{K&jQ!D&ft4GoF9 z-vu@W;$brGDc8^v*~QZ!VlfU#aHf`r0wdu+g%gXMf)@&m9ZGqh<%-h< zYbpdSfF1Q7hAN+05qL);bLzrm6N(wW8qHU3>D3Nv&Uxr78ZZ|FP?EctGi}*L!(AZa z*Iw%sF}ReNm4UVuu8Rkp2FqiSJQ39-h9y7Iz~GRWWd1|Pa$99p^)x*M1EY~mZSCsj zuz}Q|{sLJ z%2%>3T`iop(*=6;)tC?;D^StrH`-b1D5>Tw9qy?4(n@o?zlzbCUCQV+EWd^>Vaz>Y z*Goz|p55vd1<|55jlIuBrFLc&Ay&JsBjk(R+uIvx1GNcl?#9df{HT-pi$H5vjE#Mo zEP#_Az|6`6P$|bC>)6Jy{`{bZ0q=+eWZDil7zulAve9J(-!j zns$qniyoczzF4{4y2Oz7`2G?~WGj)0IwEs9UiCi9`_}U)rO7xUy~PZ^ARX*;Xx?;8 z(5w#6aSpnof(aY`Ww`Toy_Q@&0w~)l&=xxSy*gkm=j{7olxotJeth_ARA!s*k<)>j z{i9s+hTLrYeTxCY^_?S!*{a6L-wH7{)AoqY3r$IaBw8guZRgw0Dq+d0C1H25APH}Z zY%Nsf#e~M`ib#m1ykY5t8;9{1Q+z!iQlJXrd5!_9;EaxEqUdSwcggvaknWlYy z5+!S=1$*MaSu5Cp=&T>z;8E)pvl)a3)oJBaGADc=NU}U04f-OQ2SBQ8=6A#tA5eBj zM+{jkS;b)n3ESo*eH?Dw%y8)ztl8v&+x;-doZs3@-~5t0t0cqZZ}x)ckc6W(S@*~Z zq+#D~8L9$-=Ix*yM$-7=)-xEil8>N1(pcZr8lU7F{~j&D!#3~zGQ&Z9SVK**FdC>? zuG5h+vIpz81!JdFvihTSU=xV>^?l>d2zhc8CcaQ^*9rBQMH+s@qChKbKD;FG6yqMLKZRavgIs~K&!sBH`JhE#o zHcR-?o7Uv^#;Uvwx#xiUU*W&hiqKhncF9dlaxHhud5BR5FyH}v$U3b@msE0*`U1 zje#v~9i5VSuV!ZzwD%@*+h*jqEU3;T$}YEdqs0JjMIm>_qj}YdD1wC&2G_Wx8!c&1 zH^zM;xJ+~4-Jts{!|EcvVV7HnmaOSi%(G=102_J+tkSx3E_F!-HUNp6UI9H?5g5zm z+2pQcI**FA2{y~U8L6>Tj2wy4GpjAh@?vjT|;nL+8A3VIY@==%cp zyE$uP2_2=eTul#b@jWlwt(-aBDti4wZ+c-)xZ$^>9)WqPtLikmN)^_|1WO{LA|a^{ zjD59EVTJ0GB0E_%9 zdB~wB#b*eVSE2=sr+02?nIBCYt*RZ}t40+Lj{&80^)dGzH;2`Pt(GqL@mH*g>zO}Z zwcX#_D+Q;%u;&yY@3Oz2;C!Mnl#8|1i~B%pl9VW!j9eRXEQ<5(s`YMO2uq4?@tagv z=TPpjTz6lRC!=X9S&c)YCNgsb)TSDTUJsXXfgJk-vsO2JYHK&`P8v6Os|IxBjs=HY z7ZDwmIzvkB>+{3UWat@~gt0REHGZeVWy2lerXw65Z;!=_sNYCU%~{-WsLwTg_VV9P zmH)#3|B)&E55>Q`e{_WSoEU0<A^joAzt9=|4|V;s5q~Xi|E$FRp8l`J?N5pAuP?VhB{r%*jn(qU z>i$=LxxM;k*j>h_5z%o@FH|0_y;IIz9&ocU?!w}Tai4K}sqa4iG|GS1lqM?5`^&oQ z_f}68DmT{i`Fd_DxxdH%%BK3%^TYLzcd|3;4c`B9O{Z^0sQJ;4`71m0a}TZzyBvpo zjiCCcGyb^meerXC#r9FskH`OmMg8eE{A)4_O(?1@OTihO?G~q+I*(vmSZN^27!O^eR{ssSkGzqjxJ{S-#Nj`MiF3KK}dbOrT z3mF=$x{oy0sJ4?_PrGaDPQ|Cyv)o=$UidDeyFxIL*-B}+FO==3(IUz_mIJ{CHc@1y$Pe)q=m zg^vqc@S^CoR8+gIL$xx>)ViV^8?Bvl{uA(apIa&hx>rC(EG^rX=@{+!bek_8dzgQS zzRflWZ*<-A@hlzd*KCMQc<$cJW3|*4+HaPSU7PLZ%m9)K2nEsbA%efKvTo+ZCkt2k zTFjp_YA?EoyFeXGtcv5blpSsCq13SUs7$v2iQ>knLyV< z^83O`7CC%5?e1DdY_`VuLC0YKhIqohtz@zIFh~*~hy-7J{JG`d=G~78vN_%Ryb;~q z=k$!_eTbdfC+*gX^yhqM(cD{O%R&^(71b5$?-n}+iy=y60h;&;Fv z90jn4m>uBmW+Zau=Sf~6yB!=^H66k*Y2!KmYhIGp(h-G-sZJ@K@_bhsRSXQv_*0Mq z1%5mkUNO@^N!JX|E{1gpb$8F)x!VgvXck5*lQ@eV*o$Z`o%Xeo-O3GMyYb{L4BAoC z1Y7~~Q}a!~TTtxkKIDw67A_zZ6bz>jC(-vkEv5X~!SFU_RnjJr@`9BcV8yV8SF(8Jgr>4DjF>ZKE>1lI0ONwRCCZAGB1 zexbexL~e;_0PGS^(qE^m(pZR&6=G>@)C5YLRB^%wLUsA(YI!+ zfBVD*C~Dq|G(lGKy6NB0&c~tzr8o(uJcX-0ARd;6TAK@_#NlNt;U$XYJ=WP(3*-ci zbtP980OY2VYE5UkJnh=1;ZnAQ_ws!y>Diq`VY#1~^$s(gi{0WA z!22rJNsYE1b%5-+Uk{mQGOtT+s@kdsAul3X*t`n?M-`7(fQ9r=K{I?K&Dwf)aL8`r zk430$^iX#K&!XPb@Zr3HJ^2hV4c|afe3@Q_(z8LCMKyS`gH~RRSa*{_h2Pr@kLE}` zcq!QY7`(M5^>cIThF^!3m05B5G>RC8_1$nFCQ26p3geex#!hFqOo74_;ODV)#FBJ} zdJOk?sTiu9B-xU)uvnd!MTgqncE7o_Eg;`pO5$(Rl8lbz|KdHu4Vo#C$P1G8?9|az zxTys?UeLO#)xB?g%hcku5+{AO*w{10o8gqdSnIzVoUFS6$_(m+#SGLFb#Ouw{ok(| z7eDXGMt=TUcV<1mJ7J)_JYXv-^cY(P!x6vKm~7?{JZO+7pfTV>sTkD{I8>_$aYC$U zGSTq!@Z*Zy7Yrg2EJcBppl39hSJg-49JC#h>*7FPP~(e*tl~(i0;fV8e$5@G%aVoi z0!te&nC0;bHDy2SSgKElWj2L>23~HLCiUf~|Tsf;lV9^d(}>C3%gNKBzF$ z+j8+Kx0$%2IkhVt-5+Ceq8qqp5Q5mQPUlFW1u2k1&dR(2t*xLLQhMfqzz4Y1mQpHI zZ9eEeUNBV;Yodif4PgZ*_jwK?FR5m**bbfiqR4!Lt_d&f4vm3oJYdbwMyI>KUB`jb zR>u*nT~glvwP)Hnj$$>Ww-F|pOAf>FY`K95^xHv8dinK+wS2zV6y!#w{hAJacUiiy z9UmyS-ATo|D=liA{Hh9)OGr{nV;0)aR!KEgYm9wLkM`q@7d}d+$$K#+HGKia-SR@W zfLcM254Ug+NNpnqjFM?n-anObVR03$J;I`cPIlGStV=#Omr8;KzVxbVqfd;ZW{APu zmHS)m6X0gE?R1QA_h7th-86MRQili162VJ`*eSW&891IKY{Kmf8zb*qvcGx>A(lIw z3aZ3ctW||8>jw_q?k4PkMjsW6CG1YeERZ1rb##4tA>wea_XW=(T|6y0mA8%nS`0(l z0d>ym;Td%;A~$v7;WnE%w)>?cBgX3S1?xK4%3*vKS-}&g)x(%eSja3lH!n!&yu}E%%Q`j4`b5`7|WSC4HWADILkP|8Wll$!^K_i@C3{etr<6^F6 zhHaH>U|wWq+3TzY|D3&msIaiF)zf!$CA-fC2^d7%)(iHe7>k2fY}++9Wa0^#eb*Z0&xw7*djt+HdXBP9|zYTgk$)CN-Q?f_;;##1sl?yk? z!ZuJ)iU&RvR(-hXHye8KHFBuJOj=9)GnQXH{wiILsjBmcb0PR?e2rp*SQqI5c^5Cr zJW?FkP)V|7>ZKd zZg(jYNLEQFa93rYuP9{Usa&Zhu98cJ{mHrNB5e=oMY!z^u>L`TX^7l&5iNmJHK{GwVC{J`e{$!sT~ES_y?PlJo%x!i+9xfT=dA!Kc&JLSp;ux zlo*;m4>WE^U+bJg1I4k%dvT{#lFi%%;`3NCj=wuB3@Pi}jU<4KaYULcy#J0%>w8I&5Ss{=wO~BQS|(?o0eAV^vWLF)NUo*Ia{(kVb3rS;T(v#Xu-9 zi#gP(e=?Y?5=f9s)_V0C^<*KOUSuNJhhvFr($0j z8*}r-4I-=x6yCRGH7KBpNY@5l1X#gDmypbqWs@B5y&RTvWEIC8Mo{f|N$wh41Y}r*>ltlva_Tjt_=&dKp3ZLs6 ziasC_sL!~oxlRnPT zZ~l!%{z{k0z!uuHkn&d3&8|OknL`W)bnIzO`xG3o3K& z{QX(eU)O;gSgY2@ZI3`R7>Fhkxm^9g%Xaom!Pi~LlOcOq^_JP-${4weNLrfIqeW}m zpHBr_HUkpE_=yZE3p`ny;waFthCeEeZh`)%v^8a(Z=>m}UbY1`&||mVuNik<=h7V% z-stNgab!4rQm#(l>e`4Emt`2V(kS?I*o;4I1|9QG~npRHO%1vP~j`ATZv-p}AI)nD{cCVB8XLm%VWFI9I{_XyDl!&-Hr=15tt#L&fSg z2%YQvR_UPtp`DOWX4<;>EoQ%+jOd~qr;~B0C?UW%@TYis$k*AfJfnCKU=9c%K-$*> zTr0HI0!fDQRaxP=46MCojsiT&s>Q!IJ9c!PhVTR2)HJ@1axxEUF51aw0T0@Am{I$T zamMN2Z?BamT0RV2s!XFs(q)5uf07K4>V5rj_|dF}&~3N5+7Cu-diGy-oH(34edtqe zZCFiNx)f^0x5<%Yi0P62uPX`Z;VH4D%Hug}?3R_90vweQI0j$vx64H#2?1|rf*Dy)% z)38f1O_GF#7&+bbi;A`=N#U?e`rvT@6l5g;!daWPC7hPVTQeK@wBvy2LV_{C@@dXDWQY}`Ht>O?J zXQ=c_xiu&J>LlvsOq}gqrnp-XeKn`r2T>yahr)~K2z~kS{C!4nV7^o6AI~lS|1m#g zrVNv(^r2kXC$uXgrlXT|AaVKlJ5{$^1wP-OmT}J~!Ld0X=^eTHnyx_uwtu*!dPwEP z;P*|gtn8BN;OC3KU0FQ0aulFOLhot|K zUM``B1nz&^d+W{D{@7(ea4vC(ODs9LWLMTCi$bKpvSG(|^EU6q=ycD*l(XBk$j)<9Pzu{xf0ch# zTqoQ+%^L3GjRYzIXI(TaG6XAB&kINMsywK?z7OeniRIN_Qho6>FuN}>>4o(dYqd>A z16*>-5L`S;vI4_c)))#I&0F0i?Q zfeUd6BRkxPrzEB4Fov!3?pq(74z^H0ZqOz}Bre;GU-Te`8-1$ibC?j+n2<_^r`g_i0?=8R|o8QM|Gcxzi2qyJYZ;Oocm`GOlYbsagW} z8Z0^vCQQ^em4ZWtTSDo}%NSUFEF`-$e+%VDRSsN_d!G{$5=SAm*yOZE*MdfNXdS1Y zUJwgqyu-3O!c2Dq4miZuU5xH6tEfns#FL^n1azj3XsX{mW4fez_f3kSvvX?hF=?f< zE#m~1=DSyuTsM`;Uz9|~QXIx$c}Z%uZF@?5(KGpPZcc2P=PILeJXTn_q~t&IlG;+G z*{789JBK5}OFG)Ay?cymCX&O}zz`D%ijq08c1gY{>DlZ9Tt^)D$=~PdCDm)jlPhm( zmbV<7I1{tgngw~<;>cJu)5h@QNkUO2;SQ(%ay&rEn~BNBa{AsNGHPBIIs8k?Cq4;? z>#eWb4|)}I>FEvkoxfz&FAyx&Cmx3u@OmSSXnR=Pu^|}C4>rjt&(UeWDmW<{`j(rx zUUX5lw>Iis5eR#<4|y;z|14D4;1m!F)O;VzQrthZ$PYu3K#`fru4<>=0j_`w*kss6 zB75Viu_O*t_b%Mvb)tTxMfoFG;cpase~yA*hVu{g-Am_`?MHnuHs%U;sGMQHyeuE> zT0rFvCr?Clto7`>!l%bq0%Gog5ZyD=H*e-V|Jv9D>=wt1We)50OR9^oUy8A_Q;HlU|H-kY(tzZ^X>EprMybU9rh}Tk zUT5u4jz_+ZpH3A^$xSW?4bKKwp30IGd3-;fab$1YojMnN>H7aBdwOm4wB`7z`Y@Y_ z%YG_)UbXu!C11&T-{9dj_0+Q!o^P@HKYsO(E_(V`L4V2UuW|I(6#4JCj68pX=Hu5) zW-zHKHg=_{&@Ep-kb?F|asj2L6#Kd^`bI9P&JI4o>6>cZ5NUo@9}vI4?`}4x1L5+< JqWH^+{|7DL-CY0x diff --git a/windows/deployment/images/volumeactivationforwindows81-08.jpg b/windows/deployment/images/volumeactivationforwindows81-08.jpg deleted file mode 100644 index eff421d6bb2366aba9c3e1de8ebc3c23bfd46efd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 53822 zcmeFZXIPU<*C>o#P;`SJf`C#2germ1!Hv`e0umrd-$(+4kkGs0Rw>e35;_PZ^njGm z!L1N_k{O`_s6qL zH*^BfPE1S?h&a* zX-9XgOn`%jjI8t>878&60Ui#H7?jWLhbU(>PF?U*(`&)oXr#KJ1sHY*=AnghLF)&3 zp-h8}%p8L-j><^EyBfFE0#pL99$1u*!|ed98_ruLKwa=}%vDa}e}ZKMZ~qO&2cs^i z`DdxOAHeS4)^hhk-3Cj`Njct;mA$Q?AT28oR#1?YybZb|3zE5W@>7tKl~(~PsDKo2 z|2+tvl;(wWQh{sh{=KY|l)B*GE9LL+FYPZU?e66)Bde^e{3j0(Na_Sb$~zF};}9T) z^A`FC2W^zMqZiu42knl#{U=9U>VhYd{#O;S9{*(fztq+LfCz*A?@_VXKNavd zw%$H))W78YUo!SK3-mzAz){}rzFv-~6Lg_Ji9J-byig84?p|i@?r#6k;(Zr)A9rsT zcaPgzrV6*kEYLWlyT3Q^Z}>2n3IylvQj!Pjf)xHitL^USi$&pl{y~fU7p?Yxr2W$rupTERYool-eki1_ zmpk_M->R&F{?D>#{zra)r$zo}S?>KuTA34JWd3Z}|DmD(0XngsKcoLN+mpmU4IhO& zv39Q$vp(Kpy7D(;WkUXO(tS=HGnhh|PX9BUIfR07cMfNIsGT_^qGIlI&~uR z`3vVR{=&p`{?zGH=b2f~p7~SylS=+soAYcJ*afa};JGf!ng|Y$a8eO|nu$Ync{3k^ z;th~cwa&fk77m_r!ZlATy|jE4;PU`;k%!N!OhZouI(6#oS!R}Vr_Y@|QOuwG*aT$R z&uE$?o^|kiIwS}`2fm*B29)&nnkfh8`Fjt&p3%1}ck-%)%x2}}FK8uKb9p~kIG$v> zeC9-Gwli!@cbQ)KIX4w>)-wXFQ)X=Jw5zgI-pZ9}2C3YD3hJA}w#gmWDKJ29NwZMV z#sIBr#y?;Q)gPm^g;HIi-L%_BCm7fikj8T1>UxtvqhzHjn`b!&2w z>V2cx|Mh3DFLxL2IyYfHoi`qP7$g?p?l&$~ni}xw$=c$^ldgXe-QS+sEVs6}vomwd zG}`?r=5)6`zqC4SWphYi8Ec5hWrQxBetuFI-(s3|sKh@*XK zf7R))cKXZq{_0PE`G~)K`TxQAq|4S@d-K}MUR;rb^;E-^hE(Z0^8=lx;a>U4rE{R) zUhJFfdIelKbs*xsF}*jnXw3^`VCo#Uj+qYUt9D!GH*zv(GGcx#38Orx=w%TNmvVAc$V5JUCi3Vn^326IZ{PU_f2|qY@W21 zG)&Lo%aV4mf!{!Xf90DA1Fn2)ceUroOb?e{*99B@^?=|E8nEltQ z=6{Hd8-9}St(;0xeT$)FtM=`(3NqADG;&okn^!!a zRZN4F>}t{p`D7ouVn|O!t0kP^eAQpM#D`aSHVQaKH2|rIZ9>AksRkKiT#LvMh*=6Y(-gj?#{G&*y9S@cX^d9gqSt&N+%&)S<7EB{}AcdT|(=J<1+0M>dGX9;Cv`=^D+8zv*471en zi;K$WU5OeaUD?O=rs`V9{u-7{gw8EV}4l%V}ON zD>jmai0W8aAn~^FO7l60{X^W|`SpecwT+nOagn_{5E6mI*{jr-W?;+7*)yX3X4+aD zqwr)v_J&i-MOs?Fdurxx>AHHL(ZC+Yu|7jhw#<*yt3mmag_aOVhdiWPPjR|t8k=NP`V^d(_c} zlv8EvyK4w3@{Q2q8aY)NDb!Mrocr{gKOpLtq-am`_H_$ALrya{YLQ~Rctv|W`+Us+u^TOYc%RIF%mp1|iiDjk;+ER)tm$oQj22+OF? zIx{gp?osj~unCAJ^sLce8tv$Aev{^!G-s5a$e+*UVr1-1bh{aC88BWN6|Ys$Q$pzNvTi-9Lgs^G zbwB9wxNuw5(b2OS0}dPVKBQ^8pSpe7q|^Vs1ssMaHah$p76^hvAv%ET^@JOcay ztFcNa^k{Q4`l^Hg=c1?I7@7NE4X!~{OWzT`*wn;(64Gq?I-jcbvE7d)hKO2tRnh3l zb9Y_q%5^p|6BK?Kz8}qbSup$L*BaI_jEpfdx6!^*7uK+tEyxjB?%STxYN5D`A-KD< z2RvbT-=|uYG6nlDJ8ITvDXf^ggc*D$=XO(>YW`nZg zG1D{CX)wQ*vQYJqkbI+;mQ-(2G{hvM?AiQfU>uPl#ok>v_JK!U*i#G-Zn_)X*Vo%+ zn(q~AjjJb3;*1m=u;^H`EQ+|0$oKk1+Va4yXE3o6AGiToycv3>1`Z*O@;`SlPUw4V zI)Cf;|KQL64raYSl`|4kxIKDnAF1a4DSP)v;$BY0-F^RKrscaoj|OEc7!~1G%Om$? zdkQ3G>o=B2s;RwJQ7|BgRGRbqu#L3T;)=_H6&x~d>no*98CFpSdHFVO)!jO^%15nt za-T2|XAvLSY1&;aV76M=Y7w_H+T4_!a=$`)`6|Dpb8)zO$Tku>+r&Jt7Y=8I0FrXl z&8qB5=Elu$-R^9L8OwGnte5|k)^e;m2*iD_0g*4hp}`YKVmP#N%;b2?^wC|-{l|r6;~$I<(>aG+$4rE4(_>GxSMGksR2+`Ry?*s%d$v<% zD^PUCb~WwL;V0f%uq2#;SdF3QL+g+kUhX&JyfFrmzS7AOmbLi+(LYFEmCxJ!?3&)Q z^_V4K%%9-f>VJ&B#>Gko%n>+HD?_%vd|_>l$_mo>=bSjDt@96Ff`A zsvf%hTM5Rd@3~7?*Xz_ctvR6`Vnh#cEC17VlnO*?e7DJJF*p6@$ZU#aQBMLvR_ZG2 z=$znH+^gjJv_}E!qNv{%QplxQi9;ht9arSjm?H=FeKgi}T}->&GC^{?R5{r&oU#O$ z9-ZQTWJge`ubCxd$D9u1{5X029mu0ADjnqnSLp?Yg{6b;m(k7j-8H9%XgRvr5F%>e z!lD2vD4}beqxSxe!rB}<-@sQKZjfwyF28ZHQ*K6VztoEH_|9001uKE%PGn?`-~@ytOiO zqxv!*imb})e!$hv+G=;wkj*@3$4S%#DSP|ZmI~s2+BtEs37aN*oG%c^eFq|_xr6Dl zDSVl>)!+?-f=l843^97__Pzyw`e^c%;lbWaXKuO)Ev!URX+4f;O17|5W$9)Fhg%{| zcDrjX2H%dB=J+C#ylagGt>4GKP4LX{mF@5N#VJ&hAt$_xd709<*zmoRpI}q!P6mX- z$)m0vtFFx?|Bd$x-wD!TylCgVX&cPn)EPIINGWG5Jv6K^0&@E9%@0I~oaueMq@tct zoG3+P_>Piml-AgnS(t?h*NbLlBXQg;N@kL8^9zTfX`I%FAm8W~7e67PP4(G+r{IC4 zfKq1?k*7(@r*e#HF+wR}9BB~Vvr81wBMHO{m@99-v6G>|LOv7a#jd2i@_OXkkx2+m zEGctrV0vH>~o~P2sbw7M6a!@z0@Olq@5(1+@p*2FF5er4X zaQA{z6yFz$QA+s*Q)%5}ri?^$W_ZQ5hJ6AWV74k@TM~2l1h*Z@B`Y)4F<&si_C_I) z+}wu}e^v9W&_RCAQLTuUD__WClCQlI0`(y@y>SZeQx_j6;wjQJ0|_W0?nipnj8%?K zK@B2lpC|(nC5vJkC%z6$J9sXbcRPhEUe5Cg#5e`3V+`IqK4^6 zUk8oV=Kl)6`ZqTp6a0kwwFBZUefU>@qy_8lu=y$S&wh8;YT3Wx%jc7@7MdEE$;j? zM{C*paCfqE*xx?vs=4=-{_U&Yz{ZTbW*Yu?E2PT)LjOxMe;L7F-QzD$@RyJL|7$pq z&C6PlkSHE+^c}sQR{nd3jQm6d-&qD4JSqhRLG@oyIit7J*QZV4VDa`kDc^1B8a zY&r?mz%Xg&ZL4n2C)Gm{3-b&l@DR zQ2($3V>QR&i-Gzq`pXDlhd;Hx`+z-~epfbFf^+~Aq^23x$&0irmx|%(URvi$`+2%q zgvt5& z#VLBq$>?r0v~P0_w_2!~-Y=|(=uL`KrLcc9o2AfR8G?_iAv|5wh2giF8ljHB2c%>hcoShwP`V0lzJt{OV*sQryQzB;-f8tW zrtWnzVm80EU|3t9MP>rH;Q?9FF4^C_oI7!iL|f2E7hSA zcAO!3&!m^I%^wi^>VI^Q57*Sve2)5S6jf{j9-#nBO12uFm-jHs99a-G@ws8G3n)yk z`L@&}8$lwOGW%n)eiLE$tKV|XrN&M%$1U*L)d{4vWsQ+`cKeI1O8xMuS0-I(SF~D> zEkF#Pr>+!#B>s*<`{o$=Gkv!F!^US;8_?U=rsf5MThzP-XV2P0t;^8(tocD2;ncc* zm37UFf~n^>MvQyzMGgZ%6S+1R8Gs6ZVHf+#SR=dpQ`L-*LEwZeG)#*8c68N)0x)P8 zV5gl`qa3|W%(SCn>+F-H--3SAs5Ad#(h86BHUJmZK-e3M6GCf7@U~lvoDsI;QzGLnD0jyorCa&eC!X$izi1?tC%^^0_@krR|p|_XpfVjlvOj(F) zZ7jnT1{POMp1ZT)9xcu8os35~U2FkS#L8NV5u6sYrS#r0#G;<7Bf&#f?b(;P%LtUc zxrH1j4zVA)Q`?uqi)V`e=L&jjsFV71hjSe<)D zJ}?@*(rCk|9-Ci%EeNO1KXv4>RwRkxe$`4yuHTcd`Q>B+`uPHHlvA3%XUfQs+|Y<_ z3T*UtLWS_4si4v~^t@*k4Y5A-cFT8Ut=Pb>v^)5V-8le)f!58Egnk{G8s)=i*EB`* z$9oCn1E;K2l@2&})-yZAXF3b&NH4rLczr{UnZz%i%e4JZuf>V7@K z0A;qIM>ey?yY%a35{KL4kU98al2M9;tLH^%G@j67wa`C(a#RiokTRm$_*lu8j+LZ> z6lqz2XY6=ex>^1YFq)A&d}-VOB30KbS#1c-`#JW^?k>p9$<{MX_>I7@XHD7EZ)u6Q zzg5e&T6Ji5ZG^AK{S~cSm#6gft^AwBT?Fu>ol76+$`97+_n#=s#dl##~1hzp=87 zg3U&i8u#ir0%V&H_^R|sgcr;Hxc~LAH@7C+@jlM@jy){O< ze(5Ru_RV^&CuYVG*D#R~mqAvOo#2s?u3Fb!zh6+bgk0-&ZGr-aFivw-jxRUjY~~?a zXcA~WR++BU`xN3aJUgoMmLhgwi4d0piw~7HD)dmvcS>!2tlYFho}0FlxmXmhH`+=F z8G?tDS;oHHt{3IIzPwyev$6a8xY;%UEa%8w!NQ^sl}V zsaj%~=Rr%KGIYNRE_}8tjZn>R|S|HU)v$muar*-@WXW|MwbM}Z^l3LD@jpcncr30kAhGe5V@R)|M^vqJR` zKta)DsfxLgtO{1*PHIT-btkJ(-dv?|b~11%pIYccsWxW`!oDF6rU90eSd zD;2-&@d<}?q`PeHloE3ZF)j)l3KQMon5F(DL|et}ZV3su^J=c=TNqd=K)9ee}IyI9e`$>5|`9Y&`NwstI>F5SdZ;!8jmS_7^&(|gbGV>*$ zp;2xc`g)oU6RrRb-E7O!$mtUu=&N0&o({$HQK3H`VO_@ zidiOMCzem@2-p+ZyS;I^JKQlQAQWv>jGTKV-*8eOZFhM=0<$*$&>>LVqKtpeJ_$}T~boh zC1O;dB2>cG9&k&@rIU3>eo?GP7Fti%E^6?UnMz)~%RTj==s5}<7-K&-I=Z3o9ZnGf zmz4)TVqou#IDhb&hQ|U$@S$aWUG=^T*QBOL#k!#|dh}tTxX;2bAFjdi`C>HjF$g@< z+-m`?&OwRT#LbWDC#nFZVddO{oWaEQ=&^K^jHctgz%Nq{%Z#CN;TYod?8DMVsfphQBlSAWO_=?$}0A1dTdvDbrq$8pcxns4l?3b zcgAwE%?~KN!=>Mx^~EVvW5uoRAKo+}#ot?ym7C5qr6R;Bh>`L~SKL&+`h$&!_Jg3pa*jcFI}?NW%@=d{aEbVWzBNmlMNr!xc6*05YyeMBSF+G8+G zx;PJObUE6Bm8(HZpz&*_sbEPcSHmikNub{>=Mno99?;Cv!C*!!0>lIL$Q&sIt1a zFc&8Z;H0en{30ba(dMWq=U;a1&5a(fmZDNBf?~C=gRr??Ql==F6;Uc^GB&Z~O~Ekg zoB%grO4vVwe_oErOxW2J#C>SCJNdS}A|)~5Lf9xAGRPT%99B$4@6i#kdV=jkZT65Q|qn1KKL^OsT0f_K63 zo9bAh_caEYgfh6>2b)R9FmV~ZWFOBZZLjyAquZxaEYsf3)}o=Y1qk#!q}UuUL9ALw zKAh+CG*aTbb?bXN5rrgBxV+0T{qzOWXJ~Rqvi(Akjf&L!qNh{In6+Y8*~ay$r|Bwv z&#FbOc+D<2OZOC~vMPK>KqKgLl*M16A8ed&S{KwopdT%m-6Y4V9n%Ux_@p8FP}@!R zw;MsOm|lPq6#Q5?Z~BW4*xHRoe=IRROTPRx<>0r;qj|Z8!HU_g#N;VUM88#$+xFRN5kaM2X{2N69pfGyNTrVogyJWWX zz2l+ALWaGLbF{TyQ;T2Ql~Ulk9w%szV1~Rz>dyn zMx*eAnk!(5(VYeDXp@0VKxguK4rkV}{`Ml`TIOy-vY?Da)NUr3(;Wf@!H1*7S!67Z znRso-8pnE>&0;d39i-yCWG_7Nbtm9)R616u?2E$lJJcZ9*ul()8T+|fMsSi8^}YbZ zD&LpZ9ar$a0-|ta-W)_px)+_0Da4V9Kq8BW(xZKj;vOLDB}Aw;0*WbNi1&)n4|J1~ zptYCTP5bT-V2BCMJxZdnX}KawWogr6%eiN@%Cn)ow8W;A^j2jj41aiCFli zt*DVep;|R}9y3kHb56D_ylNU1!iI4GIXUz0#ET#<-~FjHMpS8%Qr~6`pM+%xvqYPx z4vH$oAGIkog8R#yvv3;DlEm2o_`4L2P)d@k3LY6G8V2>W$=mKvhS=-ti8q%(YmU5J zo56loq8y8&e!$=!mn!M&A!a!u)nEL5ZJ@TCb}D1e1YHWLHHR?LzC5e;R;JLd{Ks|a zs(ozr=4g)iy0+DvBzluCaUmQ{WHkqb1AJ|}eyVfZJ zUxns{RrU*aMSU~tX^YsV8i_U3cP1`%&+TUsh|S9H4qoArKg5Q%>u$7hooPE;)Tr1D zCQFv-HT)Ef8K1Op4o(IuT0a+ABfOW7YbV7jL=AMzO!&ZR4fj4J^}NBU%~FilCcJS1 zRr1+t&EzeCgiVrQ&eDO$A6ejgd{JDAB#W9|EFbA} zg!ki$)+Czk49XX+BE`${JylF4^%Er4Ci=$yE@CP`D$_eIZIIOP3|rR^7z7M(Vv?1= zAEW{8MHnA5XP+4pxpel;*TBG(yFR%$rddov9(2QW>n7wgQb=1~WZ-wzhT0xA;*N~{ z#JKd^*8aMp`K}7o>U}5kk>M`5l^ChYz}cL0OQGv^x+@?(!-JtZ2r}*SHkxekRLuA^ zw_5D_Lmfht*56*do-M++itBtN%{%d!BE%q0=7o-~R$Fi~JDL5# z7&pUeTMZQ7^tRaRZG{=Oqz=AazD13Y76EG%dQ<_$^BTM*JC|~O;kP;a4&3-ED{)+! zW?ITcRi0Gg#QxeO%_`zpvPs`v2A=2W63Y)(Yd)Xk)v?3(=@Hsx`B8GwA<3mbOfZ+` z<9Ov8O6H6Z#Ei$Ce!72Thc^WWKiJ>B70tqu{rir^tM3X?O41lMs1Logb4FB{=j6kq zh{bJURQpTvxtlAQm^Wc4X_gLgLQCUZd2B=mAa#*U75A94j9n*@lF8kcJU6+h)_T!y zpKTX4M2gi}e)eClVkGyiqzs(~JlX9IPlvE)gop8yoG@Vi=EmzCPMC~3o16+!#coR# z51w~D_sR0QvY*+b7V~O)gt!xy-Ggq`ZFRn-|47K4_H*|8Iq_{!VDsk>`wEE(a8AQ9 z(`v}M9m7G_1V3YcFXI7?#ZRjQ!m{8zBGwVeUYv*v^)3Xtf9@UPRJXg zaBf3X#sCnA9RRRpAa$MF3cHJ@x@Pzhh9k(4%zQr**?udQb=fC8#D{l|%*k!9r#prI zk>+WCzxDIdl(MDWBu2KE`%1SKl7a0&u9G@3PkA#l4WRl-HtAo(FE{KLENpsW2t6`= zeG?4|_hb=3Q5ZzTYNJ&6k1E6N4$n)M8{=iFbozZJ!)VHE3ndb4cCo+)W4)nsLv)f7 zL9E7v)U5_6cPUz0)K$WxcuH~TIw{WDD)g?pQ}fiW+%our*x;p=VGh)dBAdw-I+1aeZu9`>o22T=$5ygXzffdAB>? zn-myO)^?Vh_lg$OA{t9SG(jA|0=B+27=Lgm^~PtKi{tU|{7Pj>Hkz;NW~D_(=gmQo zFAmnTLo#b{T9Q+}T0{Wk1wqmFW`*4N+L1YKPa4;i^mNk_Uz6R{U$X5CdVNb{78YUf zs8|Borxn~|FDG+1;Gp6Pr(}K6D8p=7njm3d)mZEC-fYHfF@um$TPO>uk5l>rNHA$~ za9waDM%JRZS#xybzSH{It>wn!&2Nc>+7v!0LUueBUf2dhhh~%g8a*uyqG3z!a=j}` zG)I~hqAHe?9SeR;ZOsJiMAB2bd!)`5o8S!rp>&m};tO2V0hJ8CNC)H-v?CQS=! zcWq?&Fx~ckUv6cm5Y-aEj(^K|?D-C&m`{n|okLr>CYu24YoyjCQWi0GLSN+DbXKiIF-J5b2<0Sd3>Y!YHqy$^s(pRV;qw*j7?tufb4 ziXm)WS(TaQPtv~JhcNx7UW-cDtkpvfVAxwV|0t|C3#58G>KQsa^rEA0lqt=;00@kY zl$)CHhrLw*?U@N|<(|CmqNzxH(SE^jd92xpt26Es2&1Yf{#cAOf}+Rd%@pfErBwNj zu1_4KISzXqJ#k0=w*P|mNrbYYDX$}wZOV!iSLF3sxW(OEAD>T3TMIdtT5gk{m7(OM zW`f81e08mr01nZvn4t!HiJOVc3!RteMfJyynSxfW@v(2| zhXFBd;U9WnRnPAE?qrAc$a`1YxlK)PjvQvR-s|d(v%y6be(rF1WPGJtB9jpYD^*~L zzumJm$z4xxAWGV17M1QIg7!k!l&=*Nn;X4iQ!;o|pM0I=H-A=oRN;_MXj%fASNwd` z9WoKzCzHZHTT{~1AuPS;D>^ls4ABAuj{3CM$*_i$jcz8cXu^dWP+1+N49wol_TiO#(g5s>u)-6_*YH`_`!>6c-I%;w(!O zFPT})43>>_*VAzjl&d2{dzi(s%YkoE<4JR4B=#)u%|}3ZzoSZDuVoa)yaQ6x2zG@^ zXFl*WIoUZV-15#gEFy;)vBx0C)MP#J1dPGREAuftESvi=0-f*xmFPTg$=Vm33Nd26 z0xtEf*-5BJ&*|joB@M3zf>;NHq&>xrnS~Z_yv*fo0&ogXTbomA9ZK@e$gvXcuLjfi zL^J52nZo&DqTz8_G6BPIV@_;zQkynKZ<=_CpdK|jMm573K4I!ywM0wTB$=%k>zjo~ zo3GdiSE(EBs|Q~0uuqM6jbC>hpnZ3%>%trrxYyq&x6Za5z&{;sYE+k~^{kD9DQQ~4 ziMl6C^d5+hlOm0gB;I>M5?4@PcOmpA@uovaQaVJ%D@IvbLQ0;Vgrl1KP*UCP;v$R) zKJr+17I)=BZYZm`$&iJSI2eHKNAz=2a6BxT5xgyogN6CsLLIxCSNUp^S>41+m+lly z!ASzRm*4UQO*|DlbBXC*iP6gg+!e~A&|da(0=+tJL|0o5E%y%{JvZBbA#~Ba@Ze_mdK17cDP0 zZItM+l%xb>qYIjDJ$B=*EnRimj}V5+OTn&1EhCVj6kR+i+D_=*tB(6U9#!x{dqDS#-5t4cTi#yH<{AkM2T>Ekeowwl; zT2O0OSj$>}R&Gv1xF&xj+Q`U0;kTZo7`baL9}7jqkC}Y1&Trv;J+3Pa76fs2W!v_~ zT1&K&ZMdWLZxNQ2PEC1A1zlY)lIGcGej`R)?2Fe@*MKi__B_kTM|(~$NHsh4o*c9E z8Y4(7V!o#$a+rH6Cog-=@GI2F#W`J*DfzOQ22&Pfm3%)yTk#wtC-a_cdbYx@g-*C) z0XC60hX_`=c>X=ONh>*sz~O;q2*|u$9+gBsAfd-!G)T z+HSgxTM9>En{SMlw;Q6X))y6p=K!Ae2~J^qy4fCdZCx}XT=tEYC`hiIRI){J8IJZN z>n4}f?zw|3GX@NIx0QNwqT;|Xu(vO)bk(=!or#l473*O8;#lDYYF-9Rp>b0EadWLe zUhpkZM%qQ7Cr6`ng*Z%@^-rUR~-_=?GC*Dd78Q;JQH-n8-X^%Y!V0fv}I5 zmw6$izG&@ZrfO-Y9Wj&nm}0S>NO--Sgqztvd&S`Xq#Cz-T1G7sAUP;26@sb4Nh-eoq|pd zo5#a&L)Mq5&3b;stz1j7`r?rD#n5qjsTFV)O(v@onbKqO|?){YvOh z^z`B)RERvkvLmMSM(1S7c4xG%8=HB4Z1r;c9w0S|CSKy&#!=daDuD8IeEjz%m;Whs zYOr)>H6!6i+;3(6vITkJh=#1K57zg*+$7BU`j@m)WE%z*7@@;%-dFMwVAF0m#O4Dq zTd7!2_aep+y}v_y@{QQHn`O9n)<6e(yH>w>15X-Vqrxm9TUbwN;059du zYBV)%Lybn`Ii;dwz>^N?$-O2BgY!IV1oMDlNaG>YXdpJMx8(=DLQzktcdtaU>b$yh zpk<`VJ<$o@g%)EI}S*3{sxv*Y683WvT<-+y4*RN|lV`U&v!(ogVd&a4(n%UK@o18RSJ zqBwhM)bcKgj3mwotGVq^s!X_vjj1t&@H;dN#52eewt2rFG1)T9?(0P!%m8IuE{>&q zoYUS+@$EnQJQ}omu;v{=K)OY#J1Hzus*O5fp=t4&Skp*j=wsfI@Cl!hHCwC{*<=d( z;_1US;ZL3hj>Pf{7tGcc`3d)9W7XlM!+D&oz4NNlq>X$Tsp+lxh73Y7w!qlB-aK_b zE4!fL2}{hrg(T|~p*V3SL&Pjnd%hd>eh8`zq+aVWh}$XZw&F+3@5v2XA@Mk~UYy;I zWdRgQ8(QfoP?Or)=?==WU(P$g&6Jjwu39@prf<2ofTX={Mzb=Uq=>(6IF(n4uUmg{ zqr87+F`(yX(EYeN2KkwU@^M)cxz=}Lp)cRuP+ItC6c_vRn8}xys#svm;~h{=VM~X@ z`@LODngsVarmmBp{$@s<>CLwAN4{%~#`>E2 zD&HE}l(e%Gw6i(ZwA35E2TwmB*M$a#JqU61&UQLW1y`66Hd9d_C}m+ z1J!J7!?Au#HX5Ly%u@QBZkgA^4YHog!ZDMe;ixj-fPAja`N;%3O=8T16D-IKTkw^` z3(w(*>XlXAF4V)4cYjO?PfHq^&C=4BEioaRABS~IY6x9h$t~2?MqAyrH<6A>Q-tZy zCwG=4TT za3q7Y+l`V9aSi7}6@laIZ)ExO-QINrs^q@`Z_LqqLV>P`?ViTz@*WA_Yhm;Fj1r&1 z(-3KiwQq*aw;Kj#_V2n+$A^)>3urZN3~c_W-pkfv{5X7VXHkW@dvZRUespOrEqnC# zM)uZ1PUhp@57F@w6RKuPrsKc=n}d=<--vbVE4gm1U^tO1o@#2&InYveBTk7R(9L>B zTW3&;MV@EGInP&kwRoM#T`ucsR(nv8USE=Y#|gL7*B7(!L3i;h#vPjFs*wDyTsrZ^ zz`wEo?<7wBe^$x=juihh?G?X+-0vY9kECQKSop@B{M|QmGI#kud>TF6ZArHLp7S&1 zqdiC8m*NY^1ApP8`7OI6n?Sqn$=tWu&Hpp2le>BNN?P0?a~k|FoZBiynwKMfJ^SMS zjrD&3`R_=1eZbaJJPN$M{m`Ag^Uz zXx*d=A8Xsozfm?6QFJO7Q&%E?hgGB1V!=)6yox;iq-c?eRj5^lTpVf7NqgtXk4MF0 z)_Lt)kn!DSrKCq7t5Soki_Z>-y5nXkR}IeQYzBR5c>pO4lz5lATXttEJ&)YMShZk( z{{p6)ERYu>uV{_4no-Qg>dy)*kdlaaDTrOM1VpJeYi&STfdMOsODqk}j_h@t+DqsH2dO(2|G&WaSsE3qK0<53ib z0^Gbg`qMcqFc9ckl$;+|=zj~+3I(*m(;2>H?4MoHcQD2HFGLxOIwJQt{vkRw$==V= zP}=pDC#$qFiB1w8oz*4hrdeF)_Hj$Ddxl>ixDES0?FN`*$30f&t(Bl*TSqsdti5C( zMcFuFo)K4HR5oO!!P0+O|0NBmyNe)595X3j)Lbd&EQ&UffpJnR(PWQtbMgJ5VKS8c zP;sgvh%>dghk&Ql+97!zZ@Y^YI*o#dfzyiiu?hu&@^DA}n6a=mwpLNVv$u+ z2)mqs6r4C#dN|=Npi)~?v9nu{=5bN@?{;4m!<$k_At^X(B9Ffw+sIl$tu*jZ& z(KVYM<)q=4$l|RVx+9qxJFpiyD{VTe7Al}pFxs1)Gc%ximUxpdXY>h`ymG?tl%c60 zFLfMWU=-|Dpp_7bUQX&6A(7kM?F1pkBHBUd;v4XuD9+m~z6Mc|l5cH@i6AYE?~5oa z$Y^dgL<+5$T>t@#nhGwAH2+4aIK@itF*^m2?F%<$v-6q&Zh?v~KEsJ-n~IqT7+nk6 z;ekK}<%VH~&q9ajWc^=E_v>3EUhWec-NA$V8uEM1<6Kvj-&Am2a zWyCA=NGi@ifW%vYtQ553FWo%wd?An`-#z8K?WB~@E~t6a;p?;whxer~DOT?$ug^yd zD?9^BxvF1$(O}p&_=mRmv=owT&34H-dETd{Fv(^COi5)w%@%KrK7qp&rmq+(e0j(A{3g#vN2*~B$7vxdHhmKb4_}GB=R=r=7P_x^K zDP2;=>oFAb_OH)=J<~sKC}~?9=DmKmWi8G;%UQjJ)Ow;I~T*AnEJSz9dn8jJH5pbAub;{^;U((L?h`_`_razhXet&@8*e!~ziL6TLE-~F zodC4kR-~)aGg$9NwGS23q0?pK2gakpJly+P`@{R} zwcfUOKIB^0m8|nh&g5*z`Tzfp3S?IyL%(*()&HMkKUg5CyG>SCIpDiKV4_Ls{L{Z{ zWZ;hw45`pJg`SV<8NCzt6Z(eBDYN7lMOam;QnX6SfTfp!!*qOGQ_w%h=$&FYcU{%* zZlZubM7ogqS7Y_zs6_GAQ*VHi>;-TC5TB_uo8>ihssG6FhKp06T@WVtH&oBp>Yw%I zq6%YO_FWMNquA|tM}6K+;i?*gxrDQ%S0$Q**;{G02wSg_&n~ervj@a_MLr2^od^p0 z3ZNAn8B&+TO>H~2Hjv*oI7!&nkdepZW}WJY8ucJbc8jL~MtIqu z#v^hRn>c!03N6N_7d&B6qbc~$vHYK~(+wh;R00jq&skk;t4!wR>Z#3qRdk8X=BSf- z-sUhfVvdd<9LYaXhoebxv)~05(C8>@505zncx~(L3>FtgY)iBPO}++4J!_zLWV^V& zd~%&bTr07$^jWcuM)cd-pn@ zW5WOX_o+TM{8QoPZ0k7ooH5Q(kvNsq)PM>JU4vw$L+uXBq5~+Rnd$T3*a6 z<5pOr`E}L&u2kyalQv!fkyS>#;A_?2&K&?5MTR7326=GV5khavVR zWBR3@N;=|{FEVS>%oloFNqD{5{zi;@R|U*0lHL09P@AOft$bfIj0IzuB3ZsCWc9|U z+1SM2Q#@rBuVoF+o&5N2Y9S_^^s3qawyCtSNY&TGDGt`A0usm_yrj5#dCQMvw|Rd| zk(xhh6fW zI|_9`%EV0dmGkYYcwC8p&EI^8zQUm6S@m3FYbhdkrC2#!&4gn!~JSOZbnEW4diMYq12EO zn__#3J*hCR9JW#(Eb&HHVNu2yp3p{|kud8>O98&PaJt;vXA)PS_S^gva%FtOgtc`) zGvaE`KgY0V+`XX-(N^>~1Kw@zNr`!9fc28&;y3hl(PrR9!X`wW~&<4U#EkU!U=0;V9a?r@p(HV0*tcV`>v~`f8cv_ zQULPDNKb8w$=U02R_XdKJyg-nwM#WV1){d#fFwBi`%Cz1DYklviwmu*?{8dR&Plno zU`PGat|L}2f2J-kOI@jyeL^M)H9 z?9ZX$O4XTxuRUTHeP6rI{N2%X?`-~PZ=VP=!Jzq3-9&@~N`OJ@Bwzt<_UB5hF_~X) z4lCkv6z0*Ifp#J{sYf_~zJ%ZPO;HU7hAp6R&7LD$$7q@K&95IFZ;G9EdCFch#iZoB zsPp9?C$8qn?2lZH6@NBm_iBo*Ev71eA*}LgL5AfZoS*EVY|~txPkDIwO1&pX{D)SU z%Eyl69t}h&Rk#ZIl%{ULdZBM8e58}HdGT#oaN zaJN^zt`|O|`}CYwu5!k5c;>ja_S%So(x@m+Vh>$sA#Ae>6p$Ho@+kDHSYf6GKZv%BInIQvvRF}8^dBRn{rw>t^!Hs_f}uz#h{@yj z)^g7d!g961gZxJ`Z8kE`LcA2-Sy;V*%buu?ioEKmv+lJW^MYg%!F-}_4 zw*tA!i$>3oJ#1qQgadF;P0nur`s9ATG&c46)EFTT-_eu* z8Tq}z-lpId%+fGX)vx%v*L|%omSDZa7x~WGU7p=JYh|R;2>N?2r-3#gRTR6zZ^^$R zqmAKECu)a;$Ki%zeYgMSPfw1<-OimDub-!~6=TSqjBxu`a#*=@t@^#dQ$~d101a-2 zZ|U8X#18S^wU1)id%`r2@+WLIiN>1-oN;o+tuF=GPWKm9>=bR(ukA-`ObIwtHpaIE z(nK`)F4(*NHK$caQ=2)mPbXTm(i=bRB-Bx zMMBOTKx>F90^^V@op>&3{V)K?i_P0^^IIn513qX#5WXe83wsI$>H}Et&;hu45S8#p zbB|ae6B3_N7CB7iq&RLVE*}7}ww}KD)(goPUl*S!ah5E3E1~FBvPpSKpt1oK2Y5bTanXa!yKB zIKNzH`W&t)cOIJQ2A>bG{?`vB?Q}k*I>-FD+9~K&^Ik)JC69T0(V95aq(M1VGn?Jm zO-c584yrUnQaKy9(xg1d4M6DfPx))Q+DUh78C-KQ zw(EC1M?w54U&?FBTyhLv13<5rGtKIqpZeb135L4Lffeyt0+PIXts8G zW?<|L-ghgVu74i!;6j92TzW;YVpr{Ot?47OYBfGGM>R_CK&>D7)^-f@T7;1?`mi(v ziVf>ygqx!*tX(LL@7ypKs?=RibSicr?=TH$wLrGy80Bf8);F3+J zRa|GmyNch(@Ib>bQ9kbV7uW17dblxaR@Qup6jpI%UW*G14aEWme3Ho6YYrU;U)Ppq z16;RhWjao=`bgDOfhrPA-XiTZHJD!{55Kxv4;ctnz*LUdbeCrqqd%-b1glucg0e$2 z3gsS-jYih)j(4fQT2B?jG+Gk8v!^AlsCW!pKW9|5b&gr`u#>+jfm1KiN*v6kd(*YC-r7v7!8t?fC>xuqu}`f( zM0=ZF1+dlBz&g;xRr!NvZ4doR1Z-+==I?LM zB)Yu*jbSdY3B~0At^cg8Pf@VxF@iyVI^GWoKVrtP{8IXr^S47IX>J!jtsZYcXFaS( zO-*F_uYJF}pt(Dw+KalX_Ba*vyaE9&66T#gx2^Q8y;*zBGIXVW1qZVS^csBAxnY+H z47^|zqp}zPol3ev9@Bidxc+*>n=uG#qUDWo6R8WL6_P3lQ3{3Gq9&{C`6gvf7-z8T z__t$gdIZ(YDi>_EgYPwJ>6N1O&8R*In+;HLu}$|l$cmqwl`ga!tH9JB~jEXMbu`@#ESUd7Khk2fuJa!hCshw+0A7DgAAN4pk{H4ED<&w^o7=eizR! zbSfyTarOup9GJvu2kd6Mg#$1KMXqv}D_Q7*0>@XC!zWFJ-V6L8!tDECP@5tlT-9b! zI^ZGpTQljJ&uL;OFtx8XQ5YG19#mF{OpEFc+B=fU`wSNOO5~Mpy39NN=n3`j&QGGa zij-qZ!K&KigfD9TL(#-88&y*;wkFQ#Y9zR7Sq65M=zA?itbv^s=O}$VSEpjQA!BcJ z!JzfjP=MK^A-}OY$`K)0adKx*0A!5BT8wv`v_jb#P z)gYQ|)1;c1dNIJ2B|ut~M89dJY#TUJ8joOxw9F_G!&J`*w|D0YO!QFu5Brk7a#!73 zh7!Gj@}!f`Ss)F&+Et!$B5mw5JgLV&t4F-%PIy)WS|7Z6UEJGSyuPaYD-bZ&(t|>- zug`y?pqm0CeIj&K=UN2Mc;^KCAYB9ha}46ho?+SP;`2iOtlziNnOGBa6ht@Bbi`d` zT`aYq>t~O5IE2yET%5`XhY&4s%%Shk(r)9&h0ae2lO(WVyph%D3YVMl}E{%Dm02VZI)nq``Fn$z{m2Pejn^2Cc#UxTwYoM!8U(zHo; zvqARy`Vw|-I|m4*u*+*I{5x{7s-tZ|>#K^hY}qXv3$=^jC|G zpzrUSTNR>=M-LC~T6uU=ezgj@yQk4HnDQbevkYRLERnq7ZQXu~&gNFj#3~ay-%M&9 z8GMS=61fuvu0Rz>D-%)bRg-*FgSuV=v&>*ee9ZOjcLu_5??Z`ujo(G>5RF$t-~uH} znc$}ZdNvc^#Lf)!LF`Ukbosu$U_S-(GC3{4YrEyFUT9>=d+A1aaH``H+7+S5++CFB zgXmwBo^Ymk)bkG{^pheI*ny|6Pkn7@|Nc?B@ZJ9GL^M-ud7Q!+S0(QWJn5y=(me|^r>3v!br)2=O3|1D*NEj&sDLw|w+im5jcr$s7 zO6DEa#UgJtob4#6ydIq$YBw0RK2TvtM2t0_5L6}x^)P~XEt4@-HnBQ~cwUyFuVJ!# zhP$D*ieTwdt)3BAg9{Rw7zJe^ToIeNQ zrMY{Mu(KxCZWwaIxyL}Ml!9(bos6U5kGs1>L});b(x(06zC%RNJB|{#sX399?_a17gzl+^AagE!IG6k42otu}D^}A)-wIa--(g9&Bra@QcAgfO zq8BOhXl!ev8U)Kf((fG#s!naX&5}8L`y!L}r08xI+A~C}0-P?V%3%}Z6`KXn=>=@Y zsf?8f;fGwvO>)^7VDPdMKeYKM(ot6bkuPin?91 zh_LV94e$x!IkBq|LChqDQ;xEqi?bN@6%;=(f46YVMI#entRO*52iT+dE*FfPi)^3zLK93JOs9JuBF*X=z3!=-V5>oSD&TxR& z;Rlmuwwm%wOQ7?Hxs+KHDU=j?sHtC-on)Sj0l4QI>*5HYrAZej^o1c+dcn)_8sWwt zZ$H`wt!jz(?3yi2wIc(a;f`Gpt-gC1wrP{0je>|2G8ldyJ_A~($q>MavZ}nzxgNpl z@5S5v^}*LV@E^L#Ji=T1`PJrzFC^6sm&q!^R0^4WI$dl2+dIb~h&1=ProUuWPqKUh z#Ug3$+1ES-!e!DwoYxWYIHQ5~dx>zEgD?d&Y30XBS)eS7eXW`5-ug-)iluTZSyAB3 zCwAVCM zcEL>~X}I$IGq;})Z?8GHTRJ4ww?WvR8&V@KGFX*+rKaelPts}pWTKU}fnxau@dO45D61yVBzLa7 zMyVpk13*3NOb2+!S`o%Cej)7${-L2t<9wHWg8-xdB zZFb8k#SZzT=LNDAF$^f0$&qPNAGgriGHO9(OtAhgF9<_y%#(pIkEJnfLo99vC~?(6*2XAjdFExSsj)y z%h3@0xu3gZha}f9W#~2h!Gw2LM|R&_diBBE>WGNmuTv(EfQ7_w-q?F^wspVBQc;+autUyec$XJ#!4uM;fjHMnkk~ z^uASosa3e+aSJd=DJXP}5^w=*WKo!CvA_pb*?jlpK*PXbgN-lx z1^1F2eRp+~)ZEyf0x4U9x9HB6Y^vN^6`;jl#8q4MdN+5VYgecqZ>^c%xAVF@pG!%V zLxqkpY{sgJLf&d`4i&CaNt^(9(gOW+hjSUVCG@FKr6AdWzyw)uYJof z3ABj8Oq70jHZtz$9NR8F@U3{ifEc_YW)+udh}Dq=szZ39c(cQ zY(+}>Pg|UYRP9zq!H^^)HA#Qkvx0 z4L9Zhtrp752Kn4ZqZV^&QXiqI=O}Lg+z}!E*gAC{yi~i1p7bF{$i5e9%(Grq!>ggZ zoIP)tc$K=isid^n=>z)-WZqn0@pXHEwU^J#mp_-%GvKGstKJd+>i2=$MDwnX5v@-g zxz=;FXNB3F^@F=PhIxgFx^O#|*+U=_1DrZM^aHMI$+%OlS*#3G-3S|L+LFa@$$ZP1 zVophedc6U;)`5^Fl?2f^*qlD@X}R)6l~+M?JrU&%*2EX5s`V+(LNZNbWsar-@2}lM zdp*VNDMhiiQpmmOl2oifUvp9|W$4_>2sR$#eH0?@>$Iu(Lzqk{AFgeXZ0c=Sm!vVU zdhCf0CVm}kNnaDy1tx>N@4eT5DUf7Z-aFujC6doTN?T!gYo*zs*mR>AwBNPN!JY?F(#L7hC&lB0Dtu{WugQ>_5s(7z+P zs5qZg)3HXd#@FLs!%*>~=7qREww`6@d+!F{FbQ$0ySK@r*q>EZ+wzlU6DOz|l`r-J z&b4gj!KKIv*$`a|hw44iQXP>~%S2aeYFi|sCvkDw(K}FC=V|R{V$yfjjm@48eECg> zh;gC%zB<|ac?AOR-1Wn`;qN#)W%&r?Vea4&HsTU+)eyq)Nm?m5~< zdw}d1pJ%aI-h1}6`2LjFy6&o9WdJ~+S>D9pLws39CCRCOH+3PKIto$H79>>1K}xtv2p(xv8AsZe%E! zjDwTer?&D?Qbv66*g~;*76Ic#VI2+8c%05#i2~W?DUBw2QK|=9jj@k;6Ut825l?6< zxU79jJg-P>z86Lk^UQp?Tz^(?+s;63@dZ`>x~3Ck2}c>lnc0Scomp{0c{I$;D>kZd zRINsZhPau*CXqp?F_;&##)N=ooE3TFJk~2RcMCJFn7s48P5h*lz3Rr7&j_c~tzb*1 z8{&rvIS_AQ=5>FrwF}rKZ$!lVr~JfMJ&A0~aWFN2@?(Uyn!MEh%4;a0?MNMJ`Sm<@ z^q*rEe0Q8z(K=}`DlhhTH@QqVpGZO|PkD)LC|VR%fXj5R&I{8)k2QHTClc#w!dtFZO{`G!BNx2=mI&!?A|w#;#P#!=KMrp#hcaxyKtl|m!lGl7 z*?`dWy$0G0I1=G1zWzONI(}B!V)^fgEU7tTLv4cU&PEztCS1KW;`9@Fe+jue#^5A^ za~>DgOH%H&z4~kY8#vMrWDoRVk&N7IaZH8N zjUFsa6Sq~UQ3wzf8yYor*&qL8s?;(!4%wwc8;In`+GPRV_nWAIu4PS2Vd_e<8WLNh zx9aGY1iukBz5#MQa&PL?MS81T1)1qhs~S55TfJ+%7CIe>bw0cL(mnF$Rj;b(zqen0 z!s*E8SLbhIiTPvB7Yofp3c~OfBfUIpoVou5$RW8?s2S*N+Xyv)U9R4UESO$z&1dWC ziUt|YmQTwEQKmJL2aC$hLC=P*?d{5F#l42Yu~nd`xD=6K+1@SHDxbCk1QA4>Q5=66 zDGF8^@UAxCz;EJ^UCp_CFia4k6*6^#nhM=Yzn7qPeK zGB{OD={3HY^{+mTuBjxw$A7w9CZ+v+S=><$hlc}TCooi2HR#Kqv|P%TQF)QlN-4FL zs$gt$whgAo%{F<()-Nm;WI88^SE3!@J*+d{Xf|z>FSy;k02$VKf%EF?6;1I~59sU* za;ml9H&ikc#45zUNqZBnadgv5?4NvjmYpM{%!IhGG_&ybrPQse*%bUvm!tJQ$}~%- zvf0b5zakL~R4cF-iK$QZsQ+fzdPyOotm_tL=}X$bx@Vf{H|Az8zgZrWFfr6gL`dE{ z>~zj!dU#wgz%7ATUs46&b{pVE(PDrkw|?@u5BMrqle=EaK}#N`oPh`Q&bl}i%71k& zlxR_dWc~5_o6z6GHTmiW_owzm2XX$}Tc3r>_3|g9YpWf6fxZ|#l(kOGuj+6%QNa&0E5C8hNoZ?8p_CKpR zRk+(G@#e+1zXUG+yKu?U@P1+}b$iOjRLa;OO0Y2a71bod3R_LrIUn`s;58fKG(w1s zP32OnGL9acVrGw{UAqM~mu3i(bVDEbE<_FbOxFPxWsm3Oz zll~%E1y$_O3V^KqsIi`r`gre-K*t4!}6;GOb@E_?rSO{Mf>FVlwXds_G?!#T0<$XK&cJk7~ zN?nOFe*x`e&(3F1KT^+{#g}(xbX8TARn5Zl;ZQ$wv5yiLtBxQn-t650#V_NuY4j|b zw*zzBgk%~5YGDn}GWLpUTM1sQ2%qJhcFi9gpS7VWk#QXh_@1zg{-E9c$cdrM3_7*1 zdu(eYKXSUqYXj^@CjS66EB85H<&W*dtuSz8I1|qIFHI}{y^*$o0ehReKJX#81VF$n zfjg}5+}C!^q>0La7XG2&+WA1#rKybNfD75Yp~MCNCKsrW!Qpm$rZn&bOj#NJ?KP`7 zt66Fw_aLs~i1-tR2?XAj=fB_0%Dpyb#FX$AD~o50qs-n3EXB}^GCM+|uNhf-eZDd( z{?L+b{A-}N^iP?3_;&_}(~fVMs>+>7-n&U}4RbhBhHF~hZk6Ny@v4=eCKv71d@f0k zoaOEDT}!Pr^elPnEC>Oikp4NA9ZboJ8D9)S^_YQ+sf6zgOc=q+MUTUiW}m0p18}aP zEE-|O%A8o+6z`n6LK(ZHZ|{9q`ZjUiZ>zU!O23~Gwc|GrQW;gi1wtVi4H{yD8gA6E z!RiEh9iYeA%7m4?I`k{ZRh0auOG5G;JSN)S=aUv;41IveU9Qc~fJa+y7#IjEvxDc7 zw$f!kdvP31sGYa?Aw|oCf@=ol=l;x5_Ex6>A)3Sr6up+}y2G6)MPrE+?j}MA7zQj| zja@}<=kvF8uDzOehLPt^9Sqdo*_;_@n=^JbP^-{@kL<-JG$7zYF?-SZHz5atc)dD&HmRg?{+%H`SOb<4Sb(u|Hk0P8V6 z8~{O;sJCB{7-WbUzqds7TyJS9ZE_?(o~152p#U*{m6Lxk3NAGuUWMzmnW(X^TvL#| zxpxzs#6+fLzYAq+lCxL~&KgP(&_BlnA9<#T3Om&1;-Kf>zob{`Va3axTVC7v7cs7W zFD@e70eEua59&tE`-mx_(*ViC1Qez@O>aLLqC6ipusd4>2%ZavPXi(3PC0-%L9eO- zlwHA|Ok?JokwegT7@(hP952FRb++msnLPkV6()1Tu@>tNHQqWU`QmtvvaZMTD+d1Y zr5)W3FdGZ+w^MVLp>Z zb?0a#gUv67W(GWQym2|{Fg4Dql@kTCO$Sif2keI0Z&PVvOh}uh)hfv^I#WDFZNBPR zXMHf>2U&QSLf@0wFvNVwE<9qK3=VFY^f&DndrVepzb5}+7bX(5F}q%!9*TW5O-poH z3mHp%x+F{u&crLt0&aHGI#)Qv*Ba=l-fyGz^i)w2Jw>M-5M2Gc9^NvgJ)e)O!94n8 zI8tgF>>z9z6{668YxPy>%v;Hfq4ltev!1xfLW=>MLzJrgiZK7~>YIH;O2DKPD2P7( zbjWODL|++sz%S8ym-D%e={A1rkIvc$I*DkgOEdDIb#KisM+s3M|KP8!T`#lcA*}Um z3{8E4ZB~b-tJg_W6ssTB*xX0b9EHv$*^6E_^%zgRfa1>1@-g);NxlYw#7RM~6QuF# zbhB+3oV7M`e=}(p8&dVCIO#h~vD}OY^`f2&%K61FUC})#dFb=a`$>9Z@%p8Uu0Rxy z-2ebF+Fo=osBZLF$-0Ds`Ga%VqfI!a2w3-);!EW+L(xqSrx#Z4Gwf3#Ru}#m`1L+YOY> z^ZV-Gl6kMdnBw7X5ROv6lwrqR!YDo#P_VdU8;XOTZN*^@+9kiCn(;b=FjzI}DBjTE zwnKZ5RUE=SHQ34RFP#LjoAEA*)ppgjPvdxn*}FGmbseOy`(@A0fmCK=vKLy`9|JK( z%(P8-zBKnBgbs9QMY#$hU`5fPYI0j+sA(&Bae=SF-USnd$_lDz&28mvQnwr}i}BZf zHZ%c~lA~BzkV1a}OCc+r&KRiG(a?|@)Z?x%E~9TwH9NF4L<@saoE%p)eV)?t8RJ$Y z7iYy8+a7ssr{;n&d*OtEG#B(P_l%Adou1^mIG&DUn95iJFFfzJ>FT!hXlW9GB(?<} z&MUr$gP3|LwIh`3u-3!IDD_2Xg{S$VwZ|Sc6s;7hft-SgydHkEZ_|>;2|TO1mPBu%zT1FY|~gP$RC267%@E&{w?) zASDfAk3B=9GQY0I$}6`>?9XRKZg8;9{Q5SnBMMs32Gr8ZcnAVo^~^s0AyL4CHG0qxb zmQr;9_Rg<)M1Ssl%tNShNp1EVTp)MrdW;h8&3FbJBBn+_b$mwIIL2hrMqA!1-xO*S zXy`UAV?pY;rC88_ej z`s{^`Mm<(t`?~x&@{zgGfdA!+9QCbs_WI|DiV>Fk__8g#XBmtb_6jE)WEf~`LE)vOV~iMU9z_i9?9^P%hiWjFS5s|O<__%@P2B*T7gWlw z@KIy3=q*~FuVPuQ4OD(p=i{ebaF*WuV`Dq~$|LeTLK|jtxwGibZ)cl`23eR)=7BD{ zIe5=IdrJbAt%(`LgnASfY1a4s9tU6=MP0t#-ejWRkuc5|Yv3uakPG|V41+t!;TzB* zvJ7}_D4-LPDPvb^Y1Im(m^bt)O;nu9_U#$ezILlDb(0c}7GD*^t``=GO|_~3#8fAh zF;hcw@MLCln|2cWlfujoGG9t$%ipzkl1Gp;%%H#uck&F4cw&Vtr`{Wz} zL0!EK#-oAzgY?rtFdoU4c2ue{(Z{b?;Gl5yR9iTY``RWB<+7jkG5qz(IB`2A?e!nR z-oWMBWupqY>kW7;M^$y8r;?I|*pb>AjIkMd5|<-(@^}?qd*wdq{trgIn=UDT*o_6;PlBNbjz-u#b){YE1R!Gos<4+8GOejr)Y6~n9GACTLKh8 zFTI8Xwaw5|4U0VhLq}S(mBIU`owZMj;Jo7QB}V@&ZHh|aUu}&12`?Niz2~4cYxl4_ zf<6+g7m%AhuCi=FI*45wW+bd!8X4x z;|)-=h;U`DHF_Ow)F?mSpQq}LfBV8k@5-(2N4#li`EnWU)V0+X$l9N23J#Tr>@#S& z-$kDZ%}L{2(W+|M4}F};@DMhe{>24@`#7l<7;WFjy-q0SY|)k~3q&sE7Mup-bZE~o zj6^UwSf-k^YUSNSl41}Is6aP(%H*JeU@3+L6P&7#zM>ok#IXDvoW>oQce5#+XI3{c z8=5{J)S)L+fPBL;ayK2}o01;0d9cyW8` z62@wZ|C&2KWNGx0K9V#KM@a4L*S;r)xro~1@!Vc zN9*T+Bu&k?cUf`#*qZ&8(P?Llx5M$j{=H87?=Ay2Tw;wL17~O z?^}W(uKq#gb*}F6-?*M2?n=%L9+G`#U%@$3YTeo$?uXCqmp%fVuphCtx{;NS(^Tx@_|9t=d&*OiG zr0v}L*Ux{ADg-TPpjj#RL#zZj7fkFf7LrT-=E7D1Ub8X)=?RXQpVguA8_7L|q)a@c z1O<@GKpTKng__@%Hn##1$(P<)6c&+)|wgW)!llo=kpfaEH{ z!|16Q0aR&Uk9JK?wX|SLR|CK!q}22{lP&EZmPN1o0ovYKH58k;6F+HDzXLzs3rHQ4AGId1Z>n{q>$!SLrv;G#K#xA9_ukY5zVR1@)@*FbnDk z-oGHy(fRS7Lb&?QdsR%`0IsRL;rxONleyyPsKfBjf;@@HbF^Jb?i&TJn%O#1yr>ce z!7Uh9wYy7fImeBO4JO}N_=r#e2pbw}`P}6y=7OwmuUJYR{PdGsXV$m0mfetTD-Rt$ z6)e81;Is#%&{I3S)xv?K%9oTJN;E(*=8{*T7Y~+M{Tt4sqb0IGz~Lb;U{cjTGThl_ z&~xiunQAg-G8RSc7L2}~Kn?<;I`pRKoo!H;%7JM5u?bK)CxqX5(K@Yax zXlR&9L15f_jGoVPTSK9kTcj6f6KTh9j#oi9s`%wBX^XdGvihF|%m zmk4bam%B%MaDCjkcg2LP|Aah)zi)o=#2cb_>VwFb#5{qn2j_n=Snd;By>dclOdvrW zld>0Ih71SnZF6I+T?91F^vCJyiXVyngHbVYWfDrI)jq7HA4|K;soI(FF^!ECpIx>0 zK?9}Iu^LTvw4A8* zglG)4#ZQ#4v6JnE^cKmW={*a#k2C9?sQT8NHW^AUD(gA+3kUzhyUKwr63BR>O-4OjAvBM5QRjihL8-uc%GD2zY=p4mTLsXORmjg&~9=t zIJ`lhkOqL7h+L_NC~Uc_!B;K3Q=9pXI2g3R0j8VuBrvPyW0OpkB*UN@yJ2=R)%D{L z1T-JoV}OToN4g73LZ7zaj#yawHwTwWS>Xmt1trIQOOysS z$tb`rn1*Ntvl-8~nIF$24$VfA_sr;G_4vJvcOBUfl%144?d_z1LsT=7J3CysWWW0* zRK^%=%;qsvI1(=Biq)j#fpJLbm0~fUPdUn`Mjw%UTa3)%} zhWKptAL{s>Kwjz%C&LV$J${G;+yRZ63em=`kEd7f6O)FQ8 z{Mp8NP(gA=#T4EGNy|@kIqu6u#0-pUsPyt9SAT8}wZdUsbpD4~g4qBHgelr@xgrHJ z>;q#V;tB4g*Y7)GwFh+ks)NkH8s<2An~3X?`*Hl~=b4Jj=G%2Kwsy!NN5L{RsF2{b zk9n+X&dTqD$y}XbimOJAb!hrlm1gZiDs!3&z0GK}0-PGa6PpaCSHVQ^H;0zZ`AZ)E zyY2l)i~E23^gj}!Rd_N!fwoB%=5pj>oFJrrQrTrbw6-x7OoEmO$b+h;${cbY4j+6- z_;L~_|DT`i|7w&z?p>szKTgySK?u&!QN2SUPQ?8ZH@&PxhjY7;w!gT==i|yR^Zkg~ zJlpF)c}1EcMi>O>x3tUvL@zL?{7}*BjTS&R7%-Ra0R@Il0|m;HMK4Nre!$`lJ0xwQG47 zfHCm^rWmYZj^W^b`5l9dNfaY5MMH)l#3yai46u&;Kga3?%x9wVgf6Y`lzej0z=kyl zlS@BlW|!X*VI18V^O7gN#exvIS%@^1eljH!@8c8m&{F8-g-VR9g$vP=J7rm}q0ErF z0F?T-wV8Q*Gxon!S7zuevd6?xFh&mT3m@MNp}i2ppxX}5r4i?CciUyh5Pj9@^;G-8kXOH z^(ocWzt~h&m6TSkWj&26Ufp8ahVTESdubuv7w6o16DlY~>!W1tpWdc3Hss}TjHTKW3-=y~=$5%penvOQC zYsB%M1&MR`V0MMRyDGl)s@!^JrnnXe!WMl6V|-4XD*Jj?SV(2!pJScT>qxgG%>D+f zZxz?e9W$-cGVvt3a28SYS<9sQwY} z4bn{)C0BCgOR-VKskGboDrjWL5sRViI7pnDI)Gv0f>o7&1{z-xCx@Gg#Bl0YO8h1# z1MKP@ow4FJyo*jw-{@*-Rv?vF2&4>ALA8S}cDw)?s|3VNCAR@EsML>hMc=T0$L98V5ydGU_5$_V}IzqYae+bjPa>9OR4JG+p! z>wa~1=`zL4)|RGW&ExwejY18Y2#v}CO`6{oc$p?#d;hzPywvvvH#d(eY?w>R+m5Z* zA&ut4qoV`aQa!4sawZ@g(|G*av+wWk1`3z74}?pX(>{v6eK}YJZfv6= zsKEGH(5GFh&K@nd#h~}}M^&1Qbj9;Evn|7rwu4d*d;x-!(mONYT2MXF1I9+{2>414 zmj;`(+mf@6s7&s8Gevo)dYuqG;LxImQ1)jH#hv-~&u8y=y{Yq-I6lWZHDi^OUUu8@ z&kvtpw^1LkJkHt>H9qln=e(JfcsN4NG9lH{A<9V9i%NK7evSIc(1+$I$$QbgKVJb= z*AM==x&5wpB1CDH4S(q0Wrtc{XL6Wq@9xp{h{qucwcSO-MTvKvU060ASH#;@5CRaw zM3GT9CFgW`8T@FV0^nmFxbDbh*G>hTO;bNguNOwRc~Yh}r=a;t)ce`>%s^Q38B7;K26(|i3a)9`xcaArX=4)Ta9eLBv~Aro)u zqia)ZdWDv(Vb$QG31c>*7c}VHz`6Nm=_cRi=O&&h;wSbO0}NPlEjYw1>-Oy)7wi5N z>(K>V7-ft>=wO#```OmpFg zo6WaFqMUO>))&u&lF~uW>-&La-SrMS%zzIOlsH!_ALl|w%4;NNn_lMFiCON1BoQ^u ztt2d#6-n8T7e6G~)S2q9!Om|hiBu z(GUK1U`5}4aS1ixIzNtYv?yW%CM<107I28ZevfF=BXX&ua=+J|U+$KF@~pPLBJ&M4 zBF^WG>WX|X*!exa?y>#Yx(&?=Yho}HC{~eg_^fRxLj*s+Jx*oCl*vcqLlpjgR|k4RVTlt>ydQ4g?=TX(6JsokZ;g-XFE2TW7wgJ@wd%;6skc8v zM7b)5x9(_vdAuVyaC=}%GrdISe6{s=^aOfjL38hb8nWZRtET!&jQqda`|hZwvcBCo z>L_-)G!-O)5Q-vA>PR)ANg$NaMtbNV0YQNorFRlSFA4-mXwo~3(nAjfq)YErkPbKB zyS{hbciwN-U2|t{UCY0c{X2V~z0Y&@{+)gH`R(V44}1*IeJ@fz9`)7``CjYkzK+td z$#pl*r{AnCyS2j1l5i;H$qd-il#pDN>=!@l$5v3@=gs=f+8oZOcS*;I9j1Fi^}fsJ zPhgiauBW|ol)LT__ZUB8@_B!Q61XMKR&6q4RTC1ntzqXix3aVG#H_5jxKX;_iL<#9 z17fp}3?i#^t1^()8^aSvst}otM=dkFcrzU$y6V15tBBX{ zo#I7W-64iKB*W!7tE?)VKKAKCR~`C`xZCv9KrQRy6;l6Gcig+*7x|N^zcF2Exws*B zc(XFiFZ>Lk|J#wA(-~l4&ZS|sTYJN2enKMdkm__o<~8JOnrpcp;aCU)AJSbMz?VQ$ z(OoD*D;O+F!-c!;m|LO$(a$CKzO27qI*9B!D&G>Ad}yV-YjU+e+_p?N*DtZ46W{b^ z+}KZ{w$Me4P>MQmD&P53q43lj<}D3V@bAo4I#BkxNE`Jrp;}pk*xH9@{Co#!MXafv zpI95gwugjeMB>Gk$1OMR70>2+lPdGQSZ%6nkhpGfp5wxsgN(hidgj(4>;?HgsrPk#(s4Sif3b93n|9m~~XBFnZ7rcDv6zx0Ch+#&@G^ zXPhy-AMqeF2GYz7Q{CR z;3}o7lwpoV>AHN}v8>wax+xx}@(JT5*FKYOaz0Px;e#Qlb8~(~pE3a^Liv_Sx;^^V z{5*FNDc8#6Eepz;(QRH^W7(9fN#hvq3RUHM?poD##9J}y|d>!$Jb0`gW0aRm>XS>Jp1(%k^=)DF=~>ps z*ymdn7p|X92C_)!)QUFR>FWZ4jOL4Z55pPRF$j;rfI_tOPmCLBw3t%Oo#)+3|wMC zDfxpE=5Hi8Ds4*1&ClJH$G!IXVI3@y90p^ht?&6HFXAJ5_LwX=hz#jF zxgnH3c++^ed6oO%Rp)N0CQ`a)z^H3>4Y-NxwTQeHw)VQKnBTJBX0&UfW|X6Xvmb)L z&lR?0K26*rnB-h9)aNwhnn~PETtczzm+p2_1kxm&cT3bY zWC`M;_k%}EGMK9?E>1@3c6eAv9*X>COsBD8VT=b;*?}oB3=$TpqH<7hw{=#!0hz(^ z!-hnI`YlOQOa2TkoiAAzjswDu6ecYA2~Wf@`ot9kxQ8BTx4}*5@U#iXE~H#s7x-q} zeQa#KW5O;sad%I+L9L-$#`g@M=Q}*%YvfDrI%fA={`pV(!T(`4_O%U#ZzrGkk*38A zQU#sslcREvXJr~Db9d)nflBt|PK17|2Pdq-Z?vzkLl0WV>h>$CG>c^l{xUCrtD|Ze zKiQ+-jBZ%Deb;*J3~+p0AbyfS^4=I5ZKXQ{=x9ja)RdF{_xdkAc@^p%_o9K>;DkBw z=3d}QXJNn4dZg(YfHL{bBW>vJPKocOJ6`esUhc1?FG;=XJ!x>4Wr|z%zp+vxRq?H- z+w-Q=-tq~R6Eg3lhq_O8Qz*phmCoCLXhgg03Hb<07h0@6o6dX#H<)`wVnu^hBM?u~uja>n{M{(d%jN=fxbH09K{HsRNK1{RZIyWIO0kbm z?lgdo>v|8fmbRXkzVs-Qo3T2~bAMdZu;inD@ap|PPGqyWVe8w{wX47S!o!z*oV2~C zu$+|L9MCs4L48{fPg*YeJiksA)jklPTMwj&YldFWXsjcg0ocST=KsA_H;ImEOl&HF zue49aoQSRFNj0Z&vy*YvcXh^P`Nbk{e9JzzpF~8oihG<0wKoX4$r7qx>pR@}zkUf; z8y;d!uC>sVPu6@bc|{d@+PM0QJOBQ0bXYqbG+i>m0S!YH+uG zcZa^aQY^ub&*$R@sER#{s3m3p1D-BU<$T0!+!mz$KBGJ7p*v`CeB@3Fqg%L}PI0lY zM`@nvVD3Ijfe|8YciuJ@6A2Eke0E2*T#V%oG)iTOe0!k^ubj(Uq)s;pjoz%7W#)t1 zQ51nanOI%@yt-)z9(7e!3L4LvY0163ypN+Ru9lE4ryUypHZ|Le)7CRMPcQX2Ds!mE zan2@@_#(NoaEmuLlQS41)<(vt27l3t&WCW`OvlFh&5{S+&F9aA12eQKn2=K4!RA)8 z*D+{~6B~leuGhtwoJc+G2F)Muj|~@W@wnmSRgHFnKU6;i#xiKIV3QYqsSF1LnG!aq zJ2Q&J*7_KORq%vSq)k zWMaPDWj1iAH&*#HQoY$&X9Z8u&?=#vj zAIR8i>BgnKef_454g8j0PAxu~H%vW+Y27h0f?$wuXv{3?sb9fIKDkos6Pru0bkbN( zV!#5qV@xhG;i;?S0Xb@x!Jx?A|KvygeGK>Sy5V0*{Ea6bK$hL1BFQB#Ni|;*tB}th z4E+zPN|w8v(NO_d9gD1fqQK&3N6zbsZG8`sFN>Be*sHBr-f~!1HoBSZ@;~ zZIIP}HZR0w9pU$ve=L-G_0Xu5TD^tF*8Gb!6z`nAdUP z8}h1#%uk8%_siNLj^qRr9<3tkW7gz<)QpYPcH zmrn7=hVNtck8$}k*6-N;8I=Aw&v)$p7?(d|{f^zALFte4e8=vOarraW@7Vnrl>Ru+ z|Hs&AEGnZ$YFQM$SY16^R8GmIzh4;rAgCFyA)$B}6s)X>WR5&(^wYc3095XY)K@?H zRBv(e!_zw-lJ@*xw;uv-{-+6WDGziqWh(6R%lScipUuJqxu4Fh&@{Z%>r8tG*!7#N zh0JUA0=zysO)!4tSp>*D7vH#YfZYN7#S?v9!gx-+N|E&le4E@`HZ^1{edocY?Ej-p z_+NG{{~J%lpOA!yUhxjM!{(Xd5Wr`vk^(wQ0u`Jzuz^X*PV~Dj?$VX?NcEo>PV%)* zrdPJ5gcJc%$c&@rp;>p6Ab@+B%3f$;+iKk{z?yC32D54Ou-CnFBb2)nf(`eJcYZow zMwF{H_EE81{N<9Jj_=FrUG2(=GG?M_f99n`Mlsms21tU+zsz_HMMAYJJ~k zInUl#!p-i%qS|816W#df?NCrD;Mtv3GItlB*AgFeF*AiDHq-J9Z~(ZQ@|T)*DQWa$ zq>AN|P-mr;wAJ8FU>wu}s^E}0P?mGZ!wKZJvH~Plj`5Lr?BdhR!A_$}I*ZpD{khEI zSU`SBSy~A%{3R_B%^~{)2&Q|7kiuz4L}%ISV`N-L5U3@KFt zVi~}DyZ5dcpCKx(kZ{f&NRa3hcRNyDHt(%NMfQ*@0Pa);x2}99MrZw5qFM2V~ z!dDg(uElH9K5V~Urtefk^B_e50#@uO0P?xC8mgjTF?KT={@KhoT0AVQEv+QPSu<1i zrmOhKqa2Q~h|yf7_|(D54|uTnZ&<3d!0?Eu+<{{8*X(+3H|jT;)Q7#I)e!nu@x0cz zlBX7~`wBh&n2l?GH}onw)|J%EhH%l#fa#Wf>9=%a3WSxz6OWT@2`xVEUVWgz;!zworNc8Cg1Ha0Z)$GpN49u^?@BLY#Ys{|)D z5JYBR6^4a)CQCbWquq>1c2j(Yf4UH8<7WAO%q0hblb47bSID&<+cKm64U#z?9H6rj zzV(N?5u_(hmW>pdAFuNN944N2KM$h~9Wj47Ve$_bof@*iUCi}ue z=RnNDP7(R)GJD4dW7Up`fb3|A0tb!C5lqAl=g9rAc960dv&9081sfWcaUJ}5wNNG4 z6lq(VSrP+xRY&v(>|m$SIy03?rDIP;4gHyK#0e8+e2GI`-P+{dgwAe5I~+%PXmd*z zjwMjXjynza33H%aZnC@(&EJGKFYaK~X?83Nw(bATA_?_TK z7c{#OuU2LcRp9-;b60m$2CP}UHQ>;*3^R`@2$e279e7!0kQY)gK97fsdhlE&874fm z>SSk?(UW;;i#iaHJb0J+g3mfYjusLON;|j3ijm)N*55p8g9lgXy~BoCs^*%+3FfxJ z^IvjEtf92c>znf`!5&hqZLXlAk(_TmZm~v2YQMHY90_}gmUQevV>pPm_q9q@k;Kcj zR2e7i)7FH_ZWc#Zm!feK97IiLd9X)-R|As5!69O72#?L$br8PQ&;Q5s!GE!y3xwP} z0}!px0Jn#Im3e683MxlOv)?*gHuv;dq}t_P$~1Bp^i$NGkpPT`Mr`b}W*J&^HHwHN4wPi&In%Oh5) ziX?P8a${DhNUgam?bfJAyy^qm+p$vu8PkGXGtkYDxh`o(J>|0ODVRi&>aX?Tj1};L zMv#^9eI}|7!?7k^NXQgA-#An~HZ5W=aU>R`t@qSKg|+1{U;F_iB?oSiMW6Q=^eFOS zcT&(}{?cp~L3)a$%U3H4d9uC{wqATwip|JH9fo9Z8*HS*#4_bK!rb%ze z^VnL6T=7Sc=^EL&TQl78g~U7`of?{gwulb% zUTd~gIYS}8{u6mw)#N&jqAifA$ci1Bm0yNTx%ZVr&epd|Vgkr7?BYR0xU^g57u$WS zRr=^RA9M6JLXlMTjsJFbY6a~@UA1(nZhQ%sI8E00D}SCsPJVL3O*%R=BP6sAEUSWs z5_6F$Vzz=^nl1M*ZAE8*&q?iPfc#IVxSxJFiLoYIxSj##3(o+vKVQA%x@~AL<+Qz; z6~ZmWRxR=4iQ-kp$}#awLX+4Cw?GCE|0DiDITgMcl$o4yn^?hJ-msCY47xJocrEf{QClZ!-2(diNzR#4~;U? zMp^Xj-MOX);lWD!#fo%j2It%Xh3PWUV;hS#Q1y6N-Qs%xiJ%B-n<;iiIc9_*JIV>H z7?aNnrz@Nh;UO_Z!faWMM>2N>RS`CcQ$-zaZ&Us424m~JkY&Q#THq^iL|bNRh|sqv zx+fO%zH|14aYr0!C->i7NjL)>#a-RM?z=1cg+@lR1yJ(U=nd&jHJ&I@WHoD`G$8GJ z$MK^h7adS-Mo)%!|A#-^K{y9hJ|MO!27wWAzv!{$mdFX8qJR41VNqHgPaeU^#vC=1Fko-McSk=ytYE# z^5-7NNiic2Suumfn=>L}i%V^xVmbZj6B5{U=$KY{;U!0jEpRSmZUkrbSdWf8(f15m zuGJr_uJQ(ho|PcjIviCUY4iMdkc?K%zfusY5W)y&GAK!J=%&MTJ9A~TL<#9%)8UJEa<(l#cnN@1?4#E;|sjiIjxM8V_ZsKBWa^q_``YTXqOdaHxi3W%*As3vti_w+8Rd)(iiby z*zDa8 zyp8gba7;nl8s!WybL+s0@OrAQ5VpDHx*xz?x4wRy!mu+wWJ~4p&2=BnfTwSBO%xC3 zg>+xA-Cf60mfoNwmnbp$za`uzSFp>P>7eqfBkrRu@)_so!Xl$AJJ#6aRhg>_0+NY| zc;0>;cWpCEXGwVVaUt{G*A>}p`*o;rv4FNz&MyDU8~Eh|k<$D@SVU>5+Fel)_ux2G zpcJF4n9q1Bpx9ViY%c9HUobisELlC0h~KmAW#AC1PgSk*oG2mh*|@&Ocq`#rmZi85 zLYGuPizCk~+OwlMGdmp!1hts=^WeQ{l?G5x%KUXyvK{3v;vl$ z<>|^HS}2lm{ZNO4I3^_q?G7Wk4YESXv7~|~gr!zBY9U`Y+t6Od==0-ls29``{6VA9 zosP5UX+U~$+{})OshK1Xy+eJun|vw^+Q=mYfz$5VS8I=>G^t`lnK+b@1m>k<&Ynql zeMtItE_xUYaT5zI&>fq{&S)zZjf?14JON3QvbkqmIM8%vnZ5la7kId;0c~nlh74K; zecR_1C$!z7uX+&U0o#Qc$&5AzlpD-ebdd~u%jM^<>hklrQUpS|4DHO&Y_7dcXnfO- zzTYur$DO`Ahum+(3*C;kRl+Zf7-&PKa|v#V4!OyR#$W+Q@{%YI-^f1y;A-`_WDl|~ zu0AIptH<_24;VZ)H4IHt9vFtlERVX_MS~P6)ze|aPB_>scQi96P3M|)UOQMi7XgN9 z@gY8A@N4zD=6kxLhGe5)EkW))NXkgw$BwotHmN$nda~qTHs!|@TK$A>-l0Y@sYmdE z7(7fXGX++OmXYTAuy!rzN#j^nY8CahOjlO$x)S~p#IWL6Iu;_aTl~hcjmmg~MO(&c ze>PT)O(-;mHm-~(^Z;q>E4lfeRQfsd{L+h~QwL=(rAHb>+R8upcpIub%4C5lFC*eB zmc9%G#~7B?nWz$SkI`x9BXR6t3Nm55os7`v50lp!iRqAi?)ZN8!BWFxs}=jo5gn2q zLA>K*Ru;%R8!I;2u1j8mQw;6(s%tg3P~dg@ba&fcA|@Tl7}9+urd*1}&gK~w;;Iwy z9_C~EkTtw=txYEZ9KYg<=^VhWu`Q|k^(Vdy3zhGW60XsP2=$SAam9`?MWP6EW4jL6 z^{k}2p?39f?nE+1cFsQHiQxU{o9>_{QFZqh^ivcDgXl5O)?}B;ZG+T6q)pe})kJwJ zLHQIlg5cH~e^BWO$qlMSB4lEgKsl?hA%~!!-ABD^)ltZlJv*kHm; z(b9FAaSxaUVlHlfqxQ$Zz3ZF5+1g&*GbNrt)Kb zV>ebbu)H@@js9hp_{V?G(`=0*jON2@0%uE-(lA{g-b&Wj37gBXd^5+|Dflg;=j4Oh zI$!k2Rsv#oi!Y9q4L%$w%>JWJlX4zs z*7Ju#2@X~(v*niU8>B}o53y5$h9=czw<{lJvxZ^OMK}Q7RAH-%uZKcpnWn%4>mL&VfpOn*w ze!5VyN1yCDmwmA_9DphU;Y|&gfm4{6r`%6WCNUTOQfC=WAa=Tn*(+xk7HemlG*ijMDgp zH1h};IMs<#tF*7o8q@ZA5iG+#Jor3;LZ?)auW-RD}vn$%bVHIN>wTphrWqi z)kvBn&yeAi8m#-MoR`B9%5i!0jjdJte5#qk6<3%QHXvtRMV_iyoqw14(oNQVy#8`t zdAWguVc}h9!R;MyhNzkHmi+P-f`)*|id!8-b&eu-67JoUQcAKkq7slG#Cph_!w=z0 zHcKCtCq%{Y(KdJorBz%QS0`buV0|dp28#O z>&Lf0-}$*pdwIS&Zgon7HR{ew%s2Y8aI1{jTjwM4i7FUFe92X zlsyzm4OkFc_H05Ck-7oMxO+eR%N_G;n^NjP&1#vhwOEQ(%Tt*GLMR`;3VkSc38tO2 zg0Wl9$0}w@_|sv0&eN)DlT)Q~EnOvu+)Y>nbo+sJlWs`u?5 zBv`Tti{(B>S06TLlSMmKp}MW2rOU~MQ;8}pyVWEP!>$C0?5p80QClZH zv?sviBVHqFO_~Oe>7hpH~!_G_r9l( ziOZ<0!!%*p_Up&*_U|}+?+@R{#dkmO-4Fb~=LcR~bu1fO4P_aFgbG?`b+qKuOgv{F z^%6H(rcYOg^+#2Cs*odAI7ZR2MusS5z0Itix3aydXMm9hJ&7=QvS4*f^x5!#1MM_$ AbN~PV diff --git a/windows/deployment/images/volumeactivationforwindows81-09.jpg b/windows/deployment/images/volumeactivationforwindows81-09.jpg deleted file mode 100644 index 1e3cf9c0d80b8925da620e4d30fc888512056d36..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 60987 zcmeFYcT|(zwmynoEGQr-2&nX4LT|F^B%uZfkWi!q2qj1_0`3n5=|~_!xP(-Zwude$G=p zQ1?UHQ&9nd{8ZPe{#kx*QPHY-+dBJGU7)&r-mFhW^>hA`fTNe!b2$+al&7$@otq6p z*w)Qe#LxPd8-xQArO3Wp_ksN}(oT`xL{djo=ea7v5vdj6 zfiMivHL?wGww1MGS9p;%lfgOs|(6g&QFp3594y@^KQ-)WSB+^b!LRkVJB_^RNt1hi3 zCZ;Z~A|olTp&})!p{6XWrYx@VcU?6%TW?nc%IojCcK_5>`!98WQNi{3`N(Pr52O#m zPQ$~^_3l#a_PKw>GJvarOQ_?|0-9mUiqV3y?X81 z^=sFzQd8f!K}~(@-YMCE5!=Td2m*WBkIE3l}c@GyE@Kx^nf}^@|s%&l@jMUHZ3O z7tS$Xy>{jLT`H=p7cO4Ba{cPHb4XXH&nNk7Hdkrs=&wB)zK3BHW3ON^_J&?pj^{9v zx^G|&KudTfstk!ga33t^9Qo}dMAehTGHXI&XHZDeIiD8N!j4Cwfk@JW$cDm7_JTiR3IVfYu zfN|P=-5s6XSi3A{b>jnrPpRC&lcZHuZl;P>X?3$MOu#lr-h~#RuCxH=h^$vh&N2{m zpBS_fW*&KEKw7+<4NTEPCVM3Tz3!w}c*mJIEaY^@h_r?%O@EuQ9u0CYvu-&+L~h*y zm^hbr_veK?!v(NW$HXTk#%54I%6bHmWugP-f6T*k4$nF?V`s>%WWk=6(e*AM@d$n= za7sD}E1D60*Bo6f1ke2a zG=F=p_nUj;+N+T_>*awRdm>cZw+r!^B_h{93sZj{{(Ar6PPn30 za4Jtv9NlM{e@*58i>pGv`Box~rR{EC%;U$K(;KW9EQ(9}Uh|3EA$Y=PK`#uQ5! z8;|41A+u@fQj_EwwV2lGjyN5#6>r?|67(Ghd|lnAu9)X&%2;66lkY2jUVxE0Bzeu0 zTgpCIh5r|#zs2Z9c~#^ep{VabvpgNDr531k4_%G=%>5*#>-b(bPA$iE2&~~~8Ky~w zv4v^oX$fU=&0OCTxgdg~jGoj)>BR_;=X}Z%N|%pSghAt-M{<4Akv`+S}rf6)&8ZM)S8a0f5i}L8A@behiJ_xG6e;bGjyv~4rXMj62;2ML& zZgqUS75?o?PQ?X;E#j{v!rh}H4(u{OznNHx77Acs7byxI$li~3RZuDbR5b)vwK$Ql7u>UBGrrF zks|+^3{pMMhkqr{f9(VRFWb^Q-6Y%tErp*i(z*vY76qi-_+~|;|7Gx84W)d{O7hvDeNz6J_)n@FYu1uNsbmNIyD<-7uPyQ!l!t$i`6d6$JI$N4 z-p-MtN1#WlP(y2|W{@b%Y@LG3QzHnz|4D@ea=Cuf^6DWt*w^!;>UL&YYhTbzV#-|J z9w&6hGE+v_KbOcs{R+Xx?_2GxCqtd9Bp(#s9!U$WfLjB~<*#QA5 zq&jUICAe0A0P3?PNOB3dbVPTMM&1PP+%OyJKTg}=9je?M^V9tC^(WQ$DC^@#i-kSK zGzerErWrKswL$7ZRd;<{kd(Z+od#qJL+T}x*%c-Co!=kQlp0S~+@Em>IeG{#0z5nz zEM;B^)7Z9rNRJ)6oN>kQx=+jmQ42X412XG%U47(A!&KSV#PvkIy8nH2dxC>Y@+6$i zIn3D8Hqs!L!HhBunGW#!ocSK`r9NV%4bo$|J+EtAF3kh8&=tN!Qyfjnn>3Z6HE#B5Y4WLF{Qf>gV3J|QEXX?oF5egZ)C+OX z>E>00x(rc05=-ZfX`k(agQgcM&GmkKUa0T1M-%}2gb+1S_2xbLE7OfkvkV%7N zt33otGPN&v95Cn|a-l$L35Y5~MJ-QpsYx(hlwVF#+A?A|Dk0Pt`R2CBQ~UPO6J62N z$YT`Ky{fLn9F|_`VMax;K{RWe__JZzXN`8t2VBa_I|A=gERmt~Rfc&F#dC<%ksA5k z2swVf;E%~g(Q(Q$6&|Tr9?lAYG4sABb1VWGbYy9(r|hrkkeb~UQgo1oaEYcrc7-pR zbnQofxZH8DS&W=&t?kKfQTHBGW}L$orwx18w%u`sm*w!&ag+mv>C&>%sJ78Q)DgAtc^2f+N5~C##d4Sk^|2w@>qUS z1rO_c{ysNtwOES*&(^!aqAjrFfoVlm6`F{)vK8fCjm#gKC}YGz>wJvlPpbIBZm1_x zoNu{G+`v6;*}yYjS37t-X*9~*5p(pGXu4Hg+Qq@AG1uvhc@)H<_6k;pXzX5|WFjOrDte~w&;r&;CDc}c7{ z#9Pu>`+E36RY-eTxNvXs&OB%K7}U}w-AlcHw&`>lsa5DwO4jZ4ye9kG!z7|T)9sL< zD08@A_+jW50yr*~a7fXJ?YY+;Ikn#r^QQN}-AR(eK84nn?9eSOE-w6F#9Z9Pr_l!I z1)=dG(y#JK=k|K|1m?T!^(V5Yd#q$809POeg&0JLFxm(tV{^Rix1#rUc>Z05M6%FA z*@R!%gFcHynUB3?xz?N4Y%OYs##z#M*ts~zB0*oN556SlJs;+Hsz>MHEL@|oRG*CK zoy!6_(WZS*?}|Rlpzlw&zAr6!`~VuCmY^rxH8e7fu6S7SynB9fMV8wT96NGwiO(%* zzX(tQu`go`DJ8wRSV=!Pw6x0MzZNGsu0LEyhr)Ab%81t*s}38WG3Vf7p2m~XW&7a%IZ<})$dl{ab(7wc}t zXo|Ue!3J3!#Z^WEGG4waX!!&|w$?c%~H^hVg)c93q$M3yOkV9Vi)hF1neJ6RI}&|Rv=Z@g6V&Oq6TSL9RN z(Z>c*!dP`pt^Y_2e?D=)0ABFLZ)FM5*(6>>NalO$#Ssd@7D?G){c#G4x zr~SQVTRn=v?D!7Wz8NWpqRcmIb~otL;Z74B4V)k70zzulwboYQTIaaW(-$u z#Z&grrgKN&tDNJq{>0hr!=ac=G5!JtIo#Sagk@P?^!_N2F0f;#pcW9_D>~^Fjje=_ z_bf0GxCV=VOHVsML=-4W4A(VE38Ce=t?HtuA_GS#ekLjDI|AxXg9CwR45O||q7PCV zG#S@C>r(wjYEyPba>C*Lq0*V}qU*!KAFHdoKdIJ4?mwIBU5Xff`+mYyX>#*fXK5l( zT3$f|d+<7OO@l~`&vY!(pE4>%D0dE#U{N0znb2vk*B7O8 zx1FXvYWkW5Ja76xWHEH8$O#Cza~R9=WhT-ClK6=-6y#D&*mTL4Q56A*`QmL}tQ~Va z?B$Yi1Gc$6^6LnnF{i$o!@lnn`1Eb}l#d`;OP3m2X#m^xK_bKhQi+}!f;~l@a$F|R zwPI);_O<@!4EX2tao^63wsd^?Vf>=_x0gi$)O&ZRmp@R?_y%Sa$%7H=9BofCH`zi0 zRh#_XntUzhcnWETCIhtg;_|+=zt6n;4;#&-N=vkY?fQ?hHJ%m)9_)7>@0tC8(ruw6 zT-<|y8UFv3D`+>HYJ&S7g%*Etu5);nklU!^HGiV|cY>6j6U0ctSpwh^$J_{T_)fP4 zsPE6|J&;pcI;U2x)?WPKv8fmR!j%~N*OL;aqk9q-oRi8JQmyyC%WxMfzQQYh@sXbQ z8|9}Q{bAxl-k)1{a5-j=tTCsW%Ssdb?|iVmLz>Y+N@J{-zsBW7+iOtF6l@MBfg9M^ zTSVN;{7OgGKj?mLBlO2Ypl0UH75TR%H)l~U;i)Fi5(>2HQ`q`qE|DrxfAIMi+!un* z5}a9FF;;YN=*sW}!VwdUK9IX554Qgm9~ql8A%U9BZQ>lzgEkSJ0A^nwCfHgqWZdEH z(cfkimsi{TD_Hs*nz#eSUwjndun2?B2{-Db_@BGwk8yTNi9s#rcw_7%A&YmO2*fODe?dxrh>{r6(3vT7iRCN~TuMhk?IQ=*6AAZeX ztY2`hiL)cw6*66R}D}DN9yWBsx^llE}0s8`F-sm;xZf~nDx0Ypdt zqyl35d3~_mzt%wU*BV4VrSA@=uiZIOH2qt1=D$+Mzq086Y(vp}aitNRZC+0k*oq^8 z(R|bXYF6(P7x@7qBmCc*?R@+0gqLqTt%#X4iwY==Pkbrjs`TyoPb&A9pDzd3*&fV) zp`U1Q9$eY`aQ%A&=_l2C^I7Xps^9O7y95V5{rG1W^%aUSL?M6IfZ^MLe!xOSoS``LHD{#uRzlXm}|-L7wX@oegIaZC4` z;{@M4{z=6q{|nV$ckg$71INcM{-k>RgQdpC=dWw+#ee-j4CSBZSgiW{+hbm2OXCB5 zGj_h0;7(|lEWZ9w4wTvN@VK+L*tnLkZc4KkSc0p0@bBFOasR>u7pgsQmF3b1UxP(( zFNDWvB*vfUsfZ6W{>En%HdJ5m_$}4@mi(dWnG{usynKO;CN&nLG-2Bj@nNTY;_6x z|6K+HDHwYbJU+?EGyI)lifE>E_@3L7;(iQY7i~(@as=c!763%#`A9S7Y5dr7>Zz#U zV34NqVYt6m-K87wIq#Mf_vk*5!|CACN{kGTXnEk3X@L3BAZ%XrK|PZG{nRx9&ShwHO}_S^k{G;82d|#yJrYoG zu-?Dl_l94P({|8ycp3RpFxj$ACU5g@GhMd1)WXIVjUk$zHJ3XTq0(9ev7-A2O5}PUj+Qi|n9w)vZMx{t5?!8QvI}O%cs$ZyG9zDCU zr=Xrz*%TUh?IC&u4+0CeV3Th1uSW-}3-NN&MQ9EdC-qzI@U>B@HH~W`ZwDwXnQudf zm1V7#dfaOS-ChYpq7G|{dwq;*>-t$Xnair)_m&9;?rfacdiK2X2pdxichYh0CH1ho ze~sb&`np0=4mdzs18xYAl)PESUvz^#iY*U9Usio-P_OiRvFpuc=V>=IGz6k4#wtBh z$66r^ADw*cHH2d=q5JsMi9?g>3?&0)I`gsRNl?c-B6{C6gtC`@Wd`*uXEVCw^~z*(?brKr|)_ytZGxW$f?%o+ zEQIakxzf_(yN8dTw|VC_dh;Raj#uR|rVIO5i`L6Y4RH$JuO&N?tBlzx^q8%_g1B;J zG)~xYYAPq%H$+6DJN~^$WBQpW+9+J@N z54QbvCWVeug8f(rUT9i`l}kr&rr)PK0$9^_`1*z8Ehh}%!vVM(w}?lb zd4D$#^*1y%RHzEz;Ok(i3mj~U#>y*~A|Wi`G)txH=pX?u|7=)cc!u9eSmL|sVguaKw(^6lIk6y_`(l3i`cU5>1$Na2Dm6ddAK@5j z*7Fzfw`lPQ*(SuW*OX8ITr#hZNmB|CndquxGT`K@_nC~5L)H?E>Y}1@%CU-_kUQ5F za_xLYDx2**Y%^ti73R%#S_Rzr8MGqXmsJ|V-nj`Yws7jbK1Hg=qTeop&p7SQiT#^$Vu=i3Y#4{EVNfVn?1x1_djH{T4r+=G!fx!skO;QS( zr!n_Zy+(})__|S|EfYumxXn*0?C0UPi}7|krKL{(k{A8k-X^N~xAnUEEM>e#i%5(R z?`KybS7HE)&50X$ZOI1z!Q!YRMPqfT%+Y)mbco+j;H1F;0xV`hgiZjH1+}DtA+_F8-<0hLZG2VcGzO!+2}MD$?jQi$ z(EciScIjy=lLT>9MIzxa&DJeJM}5yf{VYU0S@K3Uv7lXWGM`vm>%H>Mun7OO)PGU; zHLjAJ;ELzhUB;_9i{vn17#_$%%L}s)P%+YQy}=yPl47<8)+UDU2LA_H%4T&!>}f%P zr13bQd@Jhq$}N6{SC5WXn5>~wlR7G##rNI~r>UT^Z_0C_o?zblasSOXwQ|g%Ye7>_Q$S%^Y--td_8*L{dELvRMW=nS&}tOAu&gIK3O<;?xJ_~*AurVE8F@Rma?)lp|yEQH^mHZ%%kyN9!4_! z@V)aSB9wXa{=@ri1uo_Fl^$09de!swJy?n>jpS-c1;LKY7BPu>fQoWq3iJT)bCzIr$ zzJkb~uZ;I@om_qs8{@*YFYw>79TF^)l>=a;yqA`G~WncFmIlquW}6yXT0f z65@B*C26rsJGw(7(d0=+wTgLWV8Oc6lyqaaZyyh=-?@9@{B1Qpye)7P{vl{=GPm1h zmK;%`c0Ip3SRz#|2UyaKbP>h>z)rch8==oMDt=OFed@pMPtM&vj3X!JW|xtctMjW< z199`JfBA2n+y4~0WSN&(PgHw{9_&s-0-mX9U)N(Wx9C+@Zo~oND%MnV!EM0(`?LYU z6!M#U!#bv;Y#YrXsS~mv!nz|`HZl@7n~nK*7eH2#Q(ZTf=J>EjwyWLd2w_NLOA3+f z4tck$j(E2>tpb_kOdK|#sNB($qSJjpt?!T%Zs6ff)xQf99-uw z{)jL4X39S(NS5pTN>{|KcpFoDdIVnhi}xsj+sO!V(#v%C{+r?Z0w9b$9`?@pLs-{F zX`Q!GfU%4K%neF$7OM_SUsm^gy+mWa_!bMDZ9Kg(v7J=Zt;!b$RHm&>V3)}M20;)U zxfP}*DsCWAJhotCtedG?%_x!l!Bd&B~$bl-(%BBd3btL#%NLZj*nrP#_c(nW2*zqV(NZ8Y6v^&A4|i ziN?VGW?K=j^@v?!^~@Uy{`4Ze#(2)8miY_5yH-eQuAabSp{2)PV>yg77REIoAB3fz zxp(K{W%)Tt%D{HU*K57Z9w66Asbvd~*Ul!#rK9TW)s0J)b9|q3%tb^Kx}Cl-Wg-lG zH$94;4NA?c16tnz_krkTeldmJGjX>7@+85&l!UHbZnzd9q5)~azTsczFF2tDy1`@w zn%PhrD;YK&C))mE#2m$L&G^Jp?`YFa)9jSd8x(_b6kA;v`y!dZbdnqPBN69#zy|jq zK03vGmt6fOB=03Dq@5j-0>S{FeM(Ab;4hRIbr!85|D+O7NU~IX$sKm(bWXIU`#yue zo~`-@-pmXv&pQTACimUq-K`Im`m*y-gXD;)j@E_3qszaT7RV3`Pz8A=s~`M6k?KvM z@yVR?3MX=HT^o3Y2q&-z{a`Qgkh3A_d+K5`E)Ak8!>af}Ag2z=-rF$%`%UX8x;bpg z25YBN!8MMybD>4oDx|#adcX#EdT0Ek5tr8s8+*`Ki}8|j7BtQOj+B1-V189mw>*?B zNvCNmt$kTA8Rv6td27o@AWmTncxPmzu+RrxQ%T$QA^@19#>9tgz`e91He5Gw#-$dv z66(Ab+`G|pZa18Dq72jueX7siRj_~M;}g;?F$1BemW34}3pN6#X(TONxMy2k%uq!A zM>-43?cUXVDkFHAir9VDQ^4AEx^@+<8X99nI&eH}EebBwt;;6mz@`gGK*^iIM-cPt zV=iquNf%j=z@pzAbKW&}k?1>P4U-pkhLI)en{_y-p&>|T z?g2Pt&ey`Im9r4v?Nt%gof?bb(+rDZm7K_dIT}n0zpW@qyx1xG*M0Mk0z|PInXURd zP7K>kvAKA$j49nyPpI0Pk;J@k%o7bHVB7+15FpDRbfS^@@{U}8vn)qGs54a}{MV)TF|W7zrT> z`abvKXuUC`=xSrS7b622Trea)=)RfowTMRMbt!#u$_Lujz3c=&;m@p_}d}geP4YqjDNzuDq=RU#I30+``^mWVOIV zdiF#n;(7Q<=@RPvV;!v;3JhW!JBH@A`uU@gc4hOF1%T^=wmKtq`P)WVk%aZaM2ZDy zM4MS(r#cijq@|}3maWJ(mV2^Mox>pH+SV#b7&_fFbFSbT?H5*B#EAAmLh_{eeY$Q# zC&o5Ya7gbO)?$%Vv({E3&6jkhFzIK9y=S2ZMc&D`YFOL+EOMeXu+yUg3&De4*x>=h zt)A-MiO*zBC*u0ph9%kDEftfgfGg8vMq~PKM-)KFHDjm8chEH+1eq02;HHfe)X
Ia1h|HP6m*ooYgpi|53!cT+`&TcWF(2NdTg{=V8w)j{|?3Bgn z!$9Taek1r@?jt?81C4qmhxi!CWA>3#N%^}?w|hxkZQyW4=;Ee7H^wP+ElBP*<1jtFTr;N)6GYH;8)flEcq!0)9&uG$SY4oNQ-I< zLmDXFM2sV1Ab~d)1u0@i-5!Pa=_dNjXsR3Q-1MnXh{>AofkgIzV%tMNWGIvzL#omy zPnIEVDXqll-kAiSv50ApRlr9LBnT3trseGM1)$SXPLSPh7zrpAgI?b+&)KkQgn zxXiAYp^5JOjOXsptFWZ2doU@TIJ+d=0q(JYsummjSDkV(c-+G?S26Ko_11IKnS;x; zfy)Y&CEllWc@wBlXB$1l!R9Xugkpp4=rP5I)tAkO*q>iB^SJ3&L+w;=L+&-4NJZ<> zUn5t{a}7JY^QaDtz~As~GkH3B#@G|`Qn^W;kjfJypBB+49?1k7U z8g*_+gc*unZp=ua&a`cl9$xLg%1P$Kn!Bpkg(sZ9#g>hRG0s4QzL8conbq6GkU=B) z!{eswV`J;OedrKeVKP&flMXT!V+g`Zau?wRofez?)mk1`d}Xoh%?hOb>d66-pQW;J-4zQomJg-*E4 zN7H&BqKb17cA{Ikv*u&vDkiwd-&(@EA03iR7{V}7%p~<6xneEDzj0={Wt|8Unjlj^ zK0Zj`jF)17I!AgECYfnD&z4xSRVEBLNfky7CMXoG^8*cJa;q)i!|x|Xfg~L-wV67G zO&gcG7p3}@i>aA<)HFiQ>_4eM(e4ML3x3WzQ++;A1p!tuBz_M0{GP=B~B zP41BO0)^xve3GW%ON-0qT~>ol;MW=&=x?%2{{6y!i)tf##A8@V(^SiFiQI5pDz*Y} zHeLMj)ho+yx)DT1a~DgOK$1s$`kgso??idf>9=oA#};n{7YoD;^n#ln?rEd#hwFhf zPn<-iTs2+^T{Tl$NJ(=uj2>TzY~CQ-VN-X3MEkw=n{~HxK5}O=yX%T*9N3eU;)B6; zZ|#yLx>;)bhWP?KD{rQH5H6!j-`HLmk#5L=j#N1Aak%FXuXwGYpO`9Zip&(|k8M{6 z&+WC%oY^h-jU48tjP|+~->99{l5(#!%3Z< znV49pr?8a#LwTJx?Pxu^7xeA-h23|;l6qfRI+0pGTju=`0hSe3=e4yr--LV?w_ zg`%HOU>e+1l?7vVcZc|g_(@U*crlDAe zdXt6L=1BUVRCW9c3^48G^P7I6g#IYc%w9=+S-4LQbr=}bO5lUHjEwyl3RZSSQh%s(e#did zO3dBB#~!_ZyV`YMFv%iejD1%qdd%R`sBT9b%2kQxf~C^iTtO4aAa5$42a8bQT%l$& zbSb>~2N!l{<@srTm#Chqsoik-6zc|lS?YkzJ}K_i?0nl;;j@h8T0tR$r=Sx9xDFg_ z{NkN)nape*<0c8+@c^xN_}oT2f&x;ADp3&y%+7>l_z zwdUte1fnYMo>K~$p*x`)**aM0e4MzP%;eT)mH^gZk{Fgw67<&z+YhV#mUBJw`;Gdr z856*>`n~!vDz|t8~_CuxKU;9K2ykXf5ruijh zFqblw)%ynrdyAH9G3!>Wt92g))}N~R-w#%LYel0_&hqNJ-)=4EH|V8$D}i-k4f(k5 zufBRLM^G;1u+{!AQp$f*#r>s{5}V{s_$+2`_C?)(W5SYVyzk=4mCuXaPdb#^V^6d7 z@XzG`cr0pL{gbLg>5Z^y`g=LC&G-Lt05&?3;8LI>*ImV#6D#08M@QY>_mHpd%Wsz+Ew%>@@(h)-E}VCGh)us-deodG zs5`*=;Ar4Kj&)s3DZKoL_0!PO%b)&Z@BgCZfB($XDdX9U-O+sszSgh8{i#=-X%}>* z>#ng*dT(W|Q#$pFjI;H=NRO4XQwbwc&F$hTD>@zM`@O z9xk6`h&w_L!*<#9NLVvvkiJ(N!`#)HZXsFoNCORY`3AvrCaw+@E|cYe=0g~XR_lbO zABSnk`!?%7(Y>k{GK%XtUGT;}o)GzZsTzwWXoTWM+k_!ukHO632| zw=gDunQaK`aae@w|Q4{l~o%99dIt%>)S@zSp?>&46qs5GK^u zo^9)OguOb`XSK0*FbvBWse!yNu7Qj`b2PMH2cY6{iMW%SZs7C_JkBNtAmWM4^ZXh^ zn0LS-l0V@%Wnm_9*bG!4d4NlIqt6Ws$R09KQf1rD@)J1knhxoBRB*5l<}2|?z`v>oUI6qc zTQ`MjZ~Ho>3UHL5S~jL*XkRxjF&eZOzTvy}#o3_5NqfkCb{kGND%!v}zRLx+t=`xr zmNksEut|qnQouW7m7q;y#=>npW_=AJZ!UxWYCrCTsPfYYNb$vCvNAOj^wBw4<~6pF zSQ7BA`Je3izfoD{23Rm8M77ArS!G7-K?wY({k<^5Re-z!L((- zY@8MTI`REVdIafs{BV0%6C8ndN55()z}K7^#yBf-ypu^xm0ow+v9+Kyq3)&1NbXAP zFSL|OQ%ATtmb2S^1&yjXES=finAw*|fe8S-^;4ukdKENVRIM^QbrYwh#2*}A8>Dn|sfHzOF1q;she zebT@NcH%*(!cyOM$$3MjAbJqt%)AbEI>Tr?BE%HC<-JR{<*G;%=RTv-?%(Tj^HKH7 zM`azhm}x#^cb5&yQ;tDJ4{{atB%jFVDYMEP$-*p7SVrjkdiGWCu~V_OAARyA!uv~T zS1X_G0;%T}5;}OB**C0=V$icFP4lC*GB87kP(iJsd7s?Vg&^#7g|D#KkLt7--?NtFHiQEvLG{rlwIk*>KPT zGLfZYXDn7C@JZ{G8h;f=SDEeu=t*;fn9=SCzgpXm>a`|%F=;q~>V8t$BKPmxSs4_) zXBK`|L}Y;*hb7-;0=icWIy$KPuOtZFN+=FtC{96I-bSP+tyR1+*xDhWqpmTyQVWfw zBsk7DPI8Ok!bkMjwjTmGI20+@3-B+AYJ+1bZciJ$^_Vzo7zY;LPspm}J#xMByY7s| z$cUviO2~L=U1W%B^5szuwuzoNH;P%R@+RDwn$f<`bMyWb^m^(&+-D*2I`~9DQ*%g&m#EdzY zK9zv!zYDhQNyu)PeM%3BztpJ(9oja4OqNt?%$ z;MdV_{l3;nb4Vp2<+XWw_bFpE3oaW|jCGr7bK*Gp?f2Ui^Xw~XBbt2uMr7ExT*>R3 z!}bJJMeY&+%c9IYn&k$ApH)zJBv12eKwaFkq?{n=Pbx`gZ+uTUmsI{JDF+oXN+MXS z@)SswYi9)SH?m4ydfV~A(5t>9CmC()!AUSO^^#74hlZ;oR>sso>nh!o8O9*=(N(~5j_=j#zN#l=LqbzR&JCcD zn%(S|o+!<`ID#BHoTKlxT`^kc`6i5ww5{8QWXThp^Qw26pDuajv&a(FKWm{~)4HCL zEDNY$P~=BV_40nU|=zf2L#o=!8Fo%Lho(#)j{TQW)7 z5YlQ&JqJqjj?HJ-GxA_&IrqFXc|13-#(7%Dj+J>QSdCfMDFZT68YV^XUwg#Z;p-w2 z*cQ7ES7GAS0KqS`%;6ml7!iMv`5rur7pS7MVVVN3D!l6ObvmJe_j65apO}?@tE{0x zshz#wp>_fHLw=-2eYz!7pW;<1wW)DT_4W-zw$Xf{#a&CE*ABTMoug#D;daSSDiaI! zG+0PR7-b>vCzYLrc|9H>#UHRh56q`PyUfFe41BSK#f_4Rk@{2;tubh=I#O;J82h2e zT&&=GS8LSTn2yKUO-on{L*kpP6pln1Y-IkG|w z?g5fL4MS3DhACwCB+ky*2A`*t$}C|4b=tL1XR@W$leK^c#VPlnRCwxf!EGtcLFODU zo!u&P=IO%*OH>R_>V}Zxoz>Cx?=ivsl{<iwx|ZPPO+*B>zkSV} ztPfIv+wCMSCZ;VQ3YwvEucs&0+#I)tcHI@2^h0#HauQvI@B1>vDfXlZ<@;e$+-yJS zrKZ#?`V2+rr>WQ$o6x##mQhPQK9pqgr|@(IT&}q1$$|ZjPGYy_lFOKiq6xC2DOZHzjHya{4I#%v-LVWVcBO_>$JaE3WCYaT4EavR@t$E;QY0z18$7~fLjxQe|xF9BZSY2sd zeSq{vBITzg-uJts>4%6n-`D5xa3-LZ3XW+d5CyNqTgnS4;6PuF;_Bkg2j(f%2Dm2( zvD}|jErwjh1)MLPRStsFucBW?Z;ejXnI zr=aVIwmC2KQ0la{94mB{I=4+iXqp;eP{-nEU1kQ zakYbo3C(}2g$)b?5>JtOOwH_IZhIniuO4bnxPjS8L`DXD^Fz`Li*{yuNGzB4uIEeR z75TUW5&BLZyMe;h=akkG1xfxsVAi{GAxMZ}nN2nRtbiguQ9cmogM)=cxkuM;48uWP zyYk3-OY=#IL(bXdm-x2mvdxt6zK0MY>vnGuNmiZeQ%3`ZFZJAqlC(RPZ%Fldhc^mQ zvozh_@ZZfmZjH0Ga<;p1y-Se+j5CE-8Qu%as^PaiOAjY_gT^Dt{x@|b)<=wcxf6Uk z2Zc~ElfOsF4ABHIl(?G~eC;VU%|Ac$Ui&|H=X>EQ&mN;y56?g)Roc1bJCWn6Q@Ps; zGl3~T%4kUC`v&dwjV2x@Oz}d+&RVq<)p7P_LW*ZzND1_~wcX6eHf|1XiP$cJ(B~P| zl3FKgkTP!^&O}H?T^)uFb($(FpMfs3Is~953P|aY)dga#F0`#n!})enEiOyfBgW9H zuzc@_1*hqfyU@0^H3NCrnRj97NP<-GEKLrh<2n(Kbrxb*Xenn0b&Oyh$Kgol|Ln{W z;9rkp+qN|9`eMOzEqjQak~6GUMHlPPpo8j~=r!M(5rey7ikh0F?tWZ7NYmXSd31dWp`)DTMp* zL}<;u4D+Dr`G*2VRU9CdQBCtIGk!?1o)L2S5#N4%vTahgC$mpj$c7hIY{J#dNNU=F zc;?LJiGT|wvK;P6SxDlh+^@S-qJcn}N$xLx%WdS3*V}5-j4%iny3H-gg1(y=zUZw{O?5aeSFQ-PP8Zl2xiXSYJ2*&6U~;>) z%!AjMnt_^oq&qLw%a9im(+?dUNztNl#*EzS*^~9%e6Ic@0n9)PBa8i)N%C;`52U5- z$%nA%RRM^Acmm>0OzSuXsZkstHx)#d7N%dqb0GmBin}AkcgtNNFs){Jxm%c!C#?h| zjb|^i(8G+Gov`~E9>--p;Iu@O>;#Cp8;fOxl~IrM-6gf27XnT0-nP#_8Mdh&r*)SW z^6eVxZB@{6V;|~LfNyshY8>I4$fq_C`(R`dc}2xL6$3K>MVx$JzRwK%+yp7gz+9g$ zn%BK^oAqG=`K(LOcx0LPBfq~)Num88|xat>FKXA8+k(==fL-31Z9IV(MM%aUxJ>+H$IyuZ9;_P+M5xl_Y z)udQ)y)K|Lkt>OF*+O83LUA;C-GMxM!qgKGKu@ejl6!b4 zdujPMM|{=VKt2V~AFGh8A_e7F;C~>dC`l~b_TkVs3aqtDe*L{GgVoE$z979ieqpJC zchx`<-4TOYT7}ob5Q)hx2M&eh%o2Ez0iWDS2RFn`7?5qGZ;FbO64&{(Z>1;+J?WeS zrKN4n9RN4Yu(M;bDnK63II*_Kwf~E@_YP_@?f*u7_HlOw%SxAGq1S-)uB%c^LcjzP zAOT!D34~sxx~l>bdKw+2B#=NrAR!QntMn=@q2tn}DosF956^pkf4uX)=bV}MH*>Ck zlDU()Gnx5bbA9j6_ft$q!+9rVi|3+>ompO{nqePk9{=3F_*HKz*%_+W@&J|T_Vpv@ zO^aF~$VE4h2 zn)Q6>_38;qtGySFwHN~Knd38-_3afOOaqj*gw$mgxa}2j#?ZWcs8hlhcS&lZP>Z?& z#a~xI$=7f(e`!3`1i5}nxe`OEQG}4nP0j>pzNd&ALuA5Nyu)B5S23jaTfcFD#FB~M zy<4Td#jMOL*a@aG1X&I^ci@Kds#p??J z&k&6FiKa=ZO)=yZIby5OuOi^oHrrHAT_BfrPALU_wt$&SGRdQe+u9b&E0ze$9AxU0 z&fz*qqeYC);)Ch#8bM4Au)9Z<|za%1?h)%F3n-LXw7nWy)t4+*@3wd(5k*(cJvOqgR4Y1<#H{SdgH;uH^gibohUnc@jk9l#OP+(6 ziF$2D6~P7KQP=C@oOoYN$PzhT{gXDeFdL?S5VYrP-MGt>I|_2|8=*L08PZvTa`iKz z4O2g;U+Psj{81i>;N)66A=<%Ul^)0|#+K=NHNw__Jq%cAkZ-tX$9r+r0AT+8Wu7LiRp2d~ zzGEMZ06NR@sKbxTkAtFcyjI>dupq`KOS;mnI4nZ&YHSQWvG}zMQGQ`TXX{y_yheCp zjag4*IWX(Gae=Z9si88?H>SI#+oC4wV-1h9q$t(!7BW#3M()gBVte2Jh@AEHE_B>Y z)NTuw(oKf*9z{z8f0<2C9$4A%m8!$&7#xVCfMbv4-UwbJwyf5ux^(s^$$uM8@7p3-Di)xP#zE|)*{fMcJLX(W6f?Mj8ezZNn7wU}}4 z)>~f1h2Y&)sYyt0=knha5n(n7fN*=yWU_YIm<`hNtlOgLf^g@3se`DpU9YsT+pxwhqyYHVUAC;NWdm_xd?oz|c2-D|N5>k-U?F#BAJ zYN{VXs_B}#yZ?HhL}VISiQ6U&4|J$T_dfHM+f!P!4(7f3;}N1!JzUHsmLr7P&C3$U z+N)Q8DxXwSIgTLxGHUN<9>UTL@~|-s`eU&aV?0=9-o7t0A{#=opg7iO+E2 zei{K0hZSn{wkxY@c?0_5YCV+Hy@IhWU#_3Mt}Q6_^Q32Iq?l(CEJRy8zW=<`lRVQR zuhxHO^;-nPV|c#fjvexMFp^-8#bQIhc|7ZG%FHRmp?6F;%p`h|YJ(4&J-(@8Xp36m zUbWi6dtwC8_Iy~XfuuESH|&a<23Zofu4aF+dZ4(iqcP$dFnHMVUjYNuI0*VCkK6El zJW~*3E1kOBmIvUACD$qfQ9YG?t zoYWQ)95#!`Xo1dOkUiZ^>l*wI#&}nl>*do79q~J$TH>5C(A<>Y+JOF{8QG}fN)ZgJ zu!jod>=!Rh*@S`eS%!v=bVF!gZil(?wm%dKVRTmX+=C4sBfI4+dL^v#l~LzEN;$4g;#_#Zp-^ss2X-XpzWW#Vo_B&rJoFyzR zA$7ugo_R{8`KR_B$p|p<1~|Zdg@v9oX`L6RsNix z{|>G05RRM9Ara8N`~#^9_KW476Lx_s%+dIg6myr=%Op`Q13i}V1X?LAj@%Hp`3Nys zXxi@7Y?;burZkS~*}{wIxccs?&FVRVueFqJ19K*(48{9={>j96YOItlILG5rlqbwh$MjkZe_PP3X!{H4{ek323xpv!oUnj z|FxKidl>ucpxML8;4b1(vgRvg(dOF6I1X6CzOYkK;2z;D>(9iI(rZ0ZE(B=Mxi3cd z`%Ftz=TXjNe(~IVckaehrUT@BFh?dL4Icxem5w_)P%El1)nbp6SYY`XwIclBe z8{&Q{$aDm7a0eE@ZMz@-Y@%X%rgvQq40_kL{c_8-e5!TsT=W1WQSiS{atgEvf!Jl@+p zIa)+ZurF0_1Z4Q>0ZHS;{vt>lI8PAwq#J=Yu5ukJOnaKcT&z4r%&^%zO;dlfcv*oo6=Ush^jjtevXy#k)%QHhM3XdAfx3FN z&}%KfpbSBH;PJ%6g`iww>n;)PsVb?J_8`y zq*X{Hu5&y&*j!r^B+O_aR4vK>dX_;ib&dZ(cvL`1D_fT66iJiW&%@{yxic-zrD)T& zG`M5eR=L~TS`$ZfY8O5UXvb`x%3ziDH;>Awna(NZC_AiFBdRV-5!I@FLQQ zn|)CKeOpnie~9)Jv`Y!k4<__IE3PgTjQZrh!&>MH_$Q%6t^2$ELt+wkaieWypoQ{v zZ<1Z2->Yg*#}&VNPA&8s?3K2dnn~2v734rnjkuhK4@*_kKRB+G<19@x@A>` z9rv z*#e5j#C$1Z$Xbjy9D>$?zD}FMRj&nS(HllrIOmdooOxwe-0pJz_R$p39=(|-*$ z|EHHbNhju6dwlzVKNU}}{(HXgnfLPO2kDE$c2WSs$<#E|wQhF>+4eBIBFBn5ufjyC zIXp$okOot|Hagoh{e;Ot$W8A?m*59k7iErv+ILAuAExb<`hK2T71I^BAXP0R^E=G5 zx!HaWmHvqLv9fBXr3K4HTFkv|>>(`Wx2wgyld7n0-Q z!ZMALu3=y-Wre~5po{--xBn&U6N46!>|Mqz*3GU)r3`y=o7*vPM?>|uOF!p)MqQoW z)`8pff3{C`7spW9_wxE^1b^JP0~%6TbVhu=*L-XqSoT)xa$7Hv zLL#sEI)Yklj6}jn`CmG@Rd&OJ%L9K959M>bN%wn>=yMor(hxp;Jg+r(H8eM0jBJ<| z^h^2`Z!P?ZNkWIc<~910`uV=dMC2>iE_Z;SQ_8b?i;v%26>S}{dZRhpvx2SaKr|gk zmSl`#T1n=$vS|P|2x2)L(v}?Dhpy^GPe0CcdcwJo)YIuh-b%Zj?yzu>R6A28zaX7Q z@bjpgaudGamu-f|Q=O2u?Uvb5O9|&!bM;lLleJ`)@_!PK&(68 z{?fh;$~EP!bm`U~CqY$nv(-95|D&SbS_J~?z#an#O5AB@KI4#ZoMkP9QF6M+vX;%~+pzK${nfFKd4@*iiu zKQE&usjew-B~y3P@h4Nf6rR%wdA{l!Capt5o;P+V5!(E>M@-vFq;AKwK>75`qK=UJ zm)#0t^A)${>O^Cn*A_YODC2T9(|oC$xsw(&Ep@`EQ&IM(dzuVv#m8rJk~$ryGrdEn z0j<;XBwjsryEB)lG%}h5>QftylAC|6;~3|NN@+35y3pp*w+*4A^86CCxfDLl34EZ7 zlbDBc)4jz_s|d(1j0#7&q+c?7BAq^T=*+Udj-fRoR_#UVC&>Ar{D>TnSqTuan&1Ta z+Oag>1{s%QY8{R1HdY_=Wq4I|-}La>cYJzat9IS)8T`(Zjs-V^SzI`NBCKI`bz5et zKs4&g;&SinGJj^?6Y`exwQG|4SK<3Q)Ami#chfUU7s1X+x-M`AbjBSY_lIHfUv^7% z>S&c<%oOz?12a*9N*uD-5VTKNT}JlzN%YsN|T3j#>pg zJE>n*4ubql54}C5H3O(wHZ7UuK2+j;QDG0XHWEH_#|_nNeHhY=KKi>YTlk zTPU<-^d2}8Ktw(NfVU;_(Uuj2`PA83X7WPqZw#QPV-9)M@DWqJK40xQom?mu5W_3p zIepgmuld>#;P+0b?N?6^0u={hK-Yr61>efuP9Lht`bzsHPt=JW1rI@YJ zIxlnQr#JIRfg|qXW~r(vs0&G;S!QyihTXVIV+I6P>-(v*F?ko>#sl*k0<)5_v^Rl?jV!4*$90J1fzsktsgcKe*gCVC)ggk3qB(mQJSM|2l;K35$|qR z>@;zrld7wDXMb)|SM90CDuG;E+U_X$$7J@dJ_FMb92ddyb0f>MXvAJ3|G?^ zQGoU5ge26jPy{}IC>};XT$4`mv|Ar3DPbhJ1vv&p)joPpxB{dPF<-9JFqmGIdalzV z1fy&)?Mrlb_iC^ifYH{~f= z0S|hFa16?A1tq~z#&RXto;Il(qes~RUX+I8+Sjz6Z6yKRh{OFv9I)Q2NH1SJld)it zq!~yR#Fz2KvjD~(@@dyv_+b4+bE<{io~KeIC@5{&sU+(*0y44*(nT2IX9Bx4jowfX zkr>!h@J9<(vD{@#Oi}KF$>a)rTrbG)-i?sU)JkxqCjyGPdaN21Mp5MsS_ad)^8Cik zCD0PnP~V|l4(yo{^0EUe$}Jb^iwh*2=st;B#3@hp^jjN-)#&Qv`5*OOS+r@1^`*C6 zs5wr0S7RSsZeK6e6oo}V@x=nx%uE!;Su4j@#27-NA%gQ_RXvS-sNFoXS}Erj+M;$S zNM8Z+p^6ts_{qp(LLnI$KETYkZzYN(=Mo|;g=JNG*26;Q3Ye*lr>Ms**V*Oecd8r3 zb{!epo)Z+0E8mg}@B`V}%NEb#?<$HuyYV!O*|Xa_e)~KdziNB=ILoC;C3I=&1C1SQD1s$s}wf zpptB5oG^{Q5ztEHyh*5XF#uMqC4(5%e49d1>t~)gdJZ~G(_iT(AbqGCU1lM{FDWK` z6#2Y!C|YAjZ=qj4;$j#W829QplU?5BSHiNf{prUUsbrTNjp+%a28HF}PNSck*s!;u zxg+mqHU{;GfReemsId1w#3IG8AOqNTj8i^-*gQ+b=-W|;!k~^2mK%b`y$(-OI1FkA zAn_e4dyap$>^T?KxNIZ1acWyGD9glww>wFMVSz8>)e;%O%Z}iT#S1FpCU0}^mCnn} z=na9m7We#SviPjUSVjOo%h}3a5F3Oj-w3N20@*zXwFiq_^_9=r-jF<|cOEKj(nj$C z0{yKpr`9H*18YwN@H#^~)k!aSz0z0`A%C^$94LqtnWo3+)|K~xM#74^HqL!*06p+; zpBlzkcU7fzHKW`J#9}JR6EZD{sfbI;Xq$k=Bw`IuG@y5o}K=4ek*GsDYASa&NG{#t-WsHMpBz&MY;1>;gX9s z!W1Pg!)XSLtYtB$crzQ>P(vNg=klQO$TIOJF>g=panbVtiY9S6#xln4x#jJE#?@Qd3LOv;KKW!<@eDJ@ngCF6K#lh#=v&s_I@s zD!p?=3fRC4%9v`B5Q2J6LH_D!jnwP`XoR}WQ>t|>O6xH|^5XPuK&8IInD5GuGwigl zhJ&g8Yk^Z_0? zkD9LPI4qHgGwGcG$^CsdS3h+*2QzqZZ6LP-w>%L1b~}bgQ-Z044Y2bh1INuJ*&R3Y zot#SIuBvuq8DEsHLgmrWv_BH}oOAjgXK`<8T6wMS$z{p5TXf7k(%q6V>69`4iGzLG zuWbb5zoSOFYF%GzlT+0qx#U^dbDDHBQbA$)gKAF2+!stX0Q9$8@V;A*Wc5fij>-f{ z7*A}5D=RzF)7aWKSKi%hEQ0o;RhKG6ZiVR>&D%ITcaE02Bepu^Une{=IH6;TN1_LB`Mhs8%*>tNq0_4{HFUH_ zvAwUs$oyoxl{^PwrNmp8rZm#RV6gEE8I~+CREbb%*Rp`t$qR)XCAmEy>o1MKMx$oX zS^0qtO~{d~lsR$8A1?NKI-!kCF^FVjV_&~zh;~^{z%vi{-bRh`m3%7<4+YHhM7tWP z)(XhwIrcoU)|$E|BP+89emUmuQE*i#*xC-2tUO@9!yJ2*1uu{Z99LQ z3BJ7YT|}h^&FRhDy`GoDA|0`2)WT~-4)w~DWNP0cOCWJN`ZD)8cG@vHSpT*Hr3o-v zUv#BIDFX;f)$2_O37J2~>BK_U+Vm6ELtE1(L4$s1q?<+L*3y!V7HEdKqf#xQ-1`7U zJJp0XsYL$uuAf&d-*#+L3G0%JM~8uu5m=A6FX{Ip#d#L+Q4rQi$n`A2HnBKWP5**v#%l}>KT+((M7J#p54`vATToI zX>QelGN-_ga!EZds@HmDgjmVR#HZdCVfyyq(e(^1tHr#NF8aGw*9o#>n$@4}4Z=Iy z>S{}`=HJyavOK0MT%T9@v?(Q&mM2-Ta{K&e%c?K|7nb%7ZGW5@KeuA^k!HZKPMrv@ zWQbH{28`zQ+0BKLlU1sV=#{s88lPqu5_t1R6cI_%k+e&VYk;pf%zfgvRdP5*rn$h1 z_JGj-&qs{mdabTF9%yFED$A1M6$mSgL}%u^tuv@{(~x1nRL-0Fc~J(Qkyn$Iyb6Ps zfMz@HLiBGPKTR_xIJ?xOuVj}t5^Nn^?R|DfY~9>580j@RmPr1F?_=y-;=Fk7=UgLx z43YAydxwbuQ$D-sU6deuU(6G8)ZWF?)Hb6)4|3=z&|_!7HC) z@N&kt9{%0*^x-2`$WQWn9p)xQZ#?%k(}8wjpOeq3Ab}87*xkI_Q?tb|IOyQbV9cg& zTEnF8UgPUWDOo`JF#WU+MboB$8=-YhkyA=vshQ)~Ddn-tjIP4?Q}dqHEgA@W${M;w zxUIB=6@U)l?G=u#_1-C}m9wM48Jr7{KhK<5_#PK$;yWwQqPp087_l6y*qtu(v1|AI zd>8p%#^dy>hh{H8e@7%Q$I5qi1^qaa@%WNcjq&fH?&H7zPpHm+y}i-?U8e8&*%#5j zg--8$=8WqlO{WS!50Vafg9-@l~wc<9d%$^2-82%=+YO zYF;UGec>aeBE&p`Uq9yWw>um82pl}cyJ~lhVMeKXPA$mrR4yy9BGr=u!2C+wFiX0rXFZIsR{@S0-=$ z%Qy3(J6xrr>2;Dcy>d$U9*$jvpUQZy{EMN`PpQr>wZPRQ37y+@U1FU zSF8jZyP1v=?9RP zrOC1(pV$km$?r)y8b`g+tYo+K~JwD)R=xOlc_tcQXfSl>E3vjb(N8nHrxl)%jPu;N`k)*7AgC1wBOMIR5u*nu!EH$OX3 zm|jH098e|%jxK(hK!#0G32ZZQ-ysjlQdsYGdnjxJKO20CJWfbjns#VS()Qe~1sc2x z?Cb7MR}((`>^XfRUHVZiBe3_8Vc1GQt5efPcjg9fvutbw>e{u3GqFe?K%WmB==gx7 zIV;5S$vmfAVS#5+BL^zS^eWsk4%r7>@D0*w2#DUsy^hCd@Rd@`9EPA!zRN|%orxDp z>LEJY)aYr8SsH?_J(lc35TbIRNU@)5M-wa-?>pk{@Vav8W)+{4%RZPInT_G~D|~U_ zI^(nc6JOEjV<)*F(W%Ft{4TjUVnY^g|AIeQ0PtQoA?)_f+oqWK0BPru;WVJBuB=XB zg6IAj*_P8$SPW1k^LpTtzS>L>QQ5hu^i&RDmHzIIXp%iKxm)a)ib(j;WlvKHvvNOR zCLhR7e-^8XQi1xEU_r7vIazl;@ORl=rN{q7EtfZ{r6+*n?to)semQV@0^s9bn zBq!}B3@_qII!c~pv=8I)Q7=dg=C!pLC*nC(?SN05LxAtU~9=8xU#! zuu)lAo zp&ja6nLFDUWNiwuyPF2}b?a10&4cn$AEXI+6+??8@7HIRvxZtTjbC%)eWJtb8~4%z z{!ZCx53(`Sm$=(tt?JxoL0Kt3Ftz&2VWTt)Q*ukCmgPep*;rI=x;WcXhyEq&FjMd- zo|-&kW)^j928F%g)nYcB<-HcnJgF02st~Q-%cE*Ve4qyjKhC%+%K*+1_5~u(vh86^ z6-j^uJMX^kx@E%%a^1|svU**1h)+hPss@J4rGKDj_bFb@@#?)erWLh5Wlt?7jD0z` z&;O8fy9WOJK{0bwpji8A!g&jEG_&X&peYn||9NsrNy&#_vH#$5L3S2Nd?J@KFa5jO zN0Z;!V^kgE-NM8Ut8gtx%&UP3xog7e|D!4R@9Q<|W*?3&)|6N^70!mD32x&Sk+Y#r zv?|K;EzxJOszDz3Z(cIZ%U9L6&rW|8a=#aqOc=S6MpQn`=ygIO{dgWIa^0{pAcpEa zWTyD#`^lfj68C~9Fkrb_^ge!CQ4$3nI>{}13nF}fdgEtBH5t7xGI`X-^Fe?-NRhRK zFq4K}@ROae0GeJzifxRERQ)v>dGlZKsJ&msN_sFsl46xYv5$aok8qVrkJ?&TsuA7p z(csNgs!RCcd9)8^DCLRCs(Hzm?+wq6YhV$#H@^Hhb5Hj_UDE$p{|kBf*YEFm(o=tR zWsmpfx-IdJFQGH+mY1=a_H*wNmW`4`FWD;$<;D31fMe5!ifd)GJ*m?&Xd``kO3&F6 z5ea}XH!w07ZFIzK-)ikJ2gywbv!-a+{Vu8Y%Hq;MR|F!BQ4j2lbMRPnR2Om^1cDW+ zFV|Kz+OdW+T}%#Q!7RQfv*{QujDTJ(QgWVle`vU2BvxX{tC_8+Qoj>4ND6SSNX&aE zTBVIJ)WZWyX*MDjk9b#+FV5RB&UZ%a?&&KxwKl~^TP)O~h4S*w-zYsOd9dKn{#3l{ zWfsOeQM0O}!oQFa3P~Sf#NWU_JW|*rLmX#S8H@kG?c{KLACmc)sZT zTxvT*J9rKQxmYWm zOsia8d};!^HoHYs@NZW512058SMy|WGChb2XkkM|;L`$-ea3gmd) zgMtbhWA!v*rN{mh2%j7;l8H;J78xXRJw8;Iq`1rrx7sbtXv%L^d8s#!6whek=uTmm z*IZlN5goQ#u5ZJ^E7J^0n#`E5Hnea=NASLjVUk-Ywg(;7Hki`bidms=kUXgg&{Sc! zEhrV|1_XvM_1{Gkfe$8f%4ABsDmqEtLD%m3XddnRv-DbogygNJ;FFT;;3{!UH6m9> z>-LVm@5+Y|wPm$QFW7M>YQm|&An3uUii6(ckOpqVKl7gv%|FK+X4)O|9Az~!71Y3Y zD~lQBxq%P%>APiY=i-^v8$6KT9O%deE&5&~-^J&h3WgtnTt==@`R*2uK6WK8;&Sof zJ{3XePp%I?_=ubk%@5A@zHl6d;O#HkC{it(ZS^&$-JIMY)7V*QaHKNXUvPmz%!{Yz z>3ks0XI;3Q0`Gyorz-=|u$46|lod-QD}xYRPT88FLCYnR4K-_;(T7N>_ryfSrs%V^ zxpbWI6@7t!2CK`E!Dp*hWTC{dGmUVBr%7V?&%H4rZZ z+E%!ciG{HkDFp>zNoSb`Et@yV&eF*FbR!zdf^}K)_zp^Eh_1ToCOlwe-Jb*)9(bkH z>)&3<50Thp$lc~!?N1WCXl+2kVtqiu>BcdY+zS(fBxvB{=p02ggXVEmZs;m>ue{-_ zh3#N35yhfeFl+I+ROGk>LWi5md|t7_>CjNN~F3BgKNLZyB|HQ!g}wXAJ;7uGwjR z=+rF=Tk@;NCW3amPW`FGz_hb1oSet%oJIBJix8bzB~6~7 zIrHvJ%SkHt_fAun9Q>yf7-!+F6Th!6G436pk>B5_0BX>izvh?p%c*SeP-!qoXHjko z5~#w1F4ToH9G;h@6pXwM|LXEBu6@Hc(0dq$TUA$p#EFE#{g$kwB!jP#!H;tPVI(X{ z`zr%c9#L|v+e4>>hfZz{JW7-eH*emKP8rdJ6-OYdBQ1cR_UNhlidl}~<{3ki4u~#D z?~OY(1(~4Q{P>~C`{DO$;V5yYa?&rrsU8YA;I54J3}GT_^pbl?Ezt(tS`h_#Pd|;V z!Y)9uh^dh=rt2&nv~i%Vvy`Z=-Wc+$Qc~y%?KdaK&x6K?D)nZG7mbXSmF>=1UbRuB z+}930$!&-_mn!Py#*EE!bTQ@U&EY*Na+DuB8*N4Dj^GX}?leCW{J+ckvfE<;&y%;Y z=l|gQ`~R%a|6jiS-|sj6w;TR1;{1O-Ev!k;_6r_NSMLk1cb&gN)x~hgl-?S%ic3S& zgIZKYMD4Jt;GIo*$_u8hv{_5&45u5fqB=uXahBn|xRQhdvexI=kDFw*)RMd=| z%gUIplFqt@tqZvO4~<`^{Ilu+BKKNKxyhtb=Vyw|-P0f^o^?2;7fxPfMNFazHY@J{ z>wCYvI)9;)qwcm2j4MJVcHU7Yb>A`Yupkd~=D~)*TDo{RGyR?jf~Fg48xTxxl{*zP zvn9}AFgl70PNkB!vdFmY=-nrCUb;WAZ_{%WHRM&Lz`lq{WqIXuP_>c!K%-Kn9Niot zPHf>P1V?qG`fv%3*=IC>bLj`8gf`GDO5?`D%$H@JH`&qs%GN$u^kuOmbQ=|6;Rzwr zI-yrUc!DD#P;?DoRD@mwrQbUj@^Up8@yS-`)c-}*8J*JkawKA^a1nCqoSU~+tY^P> zwP*8IZ5SoZY3B3Bn){MQSB2+V)fWzIDB;>yVP*ODISV4q%STXQjs2pzaH(p4+ZX5{`#oZ ze#9vy;`;HgpO*WCn7>+>hW_tA_R|HM1+~}NHbs8_GC2M8-)n%gx(`Cs!Mi=ctbR^I z_nss;`FKYn;=o-x5ED4xAM;uUX3cyPUQ{!>DW^vn1L++X#Uo|Z}tKSad!u@_^1NTWaTK_06h=F z4yWHBxUgq8zZH?>x>Mh#Eqb(^OJR;9JX)5Pm67@RYegXN`KWDB(nPL}V>nruc1qu) zbm)yN2G@UeSq4n?lkZy$Gn*8yGRu$cmbx8}}p1 zOuGMBI2Mrg!dd%OvdHsPRMDYK9__J5_y7doz^^qnwWek2;@-Yg`DmxQNe$$r zLSIF_|0O_0%Z|iK6Oa8cOgBXUr^>gDev!4&6jT+IR}W1<-U}EAQo1{bgqf8IlY5k8 zq5C;<&tKo+2U4d&@e8?j;rO%vbr}5b_51&M<^NBr;!kQ^T0<}|UILNe1QT|FX#sPt z{5x%3#CrDDWqbR>bFAJ!w91piwB@%8i zB2Mmz4RAa!IUyz8690#|R?wklKXu`_lG>;*Z1X#-HTJi0x}~SG1+&>>IwnBd{-Wva za@2W-eoN`{H3RCn$P(Ole6v|=!9T%Q<681BCNx{Q_m=7Wsszu5ioA3!V`bfj`Am?u z76|4&beB<@7j?c<9b)dXY0f_twGl<1?(G?`Q&E@IRIhy_rZ1(RgP(Fiqi2=U2k#~! z#eKircL@w6B-d1LLXBp>p{!x8>mhbK*30Q~K$Olj`;jX^{2 zWQQhrB`L@*ruyFc0SB^4wifg6v zt3MeXf$@FGUFB9_m4nE8%%{P+P)UcBMNXd>88&1?4WzxY&~dPdZ@rqQJ@ zSuipSECZC|*g!8*{$p$M2K3{MlSyJWQfyfH2>$HYR# z0TQJ@&e+^ZqPAdz9J;O97@M>O%lPT3k)!di*R>SHHu7Rcy_cq9tIHmaoy{&Zbbr1) zIK@tLem_Yqi1zGLmHb>{-~_L0)yXQn2ZOd_@6Wv@7l0vmO+L_6UwngSO;ri5^t_p? z{?6L4XD9&Gac9q(2Zw$whYaFpl)!PjlV|s{NHz76+F7dr%m=wFV798W&JiF6G+bO- zxAM4tD9S1&s`7g+$(Tg;`V8{k0Gzo&=-Xb)lpMr{H=j)Xs z_5Z#Q_2W#|&L5q1S=sNB9;!o9^gLfj2agyWoQv%F;BqYIv$>WwU&$?sd~Ho(IE~=Q ziBc}9F9>6z{_)E!*cS|r)pPI5TN!E)H~nhe==xL5W$%F=)#cB5 zkZ8Ve#|qCayp9%jAYWTcYnFCp{A|_x&v0Z^E{GXERDwouD&8RBzVO=e)<)ysJYj+> zmVWW(9JTN}Q7an*Oc>Bpc%Sgqf-nx-d+g9PXL(6wa`4BQqtTE9yN4q2dL5Q zG#lvXo>g3u*2-w&oJ%y-mxQ4M8~*?&ARZSP3)Qvn;Ycov;f-<}JR-H9q%ZTQb(z<0 z5OE+Z-e9t9{J#gLm~f10ub&4nMa!F?iicznySHhFz273WLr@J1-Om7YyzmGg{j*WL3NiKXw zKNM9HnI|PXGi$UMbFO_UQDFn{LU_am?$@&9uheyCiSUN$NZz`|-uQ`jYaYj{QE2A`rgp(^0(v`BgvA=9o zq#x$k)Uu~MZ+~>b5U0V=fYENxCf(_h$nZXy$T@$>uMxbC&>KR~!#j?4kT$ zZiRX3Q3p*L;rRLKhdqXXH@Ud+BS7u$3=)S*a#aFF0KCkeJYekCOcir;6&H5soQG!9 zHAar~(?m?>p%iAh1G0f<(N`w+F>1B++K*E89Cl@cH`5;IwX&4jj`3iioQMtaa@{>Z z7!atX1r^AsOSakKm2aafBvc>%QsxZtRe}Fr)@;Tdb9AvW56kB`(*0LfH#cuoP7|&V z;*m6#Xd;#JH-VLZ;%*;^FVA7mnCoWMrWztSr|&(4Vb;t^V8 zUCS6rwgnmxv;p9jqlpa_`~U{ zllmWLlFzu`ENU|!#3ZY3IB-dVs%0t`j!?o}a!soWDXp!( zNAV*bVnG@R+Sz)-IvPcEU?@nM^vOM)I+og6;6KkQNYdI^%_25%}DP#(4$eDU0QMK7}O z_v}!;Zd$m!-|=r%wzUqjI4giP76@1zwl*vVUc0MHlT$R-z7!hlnkA-8rFxbP8C{S2B?t*b8;)or`Rb0wf663Tjjtk9Ve|meGygc~cERQ>xmMC0L8J z*^BfM8iFPJ_sbsa4rpVlvi4Nb+H^45TXFEL1Y3U*AY?1ZZ1D0?6!lpB0QhZ9tkB<1 z`xQt4`Uc0epSJrZ;>C6?bm?JwZ5DnJuM0VBxVdl|(qfStwv!7RDjwCSpJ^V%t*=~D zB|5r{A*NYSiIC4D4w1g0xl?=3Fba6yDtPeykcEYZ!K7r|y}p#XKZ=*~s3Jv8y1dMA z*w;%4E>{xyuF&OOo?)j}3T9Pqn&`F>C#9PUXLKZ8d8~C^x%X-2ZNKcBc{O0tA%3aY zF5*#>wQQ1Uno=q$vvfd_7Au?irJw-zisB5wL5ww!jok}f72(JACE3gO7wG*2NC*KM zVW`NbP&r)LaCiB=PG!M8_@uN$Y{kxsshDi+%6xYUmco-)W|dC|64zm7X2sg$WiR{d z$g{PbMSF2GraxBuBE1Gn6 z1&6>mUAd$6)&ir;5Q7f;B&6L#jbm!N1EFlr6ne?YQlU|y^Shacxo7>*+Ghgnom=W9 zxo$$!L&dC@w;gL64a%vbpzbontlE5?<>k%7+6T788C%F+oy1#wha<{cj|*y*Jg*10 zA-k!;RQj}tCmS9hL)}cqveBk_N34~&hNTV+PAx6|amI2(Y;v!*Zdv|{isi*Bl^Ia8 z&%#!uB%<$JZ{#~6;=)3i0`FJQ`_O9ChGXKF^{)%6X**fGw1=F&J@@wJU;lkzI4k!J z{m6#KrvZjn6F&*P&WiZ<^i1G)=wBX@UCKccCvLW($8t){I@*?J z(W2+M&7O2k#kaDEs{oUx3L60&({gO$)^4Fr*Z59dh6E;D!LUf1`Ci?kvvr)2( zrn8A=x&dlwj^@Vj-s~_n*{IG~mZXTe_ zdwi_4Y<2+ET_4F3v$*w8+Y|h(zwCzACMbJH>_ta`4~!U+tx42-rH?MEHtI6kN}}d@4BU$&`cndgd!zCfPkSX zP4-p<=@Jr`_3QlzK?%qS!>NX zvlwfRImaC1_k)&IiICkAy-mA(jyWMwyPU;FDXkKmq#?q{wTW2$&HVM?6?)~=74DJw z)mOs`%2d{81Gl5H2!2!lRC4NcOoieG% zC<%{jYw03oM^7U%KNfXVe{1L|WR-Ze);ZSuJBw83!)d3o+tfElYhB{I-xPzxuL=QN z$ndkXMGFj9*el$QK%33^k455gQwz`eh0k0y&tL34Vw9X|V7i&6lPJ1Fx1Lg`F%O>qZl6m{mpogI;(nAt^S*P=Kh&v{~RIFt^ohx*cME)0S@4b z-*d!(Ah3oNbK*H5kdtf|AmIT?d3@7vYanMr7-CjDfgRFkC6tsGS7qxEq==LcTE8!L z*~wm2Q%D)JiEXK_cGz4&hHvEGbt@Z@m}{{{X^F|yh~M6SiT0sU8`uqCoYa?89DY&M z)`z(f{?RQ8A3O$DYxJ!KN9Ui>!Bw5Fl`i*JHXne2^9fPOFoH~@mAAWL-1@EDp}Wlh z`wCgeVNSxW)FRyJsNxR-QPdyAKU0C$LwUDyklJ)$~&Pd+?~_uMgj; z2uPT(`aR_z;=@2$$WEcSG57`^Ist!vx){Cbs?N3qmw)8%=2l%R$~K#~>q+!`t1+}(f@ z;CYCS$GT(^VUh{nUgnTgTU!7$x~)KUNwJ1Vk6CbpK4RnagDN|3`$kjHPAX?)Wt%g^ z!`a1vqf>2ONuzL%y(IV|T6I}++>#>Qj;XEQ80mmbKfq(K&;|)nPQ-xpc}wqkgwjA| zwOl${O;f=)z;Dw=ES03togr(4SPPApRoGe;7=bI>`r4_jP(LSiDNG}4*yHj)^F{~7 zSVNl|Qk2Y=)5XaWR-AATZX&7qPi z8S~C%x@{-USM5Ng+vlm921f4BFBdgh$!UA{q?f<**P5!-O0!NftD~2;)uJmsUJgY4 zIw%$u^GO`3{<7#2Q72Z}6@U31kEg1N>7p1|^gByJtJs3Yrle<=;8pYfV1wxzS4?1( zWx9%Rw{aC5DuS`K*qRWU&!cmpeqI%?PX)S7Tq%hI#{ zle}`X^;@rPd;Ep>yt-T~i5_aT3+F&uRT$*q$>=-KJ0(+gTr>H{OxvgfnCeTEmFgo8q%uC)vwo;y`wDy)-#k8FG=SlYo&VFN`>vdeFC(3T1+f4iu#CS z%$Ah8gA5%3fckl{p?)f$d;(j=f!UB`??QggFkc&tf~e#^(=t~>OarEO(AT+3GkO8! zWb4kfCxT4sAlYIx>D)QTLJf^!BZ%jq3lzBf^HaHTDB?D>ka_hFkqm4gkhU7OX+U zKPne(i10!B@Ck)Yzc7i%x0-(}t7c44EHQ+Qm0B{_xsLdn#~DRxV16$v-&s7h_)YJ4hTYE3idu~lo8CXG$_UoA($5EX1sGG~PHga7D7UgPKn+j#=^JxNrv0W#i&j>qmSaw0 z8K_@&Ji>V;IfNLs*3JNR{{n&o@|X^Y^HYOlDf=N4$kVi#rc-$+Q&(lHk~4$%cE68%={LH4DMPdZ82gF7|nro z?0GrUGpTXk#OzlN9@E`Ydv5k=vK{JA=V*w;4t4%Y)rr1YG`uG5&?6tt&31eY}5ipf{m_5QiwIn5Y6s{k2s5e^4y09Q`bcLlVnZGtH)Pec^5nhw20C7^Hp`Y=ckjzwTcWDJOmn%ZJ7l=)#qA$bdj!-u z!S})KeD19+lTSV?iIb7uFt1H>T2UqhZx4pngOo$is$k0E)oX_e#EWUaKdg&^)E;uq ztE>7amrDuXCaN4wUUg`(2Lk7_PtT6GLn%Q9*vyS*@eAiwym54ijoy=)ra_k9-}9EzUA8UwI|{8Dvuk%f_()d$ zUpMpG1B>z~RY)ig56|^OgHD?p7kn&b?O6erW^+o1W&O)Pv=;ntSmx7z*d92!F445kqz@W>p4s{H8&5Fn2mf`hd6Bw=zKZUUjGplx*mAl8n-oOErHA6ZkjZ)R5?)L&dq~+G1$d& z6dgKZ)I%y#qwcmgoKcpb_{Y?x`s<3f$raR@g%RMms9K9nj_)jT-pwf4$-st%BsX}Z zx*d<(8(3~ST;OReFJ0bsFYEIAljL>ZsFMhBTJ9u`p)|8lDw>}7rgk-!sLy6vON;XK zHJ0FO3?5VTtY|)N>jD}&v{@Iz)^2vI_PJ>OD3@XHHqnqzsOUij1usN*-_DFnJiEpt z8y#gF3nkUTt5)4g;&y*GcClVp#lg~|-5|_RAtgwrRQlkTwj#@~R%lX}Okv-uqTIxD zZk-6Hj;BdTvqzlU)?Ag9_(VwBsBX@M%7g?SS0_D%?y>T1UT-+s&H^dmZsRu)5T|eD zG6&L^Dr_^R0NzZ_LIS85`?|=hl@)Zo^f-@d3isUr#Jq##YyDU@nh1nZB!^0L1=b$m zZug+_qvYkUbvc^FIL;J_3}B{w9ka!!>nE<%tBpS{NCBScpW&RzvAuP3V{1NKW3^~rQtpU-+Kn`DL)yhTtg9RUHMJ3GA@;FNncgU5^N~1}hWl{k z6ouGdINMlC$5^ga?nB1Ots>sJBSB^k47U}F3vPrYQ3H-(;5X&5{IQe#Lp{Z3S*0;6!0bNeT-`uvAe^c#lrCGeUar@-2#TK-HnC%7wRW_ zS*kE=^mQSmty9J-y|3s*IZBW`Yc4+(Zh>`eF78<~))bL($Z&e$p)6+@Dz9_zB{N`o zAT0L6d)ud1k}H~}h84|+3BD!>3yBXrC83rsE_#W%7<;etEwe?P1T@qXeg*Pbq^4uw zT8W)AGJ!t;JD12-x$OU(efSxIUC(tAfirm>Z=;b-sAvXNaY6F3ex6h(`e)QBqruJ! zOA{1!e?}$cVpNZR(v`B7JBZuRrX5K9G`HP8AztCL=zEj??<}aFP{fWi#b&mb%RhCPCE_>Y|k^ha9Z;KE&G5g>%bMt!m>!mE*ap~9FqMsXvS+4)X ztR^`zxWWpM9NA`dgL;=QKJ)ouW8V*7YUH~(aWBfQT$hVef;(Gnf{AgwPQtBrVL=l>fz6clnebdWb_iu zNYM6WUnVtm+O6mdS-XrzYF_1mcPE>&rCu{0C8^`ibNENvX{+-+T4!&2FS`rMT^=!8 zWt#ZTgQtpapLry3=I~qcrdj&8VSS!UcSQN41%>(Wa|MzUTI}Oyn_kc~9UbKT@miB3 zXS=aw{Zp4j{y2n7!|`~pZ|u4I&y&B+JNBs4w+D7Y*Y%eKKZRZ*G~GFx z^X>SmkNwM2$K#6y^r(QM-V=juW6U1>yosoDb|>l3A?8?JNq9_p{LYpAxm&gSv5Q6p zlOj_yH(sKs1AS*qYzb@pCa+!*bSHTYH?~x{%;;S&2gOP!Z@PJFpNGXHO|Y6yoGZUu zI58e5)63(6I_mgD;c%<8NP|bUhbmQ~Ws)^6vBTXcNCRJ_z5yB|xS1>d@c6x8;*Z1$ zk4Fl>=Q#cB!yV6ClM=yhY-R~o=I)%kr&z@`AR3#PNZSQZqbFkvI>J`PW@{Y42PBv& zETaA#GKc!m*!ujkz(^Vq7r?8q)JKvqiRJ*b4!+Fg<{1C3$$M9Xx+uw|6Qwy>` z>OtjnL#SgG?29KVo@ryQ|mZ+a|Tiu{Z5!U8O*5qWKy}Kc=Ou_UVq`i`g$E1DboKtD;2+k&+ z?eZk9jT91jy9~ytV$Z8g8fHe%b=^cab2_D#Q5jQVA3v_Td}oQ1gHaCRsKm4IJWOt` z(TZuz;80bucXX`AbI5SMUuR%_GXH|jutl=7&$X5z>-^0_^YUv+icouhSBNuhkCQ=E z*j9$A}{;ef^{ls3W~#*p{;P(#|kovB-Qtr8Wp?V+}bEx0NT%f(KEm@LzEV=(8vGA zNbu1`@uYFmvI}92V7TjJY?V`!OjH@4#2Rt6Vz1N^Gv@(=ZVD^G9-~I{Ml!tjr;ERJ zcC|WZJto^hHm|k1=-EQtzOyJ#tJ1yfeTmcH=ZnWR-5;{ul6e;tV~z#br!w5ldtu}2 zHXw!KO%eaq{OP;dHJ9`2Jqq`Dq>R~>lHSdC$<{B5`4J@Kg-tiyDIu8F8Zj0;!yBdG``yz$T?_>fqOx($_ZO_&(Ea2OeuR^p`_zjrdW=R^MNlT+cNSRc~U%pCnFhe%sJau zi|jv;Tbm)UTG{*5w71Sx(Sb=1&1qBb97+}rx|jsg;OH)NZ!<>)!+~9PdC9p^Fzl5- zxk3?#V(-#Yx{_1BuEs`7>12pei^0);Gi*nBqD8PoE zOwk6>Yn7!mUG+#T?6D2Kplyiz*lqn2lOH7gK=SM`yB8*_bM;e?nMJYCjK3cPku1VH z6@BV;O7+%@EbvX~)N|q^XtHfW4kT8>SNGt3>bk8_?C6r7ixRxXo^0!-2K`j0Ymn)f zl zN@arPuKd-Z{$bQjfZjO!il1@xw6l{oU_6Y=tJ$u8Y1PJ@6p~DrM+4*Kv9+EOydTP^ zk*P|jl|y=XhQH2d)Fq_0FVqe>9fxqq&~ECjae;SnbCdz4dy{vsD7eajWgG|%!oeW$ zj2WpcfC~PQKRoiIyU|1AGA0e@hYXB#KML5M6TZij`riff4}otiKmDk?0DtH$It$;8 zgSCbXJCb}hfU6gONaZ)xW0)nGHi+O;>4=kIhKv{woAcctJ0t6V9U0B$kgiksASd06 z?E$|`=F~$U0dMN$3J<(C_l6qPCAhZI^GcmLqPL?@(`9+PJ8g1qjUO3Y73YaaR2Qs- zxMa5~z39}AOMM(i1k9p=JVoarFKYGTr0h%aq^8;r(Z(`<@*3co+;ZuWy)A{WeuT0( z&yN8y;RA6_@Znn-$x3A$iE840WxoNTHsMKZi~xhl=OB@L3aJJ*fd&ZFurJz5tcWsN zJ7KU!q@DCef_14o;MS#Fvv~^sWGNx2rv%|hQ%+V2Xcf1g_3Nst5plV-U96=QdHOIF z<7V5_2}oGZPDuzbH21j=e`GEZ?%UiBe~W2lUC7kuou_`_sCgd?F3YrGm%X|jXP>iC7jo|EHXAxXb|KZ8rV$KN{*ndArqcW zK1TJY4R}wYFvW*rkM0AfhHhR&m{tG_fO^_QvRgn{;qX&v0Gkft+mB?X)mcIX?5~iC z`=9to{VylqKfMz8h1slzN|@Sn>I@iDooMg^>ZZqJ>WgWz3?~(Gg)2wfR}XVt)VbhH zQ7oHpERyS<^xL=bvl~agr?hir`vPJSfLe}hUshE$V79fcl$U`V_SCP;HvjwIscTs+ zR-w1Dv_^k?_?IfSC#jN^DeX5Ll@wjGaYv;}k!xxNAFfFf_^r7nE2kC2N{Ye2HwT)0QWgBJ(x=jdRK#}w_< zdw~X&+s|tUozJm~-hS`)A`*-R^P=kI$TVd27kZnKc~y-b4gJ9%m-zG{G!_p@g*yuk2Y-7H8w}eR!mj^6;2Dt*4GCIt| z?ZBUsapjZNHl$nexyg}1&`ciNG|QsbBkYx3eCefI6}PH9iDDoiInCUv_=%as!u%su zR;%cQ*Bx!54x>{JWX3At&B8D77gAfhSuX{z&+vSu( zy3b#!OF`|W^sBT&N|IND$Fz)KiyEHZO<9;>9)0N(8`2kJl&z1P&Nz8>bw^`|41}u- z2FZ&k@^D;~pI2=|#?0idBt1Tzmw+=GVh?;|RqZH7=I}C(5LGki&3!cHEh<+NC$$6) zEPIza7r2lXgsZlpge5+Xb8&bXCMAN$ z?Gbg1s;f91&)&5UlYl&k#%;?DU+vi@UR9~2ERH=_mHSFSiIB*uriMgiBw*FS7p<;Z zR9oFD`QepDQdMTVi0rg&olX4kM`-a zak;si!XXbkM*^BuJ(rwXq9Hs_NxN=oi3%`tua6tAT{+ctmYQI%gE8+DGS6Om)6*VF zkn7f23D#D=@ZOYp&|zU3#Y7__kSPOJNp8lGrVKwq0dIh@rK!K(3ZOoj&+lvRl=YB( z$b53w`gO^Q`ZUGoLR@)idmpsr^Ryn9@UDAOkHe=jeYgi=L2bK$d^t{AH1AMV{>wa} z8Nzy_D#U!X(qgQ^+@_hsXq;i~CeH0v=Gicied_9ee53z-`tJ*W`{&2-KfCkK(~ zi+`N7Sbj3|iFm~baEy7^5NmTDY($Mkd?VHuJQy?=x+{5PgRf-rtzOswD;a#^@j{%_ z!>1IIZ3APYXtdF)s`(r$l9uCdkUGVe|J?Iv8Zz=^uh?DeAmaDUimLVjFB?pEZJ=XS z&=1TtR=bkIL@#wR$8`dR8wguqY<~@uaUK|SKU>`0eT(K8W4iznGf#_y)K!{wsdkBi z7K}_&=c|{}ai!DEC<9WXeU0q6x25Fb%K}RWm}P{Y)z3^gaE>ioGv~B;L3LwQklqUC zGZFR%&P3q>Z61`7bE`3T0cl!bMP$=P7tuG&4A+P$cDLINDS{nRi(sj$AGGb`x4l0|w?(_Wo3^hHg#QP=G#2^Mya9`B|P9q8^ zM3GFiF;csT(y{^D=>GFE-PdI}jIQ6PsZ#4al1IVcn4YE|iA;F^#4%+ydN16wT?82- zj_8i10vK)xBLtfWULKe zFy1#FC>8zCU)=+T4dkeR7S~Xxa;+uUtNfKHZq%AIz%PF%wf{uLPtgYlUpGsA^>#|* zwx>Q2cCv&tqMNRF$V3P-cSk20kEYl|Bz~BdA?zdz3$&lyJy!K@S^uFw-sT^){fy&l zw9Ep>5|YLEzg=|*$P}-Cm%f6emz3%9g;iAK`i0Md)Q!Z^x}ZoYDORAXQ~vv%q;UD} z&Nvi~hDhxjC@c78;ae~Aaiz4ZfT*x)U$}Z=d4MqynunjUNB(%&P|eL1>knMX&#mB* z<4axBeXpIavSd6+7pc9|yev!KXS7Ct21#{-jnm3VG)PrNyvD2dQm8sSzb1F;?4mkc zK`{52_DQjWW+X7Qpt9EGU7w$2=GRXgG*r$C7>EYldi?(8bl(hjWORr+Jo}0(0{e+c z0wh5%(^SakS1Std9N=EZDEA~c;E57g#CH}hvod!Rb_yN=GPp37X*M8q>DDS>+Gh0b zf}^X^aR56nbN#{U_xWBFru-SEeF81+lQ&RLgTQQl+{y(5b%>FkK4k+zTz0I~-up0$ zZ#(N$1)J>#uLQ`uJpa1#d^_u#MA9^ha>Ujf3kN=q z#-5dj0#6Zmb%46H8Kya;MF--Da)>DgK-StNVf|Z4iWXq2@KXQOB6rUtlQUZ%A|Rb< z-6h@^;&0Zfh({={p1Z>7ZC<-b8ay2C*2}=?^Xvj9P_9lxd+E|5Bo(|{YHbl&!J*lP z`D+!Us%;+jt8o#_JSU~pAMs~s=4XhFgO!%dg63!WZGs>7ZyUa=rJq&VQ!zMC1YllodVZWY9|UxiApA_=zf~Ru za*yM;L^ni!u;HSabuR@Ny_ogq9OgQk!oLI@H6Vq1rM_}qvviZE;4U=Tvz6oSx-abP zWad<>ZeWH@u778t-wBd&TZg>cv3y7-UtQ6jDs}$mIpECt4`lW~uljdtxYIJI5GJ^Q z-y88O8e>s|$ywe|eW6*Y79c?HdCGT|aA#*gR6IG|s)s?@t_) z8e#8}8q!9-m!yNV*w=DlcqYz}4kG16`s~>naKD7@)|F^{A;sgPYW>Orw>~^WE1Oo` z4&1&7mnx7EaeCv-D6@eJ?MVTab~&P?7wJ&jSg{O`^wA<#IZgJ2kYv!pgRs)pt3cmn zg?T2jlMwc8wxWT%&<3=a$gB8FR!Y{p%c#hF!xsxiFKibZb{0RemzNkMMes)7J>9>& z8KO5}5vPvfy0vu;eo?z)%*=7E3ugjypCIjR+`UrTdktl5)yr;HdEXy-x`NxWx#TwscR58&i z!_e3C{Lgh5h$nLG{tivaCW5G0;~wS=Gkr}H&_b(E$Urx|u`H|t$OEf{DZpw=LwKvH z48mtc)MoE3(zFlFQ_TvE-2N;N4@N6hqYORLvjbO>lA45-Bm`sCV%BEl?Zw??#}$>F z@~YhwDiJ_e^8#vtoTbl0v@zC8*M4IPW==C4+D|l&9L%@QRVi|P46Fkmb*XIaQ{cgj z-}k#K4cN#Ngoy{Ht1eK-@>}N{6}}n}P$(f&cKpmjj%*cYuSBH5dyp8Acy5Zcqi({< z?dVqRRFs>tk>thKD1PW*M#}aeeg+D#vX;*5$8jQ#@r?2z@lSqAr@7wOtuYoahNNqi zG@b3VA(gm)v*RTR(g3jRlNO3bydPUZ_K+HfL-;p6E>Dp#5{ZSnMkMCdTPAd z%*vM~Jp3OH52rgyxv_m`IRbpdO=C+)RsjRr!byJ+>Axxd5ZxH|I637!GJaV`zDHBb5hBaM*F+`6_(huDK_&xqo-Qqc`9l?ISv$B{ z4F%%~-b>}t-E_dvw07__)N(R6E7O&tXZp^M!kBj`F}-h>;Gb(oE8@@PWDTY-@4~9@xPpC&ZPcgf4BNCE;%ZEbCODR;feR?NyU+hJR5oWvDE_f|LBe zsGZUB_q7AxSxiNl+Gx$nWeUwa=1F8~DSyd|4eEE6K{`{(sB>HGBSKf4n5su0TJnf; zXIGA?km6dCLWZ*rQ~si+{y*CGJ?L_In}}7{$AQve1N-3H8c)aGqNLEJX9{d;f2C4{ zvP4tEb35FM!Y>-S*!opvA?T8~C)#P^Xn?a*EUW1c=*$=Y7;Nd^x!(Bem+|Lv|4u#k z=SK9`r~Z8?CV%bY&*uKLqtM@X_{Rf{zrW*OtogU@0RP3Y{PFhx4d<3$|JW7_%iofN z{r&ZSx#oY%#Qulg{s?aUhs*zZ@!zUP|MlVg?Gyhs$^Gs7_-9N1HOc+6Z|ZOF`>#pv zZ{NqiQ2Jj?ayo+G>dFdzv+OC-Ot)LoI*!w?nF(E)cEX+CF$j}${N*0a3ZL%G7(Ergv&qEY?MuZot+}e zCwNU&oSGp~-+z5u{7!j!$x`SyhaknBu{*D#_99OBKXf_%KlS!wrTO&Z7Ip3KEEm1z z%MJ+F$E+-T@0`3@8yRpqaS+J<&Jv-#HG13`zgA4HW!eZW{oR+#LuD`aeP?M-JMegd z(%&ES0WDCpDKzSH{HGbY8ROZc5xaSJDFkV)VAs>ZB@87ZI)w7Z@nH=)|rjK zIt57jbrw35uvQ3|vQ-X5VOxZ?JtAd<_Zk!X9?HwjC#z~%v{Ls6a*vGtZJm5>6!4`Q zd8tD^j~UTxk^|Lwp^xuZ|25C@FJymsl+!!w1S@zOo)&dLqsR*xA}yuwTG4JA-=tL< zyVu7WNyeLq{CXknzkMTTK-*=lb*Tyk-0l{noTP&9ERD7dYMy~Ck7uJAAJ{-f%hdE3WtlQu%5YxKnqnyOt5;tM#bDU3J8<$BvUx4v zRyl><6_Zk|1ezyU4I^_eCVHa|;Pf-xT<#>s{+IbwzD|!_OMe6M4I8^ZtXWW~` zzIf?G;{mizw>rAZvAH&7IZI>G`PVd7FUO?i^D+d${^_GG-X!j9hdSn^XJhe zq|5W^OJXTDxgO=4bz=hf{B)nN6hJ3FHV}ruf*bC692O`~y_bbZX&q`R7`3`%jV$!S z#_R$MGX(h14>c60DdQd#5E?1ED4-~)|LA#3>6^07q8Yu+!E4>hH|0~Yd%S)x>I8*n zbE(2+b#J0=+JXXgm7bJjdI+bPyUO0x4L(|c39V$vFP8#F_ky~iUYF?U_@FT|CZW2vVJn$w9K#563qSGOf_|xJ z{n}N(i1AE&Mf9W7`MOfE{3&Q}K&t9`xlfKIl~z0v0{sw>5y6j}F&iJ&udWTwGfgS~ z$PB0hi>#3K2>W>}scwTM5^yw4)#m1e~q9>_PB?OHqMRpG_ z0X?j4Xbmn*xx=-v0Zds)ex=A~USic(?%AaIRa)`ffc~YZ2@{FV{2qqzqz**WpO-4j zGlfheysVfvlv=IaOUz$aUJkj?aEuk3u-LQAxc<|$Btc`AoQ2K&-Pw>o!Pk_%O(x!v zAq=Sse!2BpttAP56ELxoG`_dVMkO||>Cel$3~lcR_~gb(OeWsXwaghHj(QQ13du?s zrNU%3Q;4}8r1uMf%=%yL$>%$gzyXb~h9AZ{fsaS5bXSRwc^-S4)w z?K5M>lDw25Ii;-aoP9dVY>Hr(_hxvIM9ej+KLw`W;hN0+W|kJaPvjk>I!*4hFFAJ> zL>Ra{dR(izZ+Yx|URL(OL-0Jm_rtj>m9*^V)tNT|u|F3H=Icl$4ArE(Y#TS=bXY~S z^F>j{WhKb&Lufg?V?pnpX|OTgBorEO+{*;A_t~6S25C=}gC%vM!m$hKShkxSgFY7~ zM`>cQPS?A^)`Iw+^9xg=TmMyvdb z6sNRn#r=~oX+9}~7j@3OPWdeX?FgM$a}&LVICqq8ZrJk!t}3?|ZK@OUol#7T9TeAc zznZ$DCKsbrcVf}>$EVY*5{5s?EO3rb!>oMR8)VByf;0jy=e<|LjK=cnRK5b42sO+r?ZsAmJ{*7i zon>i5e$W{6V3vE?N>@{%WodtHz@J36@gB#c0OWgg3fH?dRt>=?YB!FwJmeW}l-#@KNr`Z_ zGM!^%R94-5+u6$@_6&7f`BYxpi%f>+=exBoq&~ca1D(}&I&J>#g0tTFcI6(#(8HN& z6B_}kYy?A*f_^fan{>5KXM<#+WY?tN3Qy60J6>9DlU7;jcgX~MW%iw$E+kF6#pGT{ zMSy{_LHGm+NirsX!rkkJv2rOpMn5e_?zavn>2=azW6?h!Ww{w25#o(X#?8a&m+zvg zPn6FvRk*^3^=cO83FD#1$h2(eiJI6U((6e5&d1R2EKa?r+fVjFXYKZWNxzMLuSoKe zi?*(iF$$p>T@>gNbyQ3&lV+_D8RhF6xUC(&CFqf@Fd#1EO0P0oiPX;)y$c7FPdk;g ziVb{$n%5#dTd1Dph~i=EU^m^7P3xrjtEx*uZA$x^Xvg;Gws+-w6bdp{{(9Tcc~Q?S zq-?~TtV2I%FNX)Ouxj-*mi2A|d!L>YN75OvNNNdip}L*V@#SRTPqDTL@LF7e8?`KqiSxYt)El+aVB$tvjz&?u+Hyz-F(; zPngRq?$}pe9*x`C8-I5CZG^GD`-A{%tZJ2M$vl%gF`EVu<on^|db)%|1;uBN?a7v&x)UxF5%qYL(^pob24;41h9W67~wdqB=S_Lfhw< z9OM>h-&y>~e17pgF2UgMER)@VP4neVr$X0t*BEV4U?7@3tEOI0Ai}#&P&5$%#)2)L`9vGb(W~L9B?j>x*0sQ>PIqd z3GU42nCdht_03^HVCnHFnx%g*SV7u#)H55nCbxRBF?YzQQ};|Vk` zJ3Osv=cIZl{C+BdNu2Txt8UnBR%60>jKv*2EjZbKz%tHq5wU18E7CA@^;?1dvZOIlfPc5yX8TMsv?hFt z16G<3O}Yc3znOYE{}WPdlL@m4)%W!hI3S_7k>rQ6QJdkkk-j%BM1! z468c5aKO2xH`6a%+R%;oV&b?yYvr1Ug7JfuzOlrms)PAkA-bpwcH$k`>=|mcCRQQbWlGrG2&cT0_95@iG zGk6j3bHptXdd;uI5{(b0@Yk^hK2gp`Qk6+guAe@e@UV`Ss`8oSp_7NPUC+Y2anb!z z$YJ=9<@iEB&GAh#_j*a{)?@DZu;zKG?D3JQf>h-T2)Nv38gK-P@+DQRGu97CtCd zQZoGWtNT8wzncM7f&l{;WqutiYJ)v5>`PSSNw`+8Hl`&TeR)%IwYT1WV&(Kre&E&avJ%! z2DzD{)>~AHjvIte*@A|XbBff<6ddT&UX5bZxV6mALKbjAyI^>uU(^JvMs1DKdLnrW zJ@RyT3g57bI+-AtC->g-Urk|O%Ou#Y8%9jMCW>a(1vQJ{^%a)Q(8xT=60#IOj;#YK5mp!2JI1IZjnUu>y?mA4*4W2ts@SC z`9tBm5v;Gu9dwF?#Fu&;2hrMqS5q;OKaU-r&Ha{{wWB9Lv9&Ns#Haa{-u53FT4oG^ z!>mF2KBa7xpU2;G1s7K4Rit2{JrYsNd*=Y%ABQdcQLgu-TF-%13axM)$;+*^o+x|IaCknp$DtQF#%O;hv+q@%3?lKdwm=~Rit768-#Goe%1WG}! zp9q0YWi4R0`&?eC5PIM|n99%kj7wSNldmBVoq8P5Z{3z{lCVim} zS)1|DtlQ~B(g?i!kl2wn!mjbrXE1|GGX4$KpPv=|Xreu+v8usCy(8StJ7uw=W<&jM zzgY#TWC)-~xN>LVJ4?eA&^ah)=1otjX&Xbszz?j6Rt6cNYRIa9swVE|sFy^3>CdZc z!zF>xGT9hCe@(@M3h$~dd2d$u=6GP`De0dis|zlJt(E$SS9pi|a^;rgx8g27>F4ht zUK5)@GS$(BGd0l0>j-VDCalO0`{h5gH@=hq>d(FcO182RnOdojBX#PW4VDjq&Z^}4 z86}n|5O~2lfxIt%h}v6i`c*D#`Qvw%b{0*cwgVdb#P8*KlC*xX!@28V*U*!r_z=2$fux9)J;l-a%5>^@d#$>l;-0E7{d+p>mEML&;DeR#r z2%;E+AfCvmkvyspc!j0LIM$ChQN$e3TcM22&atYC5_FJC#)Tz z$FD*+9WTC*H%VMI_|B5uv`Xw-*kn4o)I?f-;;bCw^r&nnSa^G@P?S17I?~*uCXm&x z_-6C74p8N4`p-A3lvWp(Zu~&6n{Lh;wnIEDrc_kKn_3^0f7{hqABiD&T zQq=mgma;((-};Q|Fnq0vlA9bZzx$Q9+28+f-i+!mGg}(PS4uzWNL4~0wu?$d z1qi*}$b#9Wb{Q)?aqBZrdI~6ozN&gIg{woZN`cNh+i)&*k#9)8qa#kzKXs5Q2VeqI z+dedT5Hn!nO0PWe-JRLiSbfx`T`YPE@9hIKBPR4C0s>_XVpD?k)?T+npBA~2P{pKC zZ;u)u5Eueh;_lt$i|au~%L&P-x+z}AcXuO#*weg&^o(rRnhrU`hd<)Y^)TFXp+{LF zq|GJyQLpnIW@|4>sr?VLlSo(^P*byX=T)U~^VtPG<_L0dPZV|(j^EYPInAE~CZw6C z)~Z>|O4tlfYfB^UISRh1*%bh!9zEV|X^v|T82!SY(X!p0kT>}5FMwrtEI+N+By^9< zi}INjh*YJg+1YoFZp|krB%ia*<=kh$LH~oqUX<;SO1?GKK`Q9~;9VzFRX}weeM3p) zK0oev+9{C7e@0GDP8bNFgXM(52?^ICI6t2h`Ah=Ayv?sRt)gUj-r z#_M=rk--{yPr)Lcw$WB9#-EMDn6T)t4JzZ|${Gm9=T@o1+CdUHglrQ>F#jyI0*7Y8 zyDliAY?A{7LT_>@GQ`Q(LLGZ#*&WPM0O1*xrok4G`Ypi&?G^-Mo-l&D4M@sd94h{} zNFhrpi8O7cW=X4hw`zX8`XSa-Ha|k*dWl1RL2^p;ePLdFmv@Hlvpjdr&S9NZ@TEf9 z?WeHr=nlkXYTkT+8Lqn4|F84qd7RCy(aJ8mH*3Hkx5E87_=r~YD&S3ofM3LX^+HSe z_VoX?te{s_KBt!)kTzjF9rN-}%Jp5qV{Ny*crSbBXZVl#-)#E#$DddaTo*18r=AMj z1-L3qQ#L4<&$xHxlB1UC2LqQ}t1)^Byt8)Vm#V|c%GTO^B^!>dy0tW~JMv@Ij%>eqDdw~M#cI$yuPy?(mkW51GW*>jI0 z%HqRH_T7>X`1<|r{ikOtpvq;ZU!AMJt^JB^?eFrR#d0Rk-8bHOXW9-nW8qi+_`19Q zVvhG(UVKw--J5u`HuBQ%j8TI}gJLvQfHK)=1{p0YhJUeX9FsaNQg`jD)YQVOQWqAR z-HHkc?x+!&)ysa^Zr)_$m-6|mKN%SnZFq88B<^F&s< NOY1IP{LudYO#oKnMydb+ diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 5ec5e4ebcb..0e2ab42a94 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -8,7 +8,7 @@ author: frankroj manager: aaroncz ms.author: frankroj ms.localizationpriority: medium -ms.date: 10/04/2023 +ms.date: 10/13/2023 ms.topic: how-to ms.collection: - highpri @@ -39,7 +39,7 @@ Installing a KMS host key on a computer running a client version of Windows allo - Activation of other computers running the same client version of Windows. - Activation of other computers running earlier client versions of Windows. -Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if the organization uses volume activation for clients and MAK-based activation for a smaller number of servers. +Clients locate the KMS server by using resource records in DNS, so some configuration of DNS is required. This scenario can be beneficial if the organization uses volume activation for clients and MAK-based activation for a smaller number of servers. To enable KMS functionality, a KMS key is installed on a KMS host. The host is then activated over the Internet or by phone using Microsoft activation services. @@ -71,7 +71,7 @@ KMS can be activated on client versions of Windows by using the `slmgr.vbs`. To cscript.exe slmgr.vbs /dti ``` - This should display the installation ID. + This command should display the installation ID. 1. Call the [Microsoft Volume License Key assisted support telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers). Follow the voice prompts and when prompted, enter the installation ID obtained in the previous step. @@ -89,7 +89,7 @@ Installing a KMS host key on a computer running Windows Server allows you to act > [!IMPORTANT] > -> You cannot install a client KMS key into the KMS in Windows Server. +> You can't install a client KMS key into the KMS in Windows Server. ### Configure KMS in Windows Server @@ -97,7 +97,7 @@ Installing a KMS host key on a computer running Windows Server allows you to act 1. Open **Server Manager**. -1. Under the **Manage** menu in **Server Manager**, select **Add Roles and Features**. This opens the **Add Roles and Features Wizard**. +1. Under the **Manage** menu in **Server Manager**, select **Add Roles and Features**. The **Add Roles and Features Wizard** window opens. 1. In the **Add Roles and Features Wizard**: @@ -117,7 +117,7 @@ Installing a KMS host key on a computer running Windows Server allows you to act 1. In the **Confirm installation selections**/**Confirmation** page, select the **Install** button. - 1. Installation may take a few minutes to complete. Once the role installation completes, select the **Close** button. + 1. Installation can take a few minutes to complete. Once the role installation completes, select the **Close** button. 1. Go to the **Start Menu** > **Windows Administrative Tools** and select **Volume Activation Tools**. The **Volume Activation Tools** window appears. @@ -133,11 +133,29 @@ Installing a KMS host key on a computer running Windows Server allows you to act 1. After the product key is installed, in the **Product Key Installation Succeeded**/**Product Key Management** page, make sure **Activate Product** is selected, and then select **Next >** button to begin the activation process. - 1. In the **Activate Product**/**Product Key Management** page, make sure that the product shows correctly under the **Select product** menu, and then select the desired activation method. The available methods are: + 1. In the **Activate Product**/**Product Key Management** page, make sure the current product is shown under the **Select product** menu, and then select the desired activation method. The available methods are: - **Active online** - If selecting this option, select the **Commit** button to finish activating the product online. - - **Active by phone** - If selecting this option, select the **Show me other ways to activate** drop-down menu, and then select **Use the automated phone system**. Follow the instructions to activate the product by phone. + - **Active by phone** - If selecting this option: + + 1. Select the desired location from the **Select your location** drop-down menu, and then select the **Next >** button. + + 1. In the **Activate by Phone**/**Product Key Management** page, follow the instructions to activate the product by phone. + + 1. Once finished, select the **Commit** button. + + 1. In the **Activation Succeeded**/**Product Key Management** page, review the configuration options: + + - If the configuration options are as expected, select the **Close** button. + + - If configuration changes are desired: + + 1. Select the **Next >** button. + + 1. In the **Configure Key Management Service Options/Product Key Management** page, make the desired configuration changes, and then select the **Commit** button. + + 1. In the **Configuration Succeeded**/**Configuration** page, select the **Close** button. Once the KMS host is configured, it begins to listen for activation requests. However, it doesn't activate clients successfully until the activation threshold is met. @@ -147,45 +165,34 @@ KMS volume activation can be verified from the KMS host server or from the clien > [!NOTE] > -> If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. +> If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that doesn't first try to activate itself by using Active Directory-based activation. For example, a client computer that is a workgroup computer that isn't joined to a domain. To verify that KMS volume activation works, complete the following steps: 1. On the KMS host, open the event log and confirm that DNS publishing is successful. -2. On a client computer, open a Command Prompt window and run the command `Slmgr.vbs /ato`. +2. On a client computer, open an elevated Command Prompt window and run the command: + + ```cmd + cscript.exe slmgr.vbs /ato + ``` The `/ato` command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. -3. On a client computer or the KMS host, open an elevated Command Prompt window and run the command `Slmgr.vbs /dlv`. +3. On a client computer or the KMS host, open an elevated Command Prompt window and run the command + + ```cmd + cscript.exe slmgr.vbs /dlv + ``` The `/dlv` command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This test confirms that KMS is functioning correctly, even though the client hasn't been activated. -For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](/windows-server/get-started/activation-slmgr-vbs-options). +For more information about the use and syntax of the script `slmgr.vbs`, see [Slmgr.vbs Options](/windows-server/get-started/activation-slmgr-vbs-options). -## Key Management Service in earlier versions of Windows - -If you've already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: - -1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. -2. Request a new KMS host key from the Volume Licensing Service Center. -3. Install the new KMS host key on your KMS host. -4. Activate the new KMS host key by running the slmgr.vbs script. - -For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). +> [!IMPORTANT] +> +> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. ## Related articles -- [Volume Activation for Windows 10](volume-activation-windows-10.md). -- [Deploy KMS Activation](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn502531) -- [Error 0xC004F015 when you activate Windows 10 Enterprise on a Windows Server 2012 R2 KMS host](/troubleshoot/windows-server/deployment/error-0xc004f015-activate-windows-10). -- [Windows Volume Activation Tips](/archive/blogs/askcore/windows-10-volume-activation-tips). - - - ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) - ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) - ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) - ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) - ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) - ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) - +- [Key Management Services (KMS) activation planning](/windows-server/get-started/kms-activation-planning). From 9666e64d1f30ff554c7f1df59466d7965d378bf9 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 13 Oct 2023 08:53:21 -0400 Subject: [PATCH 078/151] table update --- .../hello-identity-verification.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 663d6662dc..c3d9210b98 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -44,12 +44,12 @@ The table shows the minimum requirements for each deployment. For key trust in a The table shows the minimum requirements for each deployment. -| Key trust
Group Policy managed | Certificate trust
Group Policy managed| -| --- | --- | -|Any supported Windows client versions|Any supported Windows client versions| -| Windows Server 2016 Schema | Windows Server 2016 Schema| -| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | -| Any supported Windows Server versions | Any supported Windows Server versions | -| Any supported Windows Server versions | Any supported Windows Server versions | -| Any supported Windows Server versions | Any supported Windows Server versions | -| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | \ No newline at end of file +| Requirement | Key trust
Group Policy managed | Certificate trust
Group Policy managed| +| --- | --- | ---| +| **Windows Version** | Any supported Windows client versions|Any supported Windows client versions| +| **Schema Version**| Windows Server 2016 Schema | Windows Server 2016 Schema| +| **Domain and Forest Functional Level**| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | +| **Domain Controller Version**| Any supported Windows Server versions | Any supported Windows Server versions | +| **Certificate Authority**| Any supported Windows Server versions | Any supported Windows Server versions | +| **AD FS Version**| Any supported Windows Server versions | Any supported Windows Server versions | +| **MFA Requirement**| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | \ No newline at end of file From 1f04af0f0bf95da4f915d3951d7249a9d383e510 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 09:38:26 -0400 Subject: [PATCH 079/151] Corrected PowerShell command Corrected PowerShell command. Also added updated info on log viewers. --- .../prepare-for-windows-deployment-with-mdt.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index cef1350b94..dd75e9b3fc 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -11,7 +11,7 @@ ms.technology: itpro-deploy ms.collection: - highpri - tier3 -ms.date: 11/28/2022 +ms.date: 10/13/2023 --- # Prepare for deployment with MDT @@ -135,7 +135,8 @@ To install WSUS on MDT01, enter the following at an elevated Windows PowerShell ```powershell Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, UpdateServices-UI -"C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS +cd "C:\Program Files\Update Services\Tools" +.\wsusutil.exe postinstall CONTENT_DIR=C:\WSUS ``` > [!NOTE] @@ -264,19 +265,19 @@ See the following example: ![Logs folder.](../images/mdt-05-fig08.png) -## Use CMTrace to read log files (optional) +## Use Support Center OneTrace or CMTrace to read log files (optional) -The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/mem/configmgr/core/support/cmtrace)). +The log files in MDT Lite Touch are formatted to be read by [Support Center OneTrace](/mem/configmgr/core/support/support-center-onetrace) or [CMTrace](/mem/configmgr/core/support/cmtrace). -You can use Notepad (example below): +Notepad can be used to read the log files (example below): ![figure 8.](../images/mdt-05-fig09.png) -Alternatively, CMTrace formatting makes the logs much easier to read. See the same log file below, opened in CMTrace: +However, Support Center OneTrace or CMTrace makes the logs much easier to read. See the same log file below, opened in CMTrace: ![figure 9.](../images/mdt-05-fig10.png) -After installing the ConfigMgrTools.msi file, you can search for **cmtrace** and pin the tool to your taskbar for easy access. +Both Support Center OneTrace and CMTrace are available as part of Microsoft Configuration Manager. ## Next steps From 5b0033294c9cc9e237195852c18aeef4db15392c Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 10:29:50 -0400 Subject: [PATCH 080/151] VAMT Refresh 3 --- .../volume-activation/images/sql-instance.png | Bin 35344 -> 0 bytes .../volume-activation/images/vamt-db.png | Bin 8570 -> 0 bytes .../volume-activation/install-vamt.md | 40 +++++++++++------- 3 files changed, 24 insertions(+), 16 deletions(-) delete mode 100644 windows/deployment/volume-activation/images/sql-instance.png delete mode 100644 windows/deployment/volume-activation/images/vamt-db.png diff --git a/windows/deployment/volume-activation/images/sql-instance.png b/windows/deployment/volume-activation/images/sql-instance.png deleted file mode 100644 index 379935e01c107a7f76fbc48776497451f5355e15..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 35344 zcmb@tV|Zlk6FwN*>Dbo9w#`Y$HYe7^nAo;$OfoSiwrx*rYy17}*S&W4!~a}YcOO(A z)KjOPs=MlrP*IXbM!-h^0|P^rm61>d1A`C)tvA3yfWFK0Bu7C%;4Z4tVqmpXgeRa4 zC`(aAQIJ3!;=3_4XdB*9M%x7p45k0S5BRV{xfvK(M2W0~sM=41i!NwA!qM*fuB$h{ zC*pO%4s;_u?=?$Dk2F$I$broWbR02=;2o&FOJZ^~u?_S6OC>lmEl2p1IxiSFwC#=# z58jH^<23X3D$wHndgAY){(vg{&a!{yPjc7N6Z1=i6b-I;^QM3MlWS;2tGX^u6tn|s z?(%uJ=gXV$IZw3$F%Tpp(*bFN1OZyRz%6HmgMtWbGR+_QpJZ$x{(mQt;fMKu6gcSk zRjN)YO94lpFp>#w*eAhKrMTC_qhboW%B`>Hceyq_Vu-v6%nVgQza9h=04$L4vP+}YW=x0iT+?i+>8Xwd42{!GDqW$yP` z6&{{J3NEu`@b`D!BCg_WIz)=>p(-*PbR^I<%d9D~*Rc)BT7e>E`~X*p-n!k5jSAXg z|}=S|~`97Mm_@6tc==n~*2+o*{j(BKLDpWRAkY|v6oT@%Kr-%=M_*SgqrK(2*D4OF-BvhGxPK%Ci_NI_|U4v2gO@le4oEafP`}_TacF6e#<3(~)>4jE6d35H7 z<+uG3X5k}b=|)FKT}+P^aCaQWw$|*jp6j4%RAmld-3u_uk10!wDQT#OrgHae3(-bJ z2e#5fOH;y;oc^JlVlVu#@j0*V+e%gCowdOU;!tf1`6|Z~?@|W@(kqC=C@L$;L#AwG z9uyzEM6mljsLhyxOo;LH*kDXN48^d=Z?mrtT~EE`JM=RGwT|{`uCV{-!6?wn3&toR z72eMf&IqgopW1LHFm6;-v>;J=}bW=)}v zmdU|G{T)|XE7gU&E;;9^xw3o*`3)8byndGZ>!^z&t;B^5I6ev9FisyHFCwB0x44-G zD-@xVdXgLQ(oz|<&@@oh+3c;|?W+`##*=DN{7QpJ8W*6hZM&-sGREHmU}LAI{z}Br z6XszH0E}^VNQYcMUpBTJsB>~GsDY05K(9Z)D#Ws+K&42vRQB`F#A5&}VtU2{#?rm34oK(&g$Vg6xD(pQfbJ{@_ zGF)l2yb|<&OixeujT!AOXDvyN8q%*Zr6>MDbo@N+?=iP~-NfgXipP(9vf2-z5ap3f zN>6WEc?mK;H85Q1=#{LTFJKSr-*rF##_~YWb9fI7t=PcdMih67gjfXUz;b_N<{p+s63g5x^8yz<(!cia;i+r1g+)wb{C^feSkXgvREB4)4YdegD%E)E#flLE6}6?py1@@*3#6pl&-MPlF!Y}?U5pCh#-zXuj5-JF5kh5SCcI zW^qVGwYo~#i?5a(P7OIr&aYy;0Q38D}tvqlf z0wbKl4kp&Ao*MO8iGpLksi#Z);32(GH(xDn`@~?HHk)%o>$%WP!ac3-Iq;iILKa`d z_wGSJ22dxpDSB$Dc5@eWsD}IXi%Wx4Lj?A%M8zl}Awk3xWYTPSb1e>Em6fOa!*P&l zR>Ugc{@MIbw&MNkyZzDut&?kOk1uz}=;#TgP9Xg-!v#T%>9xDk#V>8NxroBEMyIn< z6n1~wSy)ih;y$lgB*fiP#Tc{Yf{W zQFuc~5#l7_tK9Xir`w{IQBzFE%k^TfTnwGgy8cG{W0+G4h>@_mQgU30$o%wI@>Y2f z1N8D5fTxO~xxPKxy*(bP0FZ;xad9_hW*m3_O6DWP3{hgNjwaCret&(uK*Rt;Ar@%0 zUA9kp*q~#I0VVTA$pK6C?`2HM6 z;pNaV>eHJf;5_41H%qKW$o_Zgj%w~|wW-45MS)=UAbG}iK!vBmrj$booHw%?d>wFY zHE2%0>Q_xMt<)}$BnF_sw)12kABc`HLCNy&Oy$BcCMy5_ho2ZC&_@_de)KRh3Wxcd zR=vz!E20dA%^{OSSsiyUos~L_b zhop0MpSFlFv9SxHEOnLXWP@$a(l~A^w2?k8npmPP`REa& z;nu_S8IjOS81OfC_>i-?_KpWHKJ~9z5tw0G^W?@=8b0(2k^Jt;Q+0Jc%?_*g@R4)B zhUWI0Y-@9{eJzdvmPTKiTHcquWphl;vgLV{Fq*HfO`J0AM)==*d z8m`SAJN20obibN#Yo~B+i=rhFI)a`Q` zV| z(50=nEoTxatiFu;G6svqmxz5s!}B=tXbElWqy@k-V607P`&YC-PPWBVq_Rb5MUG$@ zI^s$i3B*=<40L;yI)89*t3@)PnLnZHj-8RjX;d84aB?|)&94owdwa_Q(!ExdZKLg^ zBVlqY%<>~2+l*4Yc(8xRzyNl;ta}pZY8mM;e!q7p()#|exBwNTch(;(j>O6{gw%cs%pf~g z2py9Uc8NA=$@NjwLeywvZo`Skjm1!Hl!}4x7Bj7S^=TXes~%O6c*F6VnQ%)Z>4LHK z_i=4VV_LtKBGW`kZ|aVuOQ(HnqcEiZ{`8d+?)uqr_b+VGoM6A7QY^4y@?6?&qN=|? zm`&0Jo=)N$No#&}>CeH5T4y@Zg!F~h>Da0i)Tim>v+K6s=pGDJkHaX^ehV0K3!9OH ziBn>oSE-f?TiA&rgJJ||G3sf8IqWjjP|L_Qi0|O^3QYZz8_t7@+qPG;E*a#jHNJ`wpoOjQjvW!%QJdS|o zYRIZh>k{CWN@M zH-_-jwQq|UXg^NQ2yE~-ASo)(*tw(BWB`i>KY=3fu+061j?blrkHUWGdqN_2vibJ z>EjOyyGsTJKHYsI;dc)7h|Y#x_Os}%<@Mz|>YwwQH>MAg5SUrzmI@CE1~xHW(~2RH zp8CrIMhLM`tpwMA(Eg=OO9b|qL)?ORC!hVilvJ!ELFS*E!+GW%!`7dstV2`kF&K|I*rBj3!7k&RPPrJ>A^?p7f0-bpk6|^_v(oC! zt6~_G-Mc`C45z}Bo29QQWWKv^>hm=9?h!_l95hPnv(+CLIHnPxNVVES{DHj z!}l>Y(>=zy)rd!TZqgGxZ?%twFFk&j<^6WEM7X^;qbkuxSwF#Ih%VNpOxr07SXc<% zstPV;(n(5Aotq1H)y%*O!Ez;Ary4v{BoS%6zV7RkYVHo4o-rcHOUQLKOxtL}9EFQm zv0}rCyqTCyw+syUlgBa1MT{9y;4mZ=#X@r!ET)(nm(V%&uT*fQ=dKhCR!2+bkt7gQ z1#d9%f#l@$KE_I(vws@e`3&I@$k0YSP)AYbMD;s=zWfb|qNcX+=~kfyynu{cx5e+_ zl(V2<^Tj7YgcL$_E`!~&POlAuyx5|{2d*A4at-vEOkyOdTn5`;E0FaUxb zct3zXvZmGjG7^-g4kMgOYIIOJMAW&aTY|Z3i`ua!CIc2@mjnujjc&X8028_;T)X-P zI3^t1q}r(I6xNbs>b5KjThxc4n-t6)~(MOIHb_?UAXr}9O^M{ zR5X<670B5L+REz-jdo>R(C2=F`RbXH`m6WuQM}aE)z0tBaQ+1WIq}nA*~WHu9!C=y z-cOeyVai}>M*_Jb(nOGsZ4h>LQ^D|lb9R5>B9=#eA9iNtlH2Uhy9gC?S5~b3$;ZUHBn8VSX-aGP zs;xx)@ZWyXT=6^|==v&ydjC7Y)@?#V&s=Gv{o>^7#ZJee~KCO8}Z4uD3F} z&LwjAZC!ry>E!tBw$%y(C)5lH4lSc-0c_?wONb@vo?)>=s_uOhI_7Y^$?D}i;|^kRZwh=SKo$k-!x?iTNpa3c>8gm!Blz#fnd%JW5_G<0>} zo^SSF?r=~@giKcIckhm;d%U0Q6%{9!YSt$vCa}&WKS<8%x1*SCqmS_($_rzSh5ytU z;4IhgL-cg{`v4tK#ez825(m)eEcm>~S7}1j&(BYP2Wgt0O7@mnC@0tHk*1PovVx}H zAcqB(MXbR(LmVzacX~gdy0cT?x3^|$3Q3ilvA!Ea8ZMeMAQzA6n6 z!BznJMOKpfuQdjiqS8*N18p4?Ib9EztHfIJwjhy-i#-Iqqm5p)W@W>w2{&uP!}W(% z&z4MM1F8^S_?5??(-Q!JV2qwKImtvt9qmv3=l1-jT;s|+CIw{2VU~Q>x8fYsZEQo_ z8|xTjRcn#C=JuAWNP{k)k56!dj)szy!{sy-4fI~KWSOYUrpJ-276pBCZDV6uH;}b_ zdfVUpK zBEbG#Tsj?fPGa)dSEWmgOq-GXkBf~B1t3I4Wie!>45adY`ZI_rnyIQv|I66rXc*~1O*K<9 z7975kP*947QTAN^q=E55w;CUW2@9dt16We^Vi7`2n9@+e{6`MYqX^d%dO3U~F;N|d z2I`lX`=Od&R@~?0Iv2+o4^(}jdg?8 z+2gT$aHT$D#`poFnUM?F5458(qavlWg)<78b&{*4>WEpPs`LlpdIe7DFh*=hKk!{~ zK>>X33x3RpvdVYLl6cuxK0+cC!*6ziloTL{TZHtB{nIMue}MQcECeSEXivO5(gNsT zfg)?H|AVk0tcOMZCs9lU`F~Jg#REZcm#soCG@jAG=)db;pq4jWq3^KhtTOxE>^;l+ zdC^<3fpGfRm)}Dw5nA%{$B0&lGmnp3XFYsSOh-=ZOD?)RdgyX~*ITE|VhL^=nK}yO=LfFOEsC@38)eFN$Ac|W5X@hvSPy@Xq$G6Zi;9+itzL_t#WsdnG z5Q>i-;Di?Q9_yQHLu()RWdi&g0k0NG;4$ATU+Qp=7DsQS+7B zC122!W|I@`1w){D6nd^^%iNIW9qFypg-{eh&+;kIUER?8;=Qfj)8_kno%%q)ZMXIN zMZEdP^hWL_y|`0(!!}|*>-bEH<=vRPi}JZnhw(nFTdjreQ0yQkq^sNr z+Y`%H-?BV)GqE_=WMaRQP^uJ_saD9yNs7mO7+7(*Gxhv_UQ%E#=nPTPDO5cPgTQ3#t0K7+>jB+e-HhwTgepJ;ZZ7PE{zllT1lG(n(y4BMAlS&u!W-In$jw3%^rMa zrG zc@Y=xiZ+ql5kpfP?Y;%d$4EPqlom|Z*Njf_C^LI?LKZEoNpT*=9X--sn-~rLkL)~> zB7v<6p7V}zu@I`DEYYWDpEgm=FCGR2 z?-;&+;zO2Uw<$2C&t0_tMEx1Iv+W2(vdgHU#wa_0Fpm0Bmg# z^ORPIB?fx2L2Ww{vSU;TYXfUjsUOqvV>jL_fYch3M5j=X*le415O^b2hlUI=OkcxOlibvn&IHVg|$O zgpNOn@quaDO63Z6MEd%D7VYi4YuZV)5Mv5HI;K3K@+HpDD~sovSb;@5RpHZ`?P0{D zH5EUz_g{h1-GFm`?B*xe`QNmK@p9;dWt@iVVhr#|NwR1<+jCQ+i&zVtRUJu1UGR$G zea0d_)!>u?#ou}V64QXrS5K!^6xi0)ZX&3co%8KpwgHKvdol!+oe4*7YnzIYQK$N` z-eEJ!#JDDm2-&d3OKBc*@G|+%78Zj!8Y@->^ecS(i-FA;OK==*Ldipv_!x-ZaKi7* zB;cd1qN=KTefyFV1&cE%eec*3KORu6V~$8@@q>%aY4lzDBL~py3iJ4jX2_1${bs60 z*W+?~15bGAz;`qyJiN}CgoD9p_L2g}#qd|BeB^Cj4u2B`qkCdcMQ$?I?prpeO1hZL zT8LttZqM1k=5bvwdB_Vhv4L=hjq&@+mfsL*p_M^!>7nYxkcZLvyZUgg;Do=vo~qvS z-s&cM2lw!F?tx|5t4`8~GG{3{fGr_cex-@m)`PJ7*2* zN`gdk)lLErdq9ZOPG%eKiTVhmE}|<@D6IcCXX&LdmO8=ik#`t)3&82}`+Po1P-L)F zMs#5<7;rAE84c*4AbgdkoK}vyO&O!YsL1v1S!v?rwY2a02DJ{%&U@R@J36&C?wXLn zdwocQ`)|aeKqE#9K^on`#IHHXqA)bULvvb7O(cmPpUd;V8-i&Bf|V;b=s4zY=f}P1zw*z!M&a~K z_B+cmjft62vE|*89=A<34GmMD&OQBJI@*VMg?!*!v&*dI21Es=OZ2=yLnosv{Cv*d zKgG)e>{lkX7dzYiZJOZY%JOwnGX~HW=4=ffV=6sJzl--3RfWY7cHCa8bH1g}33Lri zD}*MT4m4p%SQ1lc==pyiqh|E?Je;^Gva~-)3n~m$UY$G9r*u|KzN7k-#s|`wu?cp7 zXH5xKL;OLqd06b9myXNk@n)=x{xHyg{<-|aBZK_r5EdUYaC&5+#%SC*H4aA(4Nw3Z z-8F7e@TmsC!A=S4TG+cYi~Z9OMCwKb@%auU?Fqu8=om%MPd@rv9~K-wd_vrEeAGz( zpj6H5<^J~EKtZEq=%+DqNn6_eep0jlUFcPZyk2*kxqJY=LH@cD)(z>-_1^!(WYOWV zPI;B+sd?|=!cdt|$mvlQeZ8)>Tj1+H(g^@=$_979fB4i>Awyf-bi9+K%mAv8#oSY% z7nfkEQIZdLCCc~8erRamxcEx=9-?qq9JlXt@-SFDx884qO(iQcTRgJje05NSjbq-v zh}Fg}3IF+)=#e+h088^{ZLw>TQuQ~lZa%B+aE+wGW(jUjuD5eWfiP&SIr8ey)I zrCmr#4xTIs7E1yCIz9)Z`TKhV(b^Q^kZ)~GFEC(IFN=XAyY0fn*j!xkbC3m6ER=g| zzmN_?ldm`%>d@EQc%P8L{#c36M}?R;?QL9HAkPVrjeFvORddHCW*4EsZ3KhMx-Vu$ zs1il^%<(1v8X{*Zhll>DiSccZ`sZkZu#PDRr2BJ=>rqFn2L&Kr2RMXzoR$wln!`}d zUOq>ySZF<_(6}kQ1de81b$^5pg$~s*)YWeOag0_83Ic0v_JN^_Ea3~ z@8bG8b`a)9rYP*UB!a<)!j~6%j;Hfy^RyC?kC~+;qlqrF*n&)hAB?N3&e}Absrbbu z-FqA*;>n|v!yj&!=>CzZix8~#yS0ZmaOX-9hT{m(dZ6QE_i}jO%RAjG*&jnu)HRAi z_05~{cZsYXWl0$0 zsF%9-*Xvdw8iQl=j|mVQE_O88kiwsba|}vzL!wG1myZCBxD1*R##Rd#a-~97GiW5f zfhypIB8m`P$h5c?e9m_n?d_FG1f}UoY>Kc35GffRx;oFXbX^TA-|16Z+FhVK!(|Sk zMx=d75>u}qjtvOUwwZ zEsFqDM;SPC*JUSyysnCxpN=N=RS|@??U%Dw=QhTRS#QhsSV97wLK2!}V0awNN>u=p zKt-*!n#8ph^E7c*;!5}^5X|y4plMT0X{stb3xb1+Cucv=h`OO{ot%w-;ReyLuV(5_ zF9_;$_hvFvtY8Y(BuA-l{`J7>G`%E>T~wFJ)CEOXsb95wZpJTX>%3%gFK;fZ-fDn) z1iaQ4v&;3&!kWg{`MsgbmH)ESh#0Yj7cJEU=@n$+^T)gnGR@J|I;i$CdjWG z6Cv%U9=%2Gbo(e5>9JXYg-d~QK zQ6z1B^Gg-bFQ*?&5x?qNyU^Bc&*#H9D7FmkPb-udhqlJs{;|-xukLU*|bnF*AF5I-Zt zlw8%+Rnyj#SK3;E5F&BhP&xzR11eiPHi(pe>k|5&{VeL5U33N6V3x`m3DehADM-Md z9P#}rEj;~Pw$-JzUgrKn(vJoG9OW{2h5|oi57%Ei`>nTzoF}byiW=TMQvNtFXgnO; z9NOhQ0>dSQd?W`uT2LEJbMAvl_}dyu-<1SgHZ9Tki~kW4b6x_cHd=Ygyz$5)VZ_uNa!%>gq#jQ z0sWU&H#PqHTXW_4$**-yCc`$b2OZto%})O_iQqEKH>oo98!P3%Y>7!Jw1=xmi1G;!*3IKgZqcZGsg!WG4y!0v=rXAxmn!D7fvq6*&V z(_5g2O^U^=vqIl$3WD`Is$tEM9WEzMjz+lV-m~wzC5na&l6ySej!#P%>`wJ2V{|>H zEGXSLB{`Ijdf|yA!|gxP4wl*DP!!Oeu=3Uvz#?Q>rx&S^lD>wmqYJ-BuRON~R(J}m z&q^TJeEcfO1fLQ|8x1yvMgle!h1I|%6Dc_OaA_>40MjulDWrrAURw2zSg1d>JwIyn zD^Pa4PJTiC7s6!KbyR2>W+w3r&W=os4NVPW(+pUO1A;Ns}GTqTc?6W@D~ zV`0O9BE?jVU{xg;_oDfBrtx%decs#kwJk}76wMdFR7RmR*=jhfrlusFy&5EGgGy%FJSd6!+iT6S#K^7&Xv6WCX?*J}){Q$X^OF5<9$H~DDurwd;qehzG}OD-#!GgK z>hQ6fK4U%;n^m_B5EAru{3_^|jw5{G2}32}b3R|*;C@*2(AYNuY7EA5U?WbjnWu>!_Jm@jsHW_o;rH!;Vs670^{ig+7vVJ6Nte}9afuAmrZKb07 zW#5ev7HEFzZ|NQ_R^XzL7}J1!(B8T4Wd;QM)5C&`avt zt!lcxpxQts7lDG&{cdCJW^Sk0_fG8YGYZ?Kr)zb7_(=@vJTf>K^(p1@u&(Ex6Eh8& z=zu-*8qsZDSqdl!%CFBJraGjmGwfobr~lk2D=)9lzgE0C41wZzOrnlgC0G4BR&_P^ z%cF7?R+Y0w=|>Fy{Bn?LleIiNn0?>~2S9cObz^NaO8010F4JH;e-x2&m2?$VfT zio#%jhA1&YvYlq(tQI=Z-}XE0jMn<#BL4bUb>Z{Y?hTB_W9?;a-f&G+SQ6Hv4L|}b zcEriocKQ>uMgJ%K`+f88f4eD=MKy2d zmPga5`g{)Q$oo|dacxu?(>ug*%~-CN_{W!K2#cGBLm{qf^e=30vJ3@#^+YP?&#vrQ z{+XznclocUb7c80%tk?SKe?u21iQA3I{^&z-@T0(R4wq`? zw?Mq^G(ZpO(aq}R2a?tK<6fL~bgzWQ2bZCzeuBTTDvn)(0(<4T<;x1o06^9_Jg9CF z+=C$R;jAmM(yR1x@wVYIxSds|YJg(~jVuk$?@}aIzx8e^YR)Uv)7SG4K@5GjGwu3z zF>CNr-q@DfH!X9E`@^irdy`A$2bZpCU2ec_P!j96GP}>~?G5xTSjz`X@TZ`m3bQfHGP9KPD9g5Mq&WWE-YA zZ%DCpynw`NU7&f6ZYD*{X$iq_1~(+?=CUgGNF!}44li21H^gteZ96(rK zYS9hLVj{?-dmqc zVFgfdmvHhF!LK^Rg0mE6BqnMZa+YBdO4pIGGAI_^bZS;Qt0e^dx_mK6WS|hLVbvSs z&TemSFSy())zZ`pt(xvJoJm)u!&FT;Q|4L#)Mc(pQ;P|AR=vcO(?T3aRxG9=re|*4 z3w@^VQJ}ta%rs$OjbEcj-B#Hc5b9zWZE%3?AHN{u7xlg9En2=;IES`1|1p&Q^oI9^ zBiluvecR?_*iEhNK7Bw!O0Tck=SK!t!J6z`}2dlkxEtP2nshZ*DJ)1B3QRD4*lE^I6@0 zqAXDV{Pz;nqV9Mh9xGT`MS!>H&Rdw3q2S5e(bPpRYXbAEC`*6btwiFD1 zSP;|t4tEL&BAc&2HtAR5sghBi<8*611?oz zZ-485-U=cA;a|d6oKZLq}5%DWlt^@1-#KN!A_Hep(uLugh3u8g`*^uTVXbra#Uw zBD$s5x;y^-F@Kx$IvvB84*dbGI4+@N4CPnc2BdmJ>`; zxkrHy?BP(F=CgWQ`~n<5H9c1N!oXsl12<7J?(`BS*C ztV?ALSBX=QpsL$#&u4V~biKoZpg^nusedKyTO)G-jDG|#(F4T1J@zuY!k`ZgMZuo0 z=@Y2C21+@6rtRvKJk(RuNw^?wc6!YOEqV9!y|0JVUxNDNo}x_I=BUnl{(XWVYzPd6 zfDns7#>G_vE;8``hXZ3gaSHq=-HBUm{^LbekvK#&09O$*%rk5_+GXyNGMhx5o}Xj#`2<^eV-Lxw`n| z+1q$1-;F0Z>F$wZbG#1^ZYd`1$p9b z-*&_4{^Mu*e+7&KhG)K*#pKV-25RTq1w3?i3L&Y3^K_>!!4;3N25{sfe&5w`ozk75 zB{Y|Ag-wJac&wQu@#oA;4~3Tt#;zZ5A?=HWQl@oyN240LW$EYKSGc7|24?XcQBhGf zF*Pwcjg3hj&%Y^>@5L9)qm}3iO*kap0& zm1A8%i6$u6RZkXJOXTspZED8ak}y*{2l(rErBVa0|5Ve|`F;oY*>+^4SQ?&Pot@fR zTU(kP>~E8w>8#E&qR1nTDU44B1qK6<2eoJ?D6yNs&&P{j6lZUIygY5K?XM_=+ycE? zd7P`moG@UEQ@bzHc0VV(^J;dtx&b6K+?qHv1h%@m{Fa*BEliuH_JAH}O@TONyT<|k zKlrd1|FJ22pbeL_Mk4oj2A&3$FK^Ux(a7KzR@~krAXo~hYtl;U2X*`K3uL>S2RjMQ z*KrKb!zEXZ_g9xKY&cTWF#qE0bshg`&6w^+Z)iU_%+XzT*qS!qW`mhC6y)isqk*nn z*5!7E!f$k2MWlQ(v2&0REOr=gyDE@@xA?d2|C;b7!o5?hb9XveM4(wG{4=%8v&(F? z@y}?!V@ED@V}>+Ge~KzIA9$ID?bfS1}O(8PXG95`>n$E%P@p{k5OlV@f~e zaE1c%TR#3iqNV^*ytOvyXIR&Z(^kTDk3!RpD~o{Jb)upg%rkn(Tns zId=naaM3<+;^g))jm9B^%PX?fk;B&7l3(K^CuhprKG%DPX>Q(gxae8)0nY}SVMHN+3uuQ4q@PZiWk)4yO$6Vjkw6rI-ualhdH?GnL)CV`W zdMK9$Y-EvMI^5xhiyYs#iERJ#<@GjZ!|n-xx2wMelC#Esm+op+!xraYckM?g`oE-$ zYqtI0MiJv5sw|&SF0_fT_v}oo6B|+CgjESh!Za}GF=0^+g?pOSH(|a+guP2D71x!T zQ%L3Tba~$%2|DhcABLyzL>YxzojJ^h934EQ_0?*7;UnFzFR;(gjNwm<+lFKk+5R{^ zqQW^hv{34le~*b&%TKN_y=s_UePOMk{o z^p7_BMDN5Fg%xP7qTs#~ob-OV9c+}=R6ft-Y|hI{>SBuUFWy8hp}dd25QKz)?9eeH zU0!m@DzMrZ7#e4;2bE#am3(V!kpD~74iNtf@rs4dcib{~HedP;YPxDa1%fA3m&-XF>}| zWPo$$*i~L08vg!Nu(WV-{9^S5rShXbgSHS2Ay|)zmMaf2l2JVC39)t02*;AUZ850V z>_@I0Q7QNj(u#Nrax(tJ-!eh@jM$pOe<_7r(_!jg%uEl%GwET^4I&h#PymYGNr;kw zc5KZULKiH^y=Ldl{}l_jDGZlZ@? z2#pzvnSvRyWfLjk@coZQw%uze`5y%gRE>oB|3@SP-Oc~!?f#z=II`s^9bgS2?fY6+ z_!5u5_0)qG3+SPfV>)nw;!$i-yo0u)3jFnD)joOuMFxloeRFtHoXl5L-o&qyCx z%o1H}wFuh?iio{I^qw6S%)9^*e);)rANL|Uoj_WZ+i?SM6y5akWP3SxY}o;?$JsL6 zqa(D8cX{d}8Hrev;8%wo7JX2I8<>M8!JY>Po@4r)&*^T<#AXBFhQyj}hsFHM=_#Wn ztXk2vr>QO_9Rk|>{?~~ixMRA&J~luV|=vmpdq(jf6e|sCIDlWxopS_iA6;Giu|C@Ml*sy&{wJdD7>WkFCr3 zmYfgL1jZLHKJdB?Jw(CpUd1v{BoyRD0vwjondsBP6lA_tc`f{x6-7BmeP{$xEpV4i&>wQJj7y z;V`V}Q`AaDB92@*RtNz-8-mtrQLsK{ewn7@7*5Z-J8m zTARTRXNolg{?s=LfdF9KNUPt_qpU0mFy4Xj?ysx7`!=GFe-nuK?uvKTB=i$g*J-64 z_k7`3FTC>NWXdntPT28_;5sXQoHCa5?EzM>k;*dX1B#%}nW1ax+PvhV{`^ve@tT<^ zq{FwX#sljBa-7hybPbkv)hXi>S}?kU$7AZc)u52o!@@@np>0hIPyQSf$XeT0&7y#T zEj}unO-Duab`5+r{`w3aLZjm;yutQPVq~F~HbX$L`sONz0m2e)B|$h2ZEVK#V|EG~ zgPMZ3VuWHwkCCX{-)g_yM@ob#+8w>P8_H4&@;z16`T67NxGdJ8#f`${^76x~WkCiy z-Y!4&+xMpO&jJesy@FnSuh^(qwEsBEpXD}3i*}$m4&94 zyZL#Hqba23J_%K}bt#>8FI*OH7l*`D11o#c1O5Gl{@P&7?ql>p8968{+h~ zulv@8mlLD)qPN$T_;9avYt?TWuSh6)S?Q^{Q%CdD!>LBCGfuZd092FDEC~ z4e0w_--J!r9Dk?EI$nJynIs)GEG8y$RMasbCrbb^x)&;*(%azgR_v4&bNQ;X$O?L8 z9c>_wHS(-o_PxVe-;gqen2Eln@U-P2&Q#C+^|&Q$_5$u%hOT6p;KFAY$FIlcr0@s~ z#56s`fn|X$CF1f6jOaj3C6QP~mpVp_)ISZBo2g{qH~oYERf7x%Rgm4G5FxMc|6#p5 z$)0hOUk(qvFsBuzm0&wVXFn>fPZ3}?QBwxu55hejAdWF(?TQ*Fz|-yIr;`ZVg*&z2 z^>owfKCs4o4+k`$WaPyET~gOMO*Y=Fp$maHW251uTUq~Z%I3&ogv&~2+?Ni9nzCjl zLI;ttcx~;1A&M2C7#juW)I#A@58ay1f`Z4DvKjocQy)PBFoJ!Am&8E$Tdw?*LwC)y zf)(?PVAtkqj$V(R4H1`}h80WA&E|H4wT~D^LY!Vs~(0U0JXwSt-ABWsMO_IEB*%y~;>7Vc6G zYSTROvn*(3Ma7JBCV(7hnvJj9&Eg0hDd7ShZ!))ekeH*zNrAQWd0|HudH8vavLhKus9i{}(f5 zk<;_3_HxtX`n#X@MHXyAt^nPmY>csU+xmfI9X&y0uD)=q$5)E913o=T?Y~{pVnyjX zLFb#lHJTxH4!OcFXNOr?g@XKU2rKWl4;O+IFXYh!hsC?${c(|J3%`jV?0P{~TCrzoxkG;^fW13LD^?VT##xv2Ph6`ol?5&^o zk5xF!N|q#i3A!KxlEBL3q+DQN^|xWFD+XWPH1GY1Zpg4J5JK>3|N6qzq3IE_b8 zr>23UC**tZyt;0_=ztxEE`!C$20H`j!Q{2Rh~UoGxilCVS@AfNl{^`QhmmVjvEpDc z0UAtp>2;kDzKT zEE$4}9{;1b;#5-D{=9S}&TGkpv$(W9o(cUIvu=iJn8~m+PxE>2au8_AoGVI4bSXcRbXK(gHT6vq+U-#|ow;upr%tEeMF;+VrXrP(reLT?ZTSk0{v(@c$_}%#C z*3q6ICh!cSdwEBH*+3m@Q_%N*B}4Z`T^R+X@fd-s-;kZtWjJIEZ3&HZDsdDGr!rlf zJ?u0{1R=?V@mCs=kIJ@+`;(f|P#rvW};BCvx`NT2JxLQJf*W0D4vE{J6 zY*(t*5WBSq%Rdged4jJ078Zw*6=v1CFYBSTkEiq}nHgK%ZYEyFHG$Hh(aL@kom#d1 zNfq2-Qf5P@d&=x7mVbB)<7}#)ipx5VnfIW228EgE~oGv9sCnPF$DbA z@96^#nvc(J8gOjWJ#@?3-Je7Hn`4&$Y(HevZSn^UW9fuRb{SP--haJG+kyB62X_)X zUV8KgNz^FI@^bSVHGEcg18`@QX$y-<5J>zUNARB6{-eIj`t;tel(I|`lpwZ9AzXS! zF2~IIajXD%-nMKZVNXlEXM+NhIGX)&Psd;vecS)V*f~bW)xP1r4H~nt8{4+i*jAH? zZKJVm+iGkl6Wg|viIX-w^Zw5|-_N&Mv-Yf+z317_zHwc@n~UtwkdQY@_{VTyKF0_G zlP&%@_Bb?YQg)!b;`2x*wTnv|X~FN$>)weZMGQ^DjZ^!G$f3}|(%dQ&yr&Tu*T1dE zc{A7~Kzt$=(=f0h??x-iIZOvo#I@r;vRIw*>mLAyC~pFdl;|}oqiZSXr`nIS4Mhbl z-T{q8Wf&W7MUsV`f01Lld^kzr9mp9vlNd9ojvrHKuzw*KH3JqZpIb@4HmUrecxB+% z(!Ko^D74+qW=M^G@9C3^dKmQ@T7t!%AvTOsg#|(_2@u=rD3*^xU}UZ;QNz`Jcjy`{W9f48Y-~OoZ~+ z(8l5|U3CLZM#lz1t1BSY(KGaRZ08CBUtl^3`98~sv7>@Xi8M(PgG%D(GAJhR0b4N` zIouEh@ii(1P$E!6vpKESAkb-LUCl7sZ8I-iXLP4_|0S%H-tFE5H(pD8Xl0^M8Q$V|FQJ&w&E+v%# z>A}KoUu5)<6_++?T%1%n%->Q`%bD}@jS@vrX}iph_Iy8Fly>k?1(#dd^+N)Sm-Ryb zOuL<+1cOyU`22zk1@Nsr%Y!eSd+lLJT%DcC+&I8#jiu5 zN5Pg+f*({D^hLqMu)i7kTuzvvJU)Mu{Y99R@<}rIXo( z=P)Q!5IvTaT5OtxXeD-bNGX*AZp#;D##ds0eB6GA@rao@dH?%KljuZbI2MljE;lXk z_IGJGhEbB*kc5i*=?hSKh|EDk`LU>&*`0ymt9LK%rAP}7Y##n&=2(uvfOhC_vV|vI zj^(8}VG<6))?KH;3&fOI32bn3D}~Zf{D2*ugU0%i?*BrWnY$}I**5h@3p7m< z7$LKg#6(&8k(qAwM~@2OFZ2L*k0qYaiVjbHvdTJr7=|A*v_gd}nW?bBGGTogXV$EZ z$b>?#7e#OL=2V)UK9YbwQqrEGK2yo@@hM!Mvgw@O#~Y6OyKuSMztO-ZKF2N+m=atcDwx;9GKVR|%dL*=){_B2TP^D(mZU|4EpK zqH>Q<&xhOU`pvEFVZ@GLct<>)P5?ZMs;x#kEhO1Hkr=c90)sWs^J>ZZ9p;`>J-ciW!v$$F=KU%o$}XPw(rVJTR< z+pf^_a84%APmKzJ4}I06I@aasVY1Qng{-1QNhCf7FYBEp1`VP>v5xFW;+2s8;r5xq z-NjOl@~ow{;q5IQ)uDT_uthm|#r=3m)70~sQLnv}@iGQnl-BdozJ2;vV2VsYIBB-X z7V3F_>9sr#OJ*k(5KSVD&gG)8{h3|C#NTY~>5oFz62`r8a~OrkMu6*k>Wt^iDmvuU zSl}FBccNt>eb|uKjZRlZJc78GLL-bydo9S*+;W^yCmbyTHhAP6Z*Zi-7B@rbRdHI$ zS@8&daHf-fxkZLm`nz6!G|Ta-AXH-v&s6)&Ms5n)TTVbqWx^-*~|UV3yMakE=v zXL8$Y2x`sCGq`x6iIK*1T4W~wC#)}a7SlM=*vNW3BF?n!Q22D@`0s>cIpKiIekN-~ z3I>k-#3hw7Mx6i`b+Nqu#Jaz|O&Q>HV6;%D<|hd-598!)gHg3eV&S`snn9*g&JZ=l z?mSuE;EMAXa3rS#*y^cmo(Ij`E5;SWC6m*@X(Biiwj9ltbY+GH%32Fpc*-WBQCnf+ zxplXggharLOHVD(BvL-gah_-zAYO}&ZCF*G9)yrQ2R^NYOueq$3)1vfKW+%AHB#WqDF1i$a!smhZiO=24Nc zQ&D-i0_M}%?N-Ks;~|L{0iH06dTIO&x zv!sypRW-caCF5m+yLv0iui43Z&xaqBunUCk|3+5{>loJ6KfeRFt!;2<6FiY*=_SR2*#@mW24Cginhk8L^}na~NS`fKN>LFfKoh z(*q29lZNeEpsGHmQrM}mB364T%mQTnYdkUql%f`JJ`-43maLb95-U>8J8MmuuO*WP+P47;jfFa|xoy7I)$)N>-pl=hhap#!g!phTQOxD}G--RY&LSx@jgI z(c09O+Ld$!ChNSsmqU38G(!^}kC!BOqzPZY7i9#Kd@{24M&c#bI^;$!Ol4duhyJX} zlg3v%zq281*`q1E0|Zl_`un*;cg3d}Wv*LPgpjwqj~|Kx+AqhOv`l0nTE-8Z7KmtM z-9VdK|L5{fEEI63a7*Nv_r!of)x!rTz=#uUKBgGo3)GqWSNHkElcHJg+;5T4B$2bw zgu#;0{?AE%Z|y^4ov<0al;9!YDuqXXv(RlbW6I)Xd4#V~5)r9_)Ot6BfC+Iw|Lv65 z>$gUV=%cu*SX$mg^H0aAl%=f5-XYVwNl>VGs>(`0s*pEFuDLXp?*3$6um3IuH4a(J z6Ro#Nh=eE|xwN{?M^TohnEbYw0aGpSQEGmoDX?z5aYogW5F%V$!{Fp{%goLmFI%2q zsm+lR2QKZM<&&Y`dFZ4|*gVy&ub-o2dVC4f?%>gtF7XjGq~CpeBg;`4(HZle zxrseK%C~UGlX6pvq})lc%8jqcg9{dp)>U!28s>y<3wN!1BeuUTERB4LbcwBtI1%G>f^2Ea%<2nQelHSI zLrb9I3-*hI{2EF!GWbW2WH}QlD!( zOEBw*a)q3k%+-~`kQwkdW#I-Br1Fw`tGwPXA}*^Tu?Oh8F+G;+I7?i5PvD+H`?EGCmyxub(e9#o0noo!=N7U?O!kl9HI>jsFV$W9Av>*ea z%=(Mf_d+g|m9R6ka3u?F5+^AULe-ZC<7H4b8&{r&23C#^yV|tdZ_$67j$9K~EyFPE z){|6js;);{H_v$Y2I=Z==X%AG0PouFuKSCMtU808P6y+i0FldsJGl=u~nh4$y}rYO{X35D@`W>nDg!c*Dzb_x!w6jqv!yvq*(Wd*EqYV&w` z3DF1fuInuOwi=Gxd%PZlB7AYf6a`0_>^=N8mp8-vFbPOTj2KEGTRyuTvnc;|qHx z>bk4m?XNE>bGkq&$KM1v4Xyf{JZ;T~Ms^|acs~;feU?6$ZU!qwh*#P#J5MZixx0p( zpb$=v3BD9xUhP4DC9RMPyGZeEE$%s<+L{P+0|~lbOIV66#VG65#^!4tZ)LVhxT9Qc zxj#HKb76XRmOjjVcY0g6W(KROWW(GpdG6VJZ;l=jPh#^2egls+ScmJ2wtfSXF{TH7 zlNzprlDXoDxgDO)Cq`P433~@Ha;&0(g->97!$`*;yn9$~Fqvz8XIPvqGAw$<2)u!{ zBDuP!{yhy}`zC)`K;4*~>6K-ao&qAJ+1^(Q7AC0y%dn{1CuwLoniYT3MSjl&%~Y^J zq6RBj%S8ZyJpyJyG)@_!mPdjnDr#2if#4E44P4{<)RFO%MsB1q4O^Jq!hs4lqg>uP zU7s)`(AHaGh_a-FDLsw9EU&ZO@YB(`47pL*0Xpy@{AVN{s#Rs5Qi^n6`cSa6oy~%~ z-VfHhOuQuSxG8>5HFsjol^>RHst#_+l9&+_E?Z$h$}%RcHVaXI>x9uK-)D235I}it z^G;ia^GONQPes|7JdXZhB}V1nfgEoB3NeH-=r;FkZt!-q6wDBE1*>Hq4AX>7=w(Pg z1N-00JXCDb4ohjs`Z1U?$sOAV`UG5-Hy0nkorlDer~BrHYc49sO0JM1uVu!;vZ2z_ zk|0HuOBX{`wdyZbR<(PQ77!_gsbXcrl#RX~3rPU74nFOq{LHo3rKXkNHy$k~T;=s` zEZtyo(~ry!A;maZJUrtt<4d@NA&08n9}#e9+pHMojU_B0uGb090LpLUXyWfS)xUJl zwGJ2|zpwd?pGB~!cFCi;da6Oyy4+=_qGOwtmqEan!HGxnMCathPd+6nC}y*Dr&VEw zR&AUqV+5|pnDRw4$z=!t#beRnGbYO~4%5ZuiSPfeB|#F({dBwjeWenP;RY}pp(>k# z;UjTUD<28{{GLFX8B1l^yB<( z?Uq{jS3r5#jZ&Sy0ITXmLh#~&VYzvIh&fD=RWpxA7L9xp;|z>yALsrQz?4QwMIfsA zvaG6v!B$dDR6DG~yqU1L(zJLKIkEVEw*RNijR$pG)_6K@L-fqlNN?5gcQ+W8Vx}gstZ(qN>lCrYETxDr$ z)-!MRs#{}#^`@@EF}^~=G4IV^klCJKuXgMmHUnTNT3cVUB9$Jglff#$tlxOAeqZnq zxOMxob%da;F6+K9es|6BkNcYU@>*2wiW#{)=mD1T*Fjocc0!~_!w^2Ld`*uo8eH0g zT`Q|6o&-DV4I%#@8R42^xxNvt7zws;r=j6LrOBOUkuqR6d5T#`c%9j<7&h}i4amoM z)3O$BG4v$L;J5#pQ{bObH#x$t@d2rNPpAs_Ke5SGC<^!uG5NjEcDEufgI+0e&bm~|L+W%nDT)-{}ZN?Tp^U#Yy1!J z@beYo|NqeaD7--lpWL64WUTeE$c75k{o)xvsZkFw0-~UNkTt>9$6}|7-%Ps>ZR-Sr zh9v60z@5P59OZ2>b!T#*eq^Egug7q$;v&f9{?y<;v{=rcgU5(HbmYHEATmTXr%U&4 z|A`g^=br)P-|_N+>py5CNys4_{@%6|5E;q^iph?`NKxiZK#x!cCdoKd2NY?Bs>o0< zq(yp&LJ%bF?jA(4z#rxd|JC~;lc@5Qdw+4H5u%J5p5R0;o(h{F)i^;3%4u$q$E4iON{gw*_`%L>tK0DnU+x>n^0t!l zuTQ*xOhWHXJ%!~>nVt<>+Q;0~Cw|hN(sNmNce;FlD<#L3ZB3kGSCjkyLPc8cxxi4(His_O;!%3JpS%ZOHqHdQX%W-!SV5i!o)~(cNBBt z?%VR}SWn%QJb&}{n6Y`EW8-}swV!3#({+{9bo8~f9Z3R{XlI*7AimHs1-!y|hpi4< z2G91EDne#l2OPU)=eewx4zNtoaB~&2=fTC!Z%#Lq#{2E>WaZrV7DDrL`0FDq7FR_W zT-d-eCZo!_kHV(h&p;y(Ws;6w?!;d@IaAs=rln`OHUHM0hSRkLDo>O+mm~;R(Ik-` z_nz|lT-=q)7P*wC?56wes7yW>b6ksecH5B{Kvbt^Ol(!HA3Ev3=U%=$awp|7!(^lS zv^vJ~yK7`#Flowk#BNj2?`p9U*NinGqG;tdtohND%R9@RlZd@)_ZAJ!uIWwg z1e9bfc=tY|JzzQ{3_mS;9Q?fM8|<$P08Uo@kc!G$`u zHzxsj*5fBYNBG)prkzX2zXMH&)%Z-v4wI z{xxm@_0F&j#7gsp-Sn9*#d$uEU5w=IY5>bv4@L74By2hb`g=!WBF!xCOYC`4(BGhjR#R)Q^mhy1!_x~Yw&25E zBtIm6l+1yx$cTd09^0w$@&xMVc;AW{ zMi-}S&SbxSsZsBT2#5!9-U1sDigL)Vx3`YWLU4Irh~Z#ReP& zk3eg_bl^%Ka>wrR$4+nFhonF=<@Qpqvwu$^rOjt?9;pqBv)2XFy^&vAnGgtm8h_L+T=}#T z>UI4an9{T!@cA~$J7qP=Yw;P8v(R9FOq>DO^qq`3sRo)|`Dd7i2SY@(jf^i)VZFQ| z!EL8aTxLbM<7SLnMK|R7Kb+o_m`4#`o$fCP&^;Sv_e>pcu55U9S|ND&ARFpNQ3Zkj zMKI8j4Mi{gBpSNb@2|tkQ)6pf&FSF5jojSB6oRy>v_j}vGv z@`R7y3yJ@!!^GQOQ=f0g8Cydq@wgL&0TODyxNX+|rlD$xp?A4wLM`Ets3P<4?GXGt zG7h8j1JR4F8d6rVQ1v!qudGu~we0x#-lzc=vUvClKH5T1qUxsML0oTs(*27hd}N)g z&TEcrsrJ3DjAUl_!;jr&1l{iDX0Z4%TN4qVuf4pHCO2!V{;bu&E-wNmkM_Q;Xevlx zfAM?|3Z20;-sxg>ecDOs2FxYTcOeY-+*`16{$Q=F&gMQ|+nvviVj_}x+vn)9RBQya zBLo_g1bAxh+kD*0n%7JhthraZNs{tH#Fr&%oX-=_tzII*&q?VGsvPRAQ)R*IP>{?pS8MYw`5J7ORi~@Tdz3)v< z9uz(e%j}X=*zt7VEDBiqKc@;ts5hYfKZn?fBFdPW}{XqJjry}9jh9o(Wgg3O6Cp|W9(3KbXV*s z%Ls7YO$M~vHw@I|be?3(W)?%wMy>Z&H()g*dOawm*5Q%vO|iv+{4Q!I1IDqx@-3`%bSmCE)chs z*u?d-B#6~SS=;w4==&Hb2CwKyMY_!YGuSQfHk&5yYO`JS!s2qZP+A!y9=``Xlk5tXSl+Pw@bv%Z@1g!r>ZOVU8P9xCnY!UBTIQ0mJN|CNOGORw*=JPln=3lk zUFu)biYNs(IbFD&IJ&uW)oWQ{)W4vqy015QONt#8ka%03Ob_(kR%LWFekjny)!I8q zaZ5k%9NWjuU+ua#7P9wT$7NCyJrfBsv^T@R+-_@rE*1dS@oCX1)EEIMg48v1bUyk@ z9>xhs`}_~PgNY4^h4T&b6V_xk#fg1J*r3|z28>A5te#E-))cAE(JOBQU$^CzIbnKL z1p~)eqg`j{}bb6uMUU>EdTHsE-Fv%dSerBPGaR8^3xT;LH z?NPPe)Z}+*hlck4ZY9E)0QI2X(faT(vU8aw4k5`CDfw;a7?3Fw+%=BVrdAz-~VrZwvMd?r~zkR z?n=ptB-G$+k*bJ@ui~G1xfR6wX6bAP*AX;+buzOI9vB zjMe2clvTCwf4S@1KObcP0kZkq-`oEFeg=+jf@o-Hv9YnlnU^!OI1)-K1>rN;@Ze>d zBN_=U>K2XIgJXoBs^nB5H@7$-PP;gX9$8YXML!6~oTu@#L?t^plD$!!RZhY<{bx>u zaB-ise&VkYD5G9@Q+T%*OvE)Vt3=iaoI?_kMJ9eVTICQqda7Q_ zx1E{)u8Bnn3#1fDt z&1Q@u8$m-I*jIx#VGB{c|5rYPNuGd|o?EvYg$`P4CB*DM za|_7}ebN#-svW;lOIK~A*^f-H=ib-7*w`HkY4HC%aV~taaw`RU6)mFXdu>quHAC!k zEUDc~J-y&z*ATR|pY>Y44$PfD9!&8=`=fT>LI#gu*h`eRvI@rK4h#&Cl7S77h?7%O zQ$RNj{6JA%x?wAisON9@d9mL1yNuxjPE~cg7p}~3BY9bj55x>vdn*_M&9^3h3@7|CPT|PI8B(>tbPIcYs z`MHUl@}$tpI>%C<>vQ-tC^h3mY%q0cUQUpcn3VOp|M;%D z#V>E!eJIOh&^7AaZ7&_?|9QyjJ{Z!~1!E0-UcwxM;x&o;ljE)0VYGS;UiR~xO2Gy{a6g!11G_lQ_Y?WX_O8CruaCo?n%Cvwb=L=DUoFBfvh#l_Xk zoAZ25jvjd+@=j71Igk*iBjBkgTOOg5S6BCYdXD*X`c!9QLqh{siToc{cB&YkZ!Ah%vH`#p%r;8QwO3f1BMZ-+TUAV9lfUBL#RlmCa`=5DIWoVrdr&x1}EhqBE9=p{0h4;IBB~ zb-ScSh4tVk3N_l>+as4&$P@H^IGrQG{re`3H%LBUr+cq3gt-4%1c^NaSiCX3&j=ax zfB9!f_$f$I^0rj>4(%q(q^FoXX3``>j%sSaD>StG`SvX2e>OW-Y(Lp<&i9HRR^92y zEkf}^aWH?xV)pqAvv6u27c23c=}F19OPmvav-MmT{lw-R$Crpz@aFIT`r7N~NRXH4 zZ+<59d23JD6J8{r?fGad+4uQ=i%pb9Mof^=!?kTFo{{6_Fw5K5>Kpbtd#9u>CjRmtWn``3 zLR;7YYmZ4F`%Z1?^c)>}DNkiJP31)X89tYk>%yKcG<2N1)8#%|W_C{d^xC*GeFG9s z`w#DTi^My;v=%o>VJ_6$(>V?OvN~LU(cbvGws*`$1$jZ~?L5=v^j5Yi_EH$npZ)1f{5 zSlGP1Q#LQ%V_Nfqg4y<&a=))`xpTT)l&dP@JL!b?WT7-ekZGXRqWX&sl0E>befHZ`NcQccZ#m6iV4aVE>9 z4iHf-wHZ=R;6iIaEupTE%_DCkpYoUnb|*}KgnCJ?L}P(TR8C31w&9LQNkb7B^FrvN zeo4zN%VAy)fs4m!Zb6Y2qv!4bAda9Zx!z3wb}1!B<_1k%ZY%gnBJjMY&~x_S%~gx} zNLS?|$I7|W7cUJg#xa;!J6IPdjES1f7e(aT`jzB7hB8L(;OvLKbG$|fsfI?uzm-tB z>)Fl=KWbETWp)AtE=3*-OCO4t_zp&7FqhfwV$t15=%$W?7@&oq9+?Vnx$fpBUX%_q6JE}^+E=K zHo0T8&i#*+M(3bMu<+tBFEiJlqN1oJuv9%qUmx09}AJYgYQW+n;#Pp@x?G4s8Gq`1L|K1PGhfht-Q6yh* z_$J%Ejs}h?CKgUYpPTS~Z?~@&BYcx}d<170KSmcWUP=K6+MD1)KSFP;Gdw8_7{{K!tYt^&ht?2 zbb$7m>}b;jpj}Z*bviybzu$DWb~l57uu+ZPt6Yp+=6B46oee`2uGUil0ZLvPx8)&5 zGr&TtnVq5`vxD#_&HemqXD3>)bDs2lE0s8IL=4M(sIa^-r&-+fUaTszw$qnLaSp z095KU1TV#~X;v+r$1NA3t+hU*)6Tp;*r!KZf6d}{*5&7$oSY=Jn=Yt8giMCTkVR-G zQeP%f21>X%k>})eBo-iZoz5g6d<>xi>!di%w{6wv)LW;agF!a?T8wWAv3saRb26;aduvuzs1_yNe1W8RsN)s$pwepx*&Rbjg*r1R8DN7C^+|5sliPW(IKnQ~E!oh6f7J8XL~4Dme&Wx^V3~wm6u~Ay%P`OG zTT@NS&ZzoC5`AtuLt7Q5>qDn1!q;vGU(0=N0oWC06Z+7!WBF$-0uLspxQw+V_l#-(X< zp^K&Uyq&{Pc5yn7G+74^X}bBZ>p%IkaP|3=Fk$ETt2{6vk3{T7FO$JzWMSMm8>nqd z`D6FSfbUeuu*1yOi?t(d;eS`l%eUWwat2)j-V@_<0zm@avG}N`HSv7z_;_$nquFBz zNRI@QS3xh2IBY&vi`f}$UHV<>9kDVE6*4TciQTXc#nQd?w^b)zFGi(;B4SkOctID9 zGnO`oqX__DGz&XB)HXaU?2V@X=GK;oFsJD_MrP?Jf6N?-VWh*29JfChvSMQ&_vhht zEkN%_6;kxf<78L6$9(kz-~^8Yhz;s-^WW3z-OcsgoWkH0(j~w2?dRXbe27!fApn8G zT%i>~0;c0DnHRc9>274#M+a1`?o&|>2|uel$g{T^9bJAoIK;OWXwA$6Z3jvc(_qZk z)16ITrU5FNTVvkrY)U+)BV&I3(-661f5RaszP-o>C&o)VPlKC|b?nxN*`tV$or<#S z$-X4s$$2vL_qYP?6yZG8wv-H8ygM^}LQW(7SI&|z&pB;oOZqa=AA+z`8jPYPK?99BnOG|BaI5{_`$4g$p zELb!F$MxmWA>W_p$EuyJ$Ow<$!yz;;w*>}v)G83B-D5G%g?v4M(MoYf5#Wxf>D$2f zFlV=`wN~$2L>3q`5)SW?padtI6EeDSnsrb21oK_sjLv zb^CA@E6XJYAKB#q0q=&V>a6RlQy|ADs zsL|V93TEe!V?**q+ci$F(RNQxQ&$nenwTrCFCQ(zI*Alfu48h`%R}?LxQ}R1({>$a z|5$nh%A@`7hGKdzk6Utu;otQVH2uz}n?D!(^XA6`!8Dx9g5STdNFX^j-6QEX0{lzO z{I3kwf8YqL2GnzQ*ypM|GbH%u9wimb7Byx;?`+BUW{;j9n252y4U0rW% z4UX+hn~isLXHj;zl!#F={)}sEyan+&&lO6G`MgvMHu+0%^=^|<)#>s%CZiddRxGDy z^Z;i2n!}K5;h!!9JSOKU0AXiE3KFH*{`xKAcD(_ZR_)Wp1s|8 zqTCicTYK#100d5YVvOU9or$%%-iu3)jT0%pOumQ6jV_X|IQP${Nrnm#=!fb-Dq{}E zz-aSl>~|{cCtOySw`0r*fPAvXo-FILsVQhXCnKfNy8osCi&j^rsGd=uWyC;aK~)|J zskgjdxkyr5R~H4J(+z7*z)@cU0PhX7oZoq zhU_qk4-MF9x19xAvF#tbR|XeJ(A!fv{Z~Tn$r$|3%NY)xObwFK4vBTGSg+-#&*9eB zbKJ6pgvQUyVsoHSXb$5z2==65s(p5P#G1>i%=9fU%5_5lxllw4cF`4f@1cZ({xmw3r9{wsexwYSt z!=K)5e%;fC79g5%w%fk350kkTJh{0He9TTs}G5VE7ggEs>iH z9ylPQ97a^1?uje zfar2luQyXo6xl^m5%jbVBK1y zg^E86zNQ|l$yhDs4+!6rKgB_>tX%dR^}gP~yVDB6_k|Or^SUtIg(i-ICKyfGOt8d! zr($Dv*i!6;#*|ZJFqIL9M+>F-n$zO;ZSP&)*UVItkhhrJ>6l;)& z3QW^UC>Qy)7@AyPBn7NXx4a@veF>(j%eXqc;sQw6d~O$Svi<_zr3z=>&r&JLTg z#O5lpz{kcswcNFyUt^K#jtgd2JYMX;oPkFeVhO~O(pnZF@xu<>EkhgoSy>6Gw*xRb~L1ziQcBjkPagkJ`xi^gDq+zqw+Ws(%U9JIh z9~t-U-M>kOEUp~>KjQ;x6ltX0q=~h4_yHm@zG>{%a+*iGi&T?a1LEY%#7zz(!3GP* zc3Wt6mdnbz!zbqxHeNsm!@Yyc3UY$%&?$YatQHUHY-l?+Q`6(kT!mg2jk~rE^uhcJ z1dX`seOcNoz4tH)aS92kVJQi!=^Tz>c*pZWtI3^`nQ@7TBDHcNTf!C-*9O(N;7Nut z&d_fv6%jQn$%I*|NJrso@hKOjF+O$mG50L(G{-`M0R75{gZM|;{$!rXMblr0=TP>BxJE_d-9Y*+-i2Y{pm|$JMz_-WqCe;*#P91C(AJ>W zq$OcqG;*CADWer27R<6{>M}kK2Qol!&k(gc=O|GIP@73#c*-lTakr;ssqZ{sN~;mm_Nye72C@sI1sSjfHhSAYqVMlX1^oKt1f% z8^Jwax4OHJjD4MZ9r;$Kn~|b*TYr^i1U?|>c9K(W1~-+QJ>xAbHJ895l>HfwDveWv zdxTy3)3n5A_Hcd9?0m31x|jILn%-vo{Lo{-2*9q*T54sR7ocEsF8n&xir?lr$O>?- z3wG6&bi0ioy`rM5!N+E{e%vN}pA7bi!`-#&Q#LNIF~!9rYPD2;D=r_tIC)C>5OwtQ zQVEIamdc}POk8`%OyTCT3eBo*yzWarnj3U+&4C%JjRkF~uJn<){j0Q#ElM@LCbFS9 zY**N-XW5d@F`6w;x3xZTog?frS-B&z)#2c_e6IX?)ayu?%cyAbo!5BmEkP_g+3i*`Xsxz{i46g>9Sl|E+|%*YCZ|?b~&p( zc62&#Cx&gWzrM1nQ~9Tu+4+5JVtIxDc!UcjRVNFF&rfc=)HUbp;Uln+A5M6&zm)?+ zuggC%Jv2XU{ud0$x{|Buh?5PEkq(cHjEjiD->3S&^;HeUEYd%r8 z_Y>&K+s?9U=o4se zYk3oOm^!jJhT*D%J3T2G-RhFBSQ{X-zU(c$o(s8_;oacIsCZszZ*PX}eshP0ihs4i zy0gvCZF)~B#APp_udBvkG8|yIFv3mkV6A#_vsI>Wy`9p|WG)}xa1p(vTju?$O6x8A z+V?v@KqTNDGUyu=j2qX`);Foz4Q2)?j&nYDF*AkfT;EPM^O$pyF~XNJ5RV%<8=tq7 z*7Iz+Ee}kC+x1$f`C~MTq(S{F7ckQ+R;bOKr>cIpBFvph3Pa(*nDc6EY;3#LTz=8S zSEBVH=he;hQlQB-m&JC@R&5|*uq<)FJHD;G;kC;)it?L#9^7(jMz{S*X0RRS69yr> zpxIS!_GONDgJKR3&e8RB|JDfow4kHIPHuIz`drb=q>kI(LqSew!;`HvF?zR~y-pLP zsl4t}dZ)dim*zF&7~eb<3dK^*RRB%E@dv`)W>(OMSg&}0nhjf*jnVBi!R;R7nPHwSZU$SY&D~g$^Js1OfSqURLG1n#pz&YX;ivcAx2K-xKU;YA#WH*anQSxtm?C=X~c_)Z7zz z9c>RnC=HexsugT7zfR53PHRlX)%BvX<4J7fBctQ9Rvo8Dm^9j7f2VrB+U~)urfY6J z*;U7VZD4gPojsC5AJGp6c95DThrdY~ve_brst;Q7xO*%U;xt!o z=^7M4Yf0_bzviiD{!aip2F3ZH;cHfn8)1Mu_=Utw=-tbJvatyoyLHn73q$Abqt>n- zKhlJ-*7X{-G<*NP-McdnWiA~uz+yz|fvn7oqkB?)yCGJ+leQel-nlr$bYRkUaGYf2 zWNhf`?``RveBk2Y-Me`arib;jv7WH&Wy8${{T4nPwm^%-Mgzz z*Raj&<~o{LI{J^=ye`hk!rH;Re>YI2f&GJm`+Gb17#ldyWZ>lVt@FJ7F{j=^5$Ru} zG4ScpqsO{+>sGH`9TgSD<#Kg&boBJ}{ugd40+V4F3r^7LDYWJ*hDmuGP!I)*kxdDd zc;hSr!$};cC}0=%t+gaUDG8i)m?lqPGWOlOU@rKBolZ3_g@L7-@&}7k?=vJQm68UT zsQ)G#w-%TTCx0J@0ied(7cFlp>b2-KrDx!zuV;fQEZDEOjlRAEg#5gOk-&1 z1bm?WYNb>;keCJgHwvN|JAGXncD=fG7;eq3RQ(4?Pg7PP0azTTZ1oKtKyDaV3bWQX zaMo4YfJlf^vIU?~lkxEjyW5x{>?T-%taSCA4GkSMi!0>D`tE}kZ^_=6I^9ZQBv)rh zPTFPyor0q5HX4Gj3JZd^BS|X-SSeswc}trZ0S1^>_qk}t?OjidVhh{u^sFvdv^3c(u!i6q&ktfl}gXCRfbJnjU-wszFIiTb!5NPVz;{>R4m!?0Q^_#0y*8%*X)SUv^ zm6Ggl%`V6<_=_zSHPP6A{nvl}UH$p-#~-z{v^sU_gyZ<+$&>$VjeS2rjkPb{YwTl9 zgxfVr3aG2?#AYkiB>SuJ#Zf#!)HQM9#IUfil`B_Hnlx!zi_erP zQ(|Ib($mwS#{MXv#@ZME!5V9i0F&veK=jsjdV7bBbyRwJf##Bq*f|HRZnjkOOn8XGWRh@W3~fBzm32;@(|*SGuN z!NXg=HWT~|d-duC0x$R9^Z^U@?c3MF!t!_0nA&8_yYCo{!=T3612nDD)zt?VahC7{ zKk)OXeymg~J@5l;@iVlxvaEIi&FRh2hs-LHF)M?9smFU07*qoM6N<$ Ef>;%O)Bpeg diff --git a/windows/deployment/volume-activation/images/vamt-db.png b/windows/deployment/volume-activation/images/vamt-db.png deleted file mode 100644 index 6c353fe8358008a0a5555b8f3966063c137f028a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8570 zcmeHtXE>Z)_wOVkNVF6|v_wes36UWff{0F{6HN5zL?87bi6973f?)LMy_+GJ(PQ-9 ziP6i9GBb?-Jm-B+xz2gd`M>AG`F1|s*M051*WTB<*S&tfwb$A^;+2*%-L<>d0001; zs>%x;0N~Oo`2kU1Cih(a$-GT|UGmUTRsfX!X5Sz;uGqrZO{;68)u3wb?X^PM^ESl$Wat^*gIE9K#p*&06PJ=S-OHBOw2Ukb4p z*>vGb`YXhQzN#cRwe6_TD1=C$G{06wsQO>!w)yy@v&YwhW~jsCH+Hme{j9Lb%XMJ} zae_O^DRv*zEzn9QoD^@)SP?P80GQ)_%moVo4ZKcZApk<=8F2vgvrtZelroy)`8qWe zfMJ(s0Hi;_T!MLA0Ruc^U{oQ$Z{PrKfS8z=va&KKR9v=DRSJ!IDCy9&iS>u6=^H=i z;X&c?49`G!ORE{x6Ty!=3%ftRW7P$PJ^FSoOY+^sv|dmJ^94@_j0%n4xf*yafkpjW zggDolG&OK*ta#igr@YU~s5 zy$kz|{@flw8AUE{cdzRijrNwd$U1eqf;Hx*d9xgkS|3B@0I5u$pgefT_k_nedgquyvbhg*GzRZdTTpOzME7*y`oR;G^$ zs(C@1>FSQ#ooz-+vvJ=XjKdl}o<-0s-ZNcWGVlLwB!RJkc7N8R@5$0Fv+>`kki3m$ zVNYY_@ARuT5Ek-Gu?cqP)hqoD5_jp*)@F(lHV8{Icc1d6N@nhGntp-FeJ4Jon3^Fl zO|39t74}?UN+tyEGZuMdTUqxQb1ReKCbNmO9M}7f)K4LW$)9NBQ;aw+SGs^)N}X=f z*2Y0nUrOB3<#&Roy4*>7BNT3fwa9O@ES_;PiJpsTHgKME?$a)q52$yUPVGJ0@0-k8 z23=iz+#TpYcFmK&mpd(`f(PTi*#0fdnrasqiU?i;BTnTnw*@MoPl^basoMgT{?D%c zZ~6cKwGd&9v^02eh#3lQK~zqqLC#iJ(_3Yr`-bZm)`^NZY%8g3q0pJ8YjY}is^8^y z0Y#e{_{#ak`Bp5ich_KD80t~qz`z#PXWoqSK(}y};^5Dp3Fd_WV~Oj=G6#~C;hNj` zJ=c67a(ic(^C>#*3)}P&Gw-1tfUA8AzJ3HN3`<<%2M+0cPCE z8thsqZ61SVLbbXDlyb|Ms?K5;oaMkODS{uj3M(iNz=fRJ!%N?!=bu@)hb~p@Zskd=*zlyK(#nue1;b6Qtk(=+2 z`n7U*CVUGvr(p2zkg2lHYYhrETSbRH!0L^|{dBJ62LZN#Q1WHZd znVso?=<+Y?=LXQ+&zAe$99v_`YTm9Kv43!X;OtM!s1R6BZ|F@9wqfq^<9a4DIJMYo z!+7XKI=s8_C{(xg%^WW0sY)Q7LOB+q`Q+Zc00d7uJcC(%y{UB8Pj zY+^u*rH)8!cf1&x6uRJi*jKys4aJ^>+W8b10h#FDELb>GRXgJz-%``rGf~q93-PN4 zs%KU_8EE0|%b3THqh42iuy>n_jVlzp!IDB`Nx0uKONs*$4-QqKE8sqR6 z7}cl+RiJN}e?TI4TX?hP`od~1JFSK2?6Jk`Gn+*{Ft0kFK?Li~)q~g!SqGW>EltLA ziTg-KH~Z!TyU=gS7vHmcW7WnIJG~bQ>dtVCc7djwo>G@(+3iyOf@s%%{Q#5XF7}i< z82cpT(G;8eVdg>eu7P`5_2(P@R3iv*4L%H3N3%UGKJ#hm86(irSeW46h62V z*9Ms2Va#G%T^q`In~`?ltuiDR{qT5~SrCrv0uQ_}dTCdp-dAXAF8awm@$6m{bg11z zX!e6Rw)zTqx4MI#z?w?0)Ue&2?o15;DWVsWT2`1ZvTp&lnL}+5dK#rBz*>J#p940aZ<8y>WhPmm}su>EDU%rQ)b&}Fd zr35tnm>LRU*7osKABim-{oxk7HhSOQIlMS#qJ&QuPGDV zpw`rc6=a)oYa)zi+P1ws4=V+}Do&z*D2KFK}vR1@xo>FY4pT%kGAj$ks)U zV3*JLtAaf}JrBt|2z%C^aw#E9`yu_|nP}WWE)ZboG`ADw zJtleC++7bFrt4}+>UTK^xoy_7Ny2T|JapE|L~s>9EUnEnT;Y)3h6Vc)W?P@8`I5Fj z5)S)gyoB;c+}{5%&nwOzJv(C7t~2MY;!EHD;`)uY076Vod$I+Jx5QL5Hkmy8-f$fx zFfr-!34dHWDhsNfH|cu3{rk0yY0qX};ktueb)NSw>PdXA?ct#2@7Ki3d^79tT6+7Z z?RgX|(|kKclHIBfdvz?S9MJ_c>B$kLM5W5iLu#Ib_od?;0_vdGE{@rO%QHV;*_(U$ z8S1c1|M)!FIH#t%?GRj!lAhRMgL7akn%akR?Ubj14AKL~qy1Tjs0*Qiu3v+&LDt;AVI8CLk z-M)3af!(T~I2Oj-tBrV4Hj`r2?67gC9M$a8CSSgHk7W7uR&rlE%<$%~_wk#c`3Ang znfaUMe9L3Tb1LesIhkx4h%(t{+xR8r?=^K}lW`GN4KC=xlNN_&?;y5;Y~FP~{^`la zvSaSG2Z_yZQsF|qT@09yb4K(iTnwcITy?k+> zJ_n!T0)uyys>Wp@(LQ@$!^}IC9h=P87?Xpy9%_cuIBsa^7fV+7OV?GVwcJyG7*x{S z7_d~%U}okbOuQ8Eb7o|o!MA<&?V*F{JhDR*NsjZ=g*7JkGt zkcS1=Cr^juy|c@80T~6x+>~gkw3GYJ15~qmmb<=@^X;+>emjB zh$v0oc~tHloR#V@=Tvyx;ERVkRqmL+0fL)~6L)YWmn#8x z#X5XUvmnWPJm;nRX`@h}U8*xTu~BlCE$j5Cz>4vwZ&e~hNrbYPAl!uFZhm1vpWpE5 z4Ew-j$b3wCISs#IAu|9$fs*Rz<7D;~cxm(DbNkoZR9r`2RwsrlH4R1mvj4I5XK4Qc zyKR@^G`j^jB-iVT2KF9Mj@bqJehZHfj|pLx`eKF&!aI+peV40#qG)mwQqvT#cFkBW zeJZn9R4yJ85yn91$TL(VCUxv|&!usn9#_pDFXmH@E1`3wHza<}FlKa-h>%cDs?RX0 zhn-x*eO!&yQ1*NOMl$oSc=UhCc>WzBpH*$ZZ0MXyLx4C@ z$j9#7!~7L}16Th7y>KIxbCN|qSpCX5$9-~VDI2cUt3*5s*5%EJYeS7+Bh+6I@yU=N z{NkpXtYIcR(fG~dX!59@;pQ5?2U)ABoV>1VYx;N`Mdp*#vYw$K{MyV`)VKZEn#USM zP?JmJI2vk=tOPmLlmVpcT+kOgt%0P)wZzWz_yp!F=RwUf)&0+8{Vz}s#6pA)Z=CME zE?<%NPk_-LH){|!qJp{h4ux;roE0?GE6Xr?^ZMW-l;mIOZ#Z%B+vVo)_=MyV$oIog z*aAdi0;m<6`3}*CL#~-W3S3c3L~E#WUH1HP4pW=_T!$awzMX10Q8d?`|$q z);A29!DDh_oqG8r9VyTIii@Sl`NkhX|InaVvkZ<*^OpHNW_+$+9--V-;X}+q_J=7M zPu;@LRwp`(M91 z0IRu7Gh7ekhY>n`z)h=BRQ#$vf-e#EB_`6CX~b7(f@W91%2uNJW~F;wZW(}0pbDYo zSIL8U+PkH#L3DrpWQ&Gy?v34u8eud@S`^I(mRW%y86WLJf?2v(zj1wvsCSj~y{Q;% zLo}m;^Bnr!NWPz=c&wImr+mPGf4Sj%^fI;sEU*bG6mt?091nOxwiR7o3A0yk)S4@f z;dl92myRrO+!%On6q_!!4~xZ>nuhuZfMXR(h}Fz$`5L=iJLauSliqUIb;kJkdjSmZkAp<;at*S75xL@%JYv#T^YKOvIKxzK3Dx zC>Ye{$>(htDYw()oE_GfA3qwbaMLFWr(Pp4eivi5^mr_S8%y|AMYvbvSzW1_G+tL& za>pjIBIU86_ZW-5|BtpiDxDI#=0dd4xGHl}g8hzeOMv~2^6GKubM#($S|4*qG4%9u z!P&CX+ArZAQuIi5wJU8fvj+mMv3pjW1|zT?Y2K;K72M5QlLv}#t!bylUSvC+7E7)J zd3U$|c45va(bD#M5fhIE)CWsW96?1T8fi*wz6J$g$@np$ChWfi+H0e&lBuC@t?Fr@ zs@@0pS_bQN%^7i%^kn!=qU3=+q=POl_1-=^fi=p1;&YA^ZEjqsfVPtU$2Z=jc0JpNmhV@d-;vXY$7^{NFIZeIh{NtL6HvB3RxLW%Ty2k=%j@gwBGpd^0*AYP za9Nq%WjttLP9i%qvDmPjXN`A@Iltu|=HxpAhK10j9mK+{_b2BpCQMeHAhZs&@&2;= zbtV1`L9WUywWq_B8Dt5V2Wjskmrdj^4mXSFp(z>o-VCw|e$N+7TP49khe1!uP6RPs zo?Hdu>*w5k2cm?P1O^{DI(8n_`L0+l=4XP{ItfakRv`>;Z|fJHwY3NC<<&Y9N;*6k z23gF)d;nn?hY`wOrPAJ(PT!B=O5OMYKeSWth|J1l-fQ*sy}h|12rDwiKsF3khq8;= zIWj*|eev{w9zd7<;>-#ae-s#L-@@y4y9-W!Yl}o&azjU!l#?Bs1{!@xxHS@FI@%8< z6PG3xT$L^|N#G4MmsNNw@V(H+hDpBdq4vet*FEf^kPK&T#bb=3Q=h@`Ow)_HYZZr@9TdaF`dp(ANbmMx>V)i)X#TLTgyd^rK;N04XdBCE*LNWb&53{Nw()T>xX3 z+#A&b7Cy8kkTT{^x+d^^{#R>m8#<^!`I!V9K~GvM>40fs|t@)!!>!Hpvg)bGEKJ0BzQk->blg`e4D44Zvj2#lAbP0kajYE4NXJ}Omml~~kZd2j;(FDXLOEy1Dc;}n zfbwLFud1zegb$*)n&aMIIajy>4pHR21Q#B+D)`@*KK~PZ|D!(o|Aqd&I`aP$JE33~ z%TYkt*q|q9V?f)lO7@EZ*ZCH|Cs)s1A2<$Y(;bJ?U2jO<1_4aA1z4AZXrcUgBp^h# zpAs&6?Kmm==6@RtI_x8FAKe&*h6L**C9VcKh>qL^xVhbR#pTKXaJl3RswDD~HWo{(kSup=}4w7~Mq38G=E(Amwq9TA-Qd4MLZbI<_d;~X%%O3d=B?K4cJmFo~H{o>+!VY zb&8!oRHl+ar>MXtr~f+1%H~uPUusg{*_n( zhOP^ym;o_XRbc4gAM0b|)cMj{UDtK_R;;2tnkwtC)F+rw%XJpZ^q~chAoiH$C35LF z0<9k-`w+2CShq;PP4A zoNOc|t9O*Me)4Z;P>E#))6=0Ig&%J;$8Q8EBIAS@w!0yQ_ZO)Q+K(~m<<{PCnCl~L zYKdfnX}*W%kwOw<0`%vI6F#kIIIU@#jW;Jw@YA=ev$Jbc95rDT$0Ghdq?fKsPc^zE zWSK<~nzWa%r{3m9zF3y}GNk)4)$#3$s;MhpXDgS*x>^&&BWD%?|EO;wS}%mj8P)#5 zLZ2Y37WIp^t2H3qwNBdv>HBh-6j>s_B00(ynRuo$&hWkMe^RdgNAH?fPl4o$hXDDI z$ihq6z{RP%yrKJd7{ZV5!0n?Tv3vZ4vuC{Ia6-R@KKj3U@&io4vM^9x7MWtu_B3i|RIqNv(A2tKzLoH* zd(>>NN`eXJ4I!tzO2D{TJhYx@%BN`k`MzPYhJAqWD-9leWV9>8@Qcs6XTrlL4@VR+ zde7Fb8rSnnsg8s(Ko}C;0f%4RT8-(BPJ@I^z&~HgS;&m|-=@NEe{%(^6RV2gg;6?j zS~%@=4nm3yJ@Qlk>1afx@ltuQFUQ@#oi9UQtXT`)waAShC`0-Jbk7|u=SF-swLh+3A%lohRh^qK`>91+Rg>!GnBk{pW9f`mRP9B;(p z?*@o*D5x1~fKSU3%DW@SXF3JMO4&-y6_mP#%%pA?%Y&v@(;MI_sAxhHVvs%)MZKo` z@vwsL=t+!n6rR&2_Uk((fBi2@$s73FDE16(i_%m73G`cE-oa)8kRE#vp^ZLLkfE6j zXY|xjsQHI4cXRLEjVc_aZLk&H8>!MwO2y5x*xi}*Lr0;qSkxFe!Kr>Z_4ZaoJaMvBpvC34WWqKpA5brw~v)tRU+sP(}o~jKaJ)c!V?^V8`ghTH0Z*~Z>amfnG zdLv&T6T|0**bFd2@(a9NxTb0~U2;;yic?6YaW=U<1f0kC!z4=3#-RxHyEyLjcQ;l7 zt;fh2YAa!^JU{6&b~V%=`zN|}yFwRQd@Y?9)2v4o*nj+GT!|HDaTOgf zi6lKJZ{^_E`gN9$SXZc6Te;Y-9t_~s3_d_IOT}Tb_$I3;c>If6!DGfVnLk9hF@O2L z*gXgpo|FS2^h=IPJ`T`--fgZLevUOWwx5F;f*5N0Axdp1%aZ6C%q@F?^Z+6P`2l1Q z38Eo{3Zvi!_1~&)B6LVEaGvJFF-BLBx2pqhwf|{;wO#mIK=7F{dO}KCe6p70 zQs9E~bRbJr2w#V$Z6xgA+lsDr^bCr^5Jn}*A1m;89RDJAm4(c zq>Sp=Zj}tR6;b{6ww;a#DRuHTMZhf|ctrjhtWm9zyb4czV0Lv8HW%*S*cdB{x}3&k z{&H62f9J4M2aOW=#Laysg(^QnB$}CG5C%!KeT@0rFh~*c;acl3Yz(Z({x}J6`gA34p4S){8QQx1s+56Qd$z diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index ec3ea1a746..7722da4cda 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -7,7 +7,7 @@ ms.author: frankroj ms.prod: windows-client author: frankroj ms.localizationpriority: medium -ms.date: 10/11/2023 +ms.date: 10/13/2023 ms.topic: article ms.technology: itpro-fundamentals --- @@ -42,41 +42,49 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 1. Download and open the [SQL Server Express](https://aka.ms/sqlexpress) package. -1. Select **Basic**. +1. For **Select an installation type:**, select **Basic**. -1. Accept the license terms. +1. In the **Microsoft SQL Server Server License Terms** screen, accept the license terms by selecting the **Accept** button. -1. Enter an install location or use the default path, and then select **Install**. +1. In the **Specify SQL Server install location** screen under **INSTALL LOCATION \*:**, specify an install location or use the default path, and then select the **Install** button. -1. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. +1. Once the installation is complete, in the **Installation Has completed successfully!** page, under **INSTANCE NAME**, note the instance name for the installation - ![Screenshot that shows that in this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) +1. Once the instance name has been noted, select the **Close** button, and then select the **Yes** button to confirm exiting the installer. ### Install VAMT using the ADK 1. Download the latest version of [Windows ADK](/windows-hardware/get-started/adk-install). - If an older version is already installed, it's recommended to uninstall the older ADK and install the latest version. Existing VAMT data is maintained in the VAMT database. + If an older version is already installed, it's recommended to first uninstall the older ADK before installing the latest version. Existing VAMT data is maintained in the VAMT database. -1. Enter an install location or use the default path, and then select **Next**. +1. Open the ADK installer that was downloaded in the previous step. The **Windows Assessment and Deployment Kit** window opens. -1. Select a privacy setting, and then select **Next**. +1. In the **Windows Assessment and Deployment Kit** window: -1. Accept the license terms. + 1. At the **Specify Location** page, under **Install Path:**, enter an install location or use the default path. It's recommended to install at the default path. Once done, select the **Next** button. -1. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. If desired, you can select additional features to install as well. + 1. In the **Windows Kits Privacy** page, select a privacy setting, and then select the **Next** button. -1. On the completion page, select **Close**. + 1. In the **License Agreement** page, accept the license terms by selecting the **Accept** button. + + 1. In the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**. If desired, select any additional features to install. Once done, select the **Install** button. + + 1. Once installation is complete, the **Welcome to the Windows Assessment and Deployment Kit!** page is displayed. Select the **Close** button. ### Configure VAMT to connect to SQL Server Express or full SQL Server -1. In the Start Menu under, **Windows Kits**, **Volume Active Management Tool 3.1**. +1. In the Start Menu under **Windows Kits**, select **Volume Active Management Tool 3.1**. The **Database Connection Settings** window opens. -1. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. +1. In the **Database Connection Settings** window: - ![Screenshot that shows that the Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) + 1. Next to **Server:**, enter the server instance name as determined in the [Install SQL Server Express / alternatively use any full SQL instance](#install-sql-server-express--alternatively-use-any-full-sql-instance) section. If SQL is remote, make sure to use the FQDN. - For remote SQL Server, use `servername.yourdomain.com`. + 1. Next to **Database:**, add a name for the database. + + 1. Once the database server and database names have been entered, select the **Connect** button. + + 1. Select the **Yes** button to create the database. ## Uninstall VAMT From 037b2c4b8c815ae81558ca78856dbfea6b4c2042 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 10:37:22 -0400 Subject: [PATCH 081/151] VAMT Refresh 4 --- windows/deployment/volume-activation/install-vamt.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 7722da4cda..76d691eef4 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -10,6 +10,12 @@ ms.localizationpriority: medium ms.date: 10/13/2023 ms.topic: article ms.technology: itpro-fundamentals +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 + - ✅ Windows Server 2022 + - ✅ Windows Server 2019 + - ✅ Windows Server 2016 --- # Install VAMT From 42bb473c5cbbff0a1808e7e763d1b6e14c20fcdb Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 10:54:31 -0400 Subject: [PATCH 082/151] VAMT Refresh 5 --- .../deployment/volume-activation/install-vamt.md | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 76d691eef4..6e70f88b5c 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -20,11 +20,7 @@ appliesto: # Install VAMT -This article describes how to install the Volume Activation Management Tool (VAMT). - -## Installing VAMT - -You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows. +This article describes how to install the Volume Activation Management Tool (VAMT). VAMT is installed as part of the Windows Assessment and Deployment Kit (ADK) for Windows. >[!IMPORTANT] > @@ -34,7 +30,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for > > The VAMT Microsoft Management Console snap-in ships as an x86 package. -### Requirements +## Requirements - [Windows Server with Desktop Experience](/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access (for the main VAMT console) and all updates applied. @@ -44,7 +40,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for - Alternatively, any supported **full** SQL instance. -### Install SQL Server Express / alternatively use any full SQL instance +## Install SQL Server Express / alternatively use any full SQL instance 1. Download and open the [SQL Server Express](https://aka.ms/sqlexpress) package. @@ -58,7 +54,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 1. Once the instance name has been noted, select the **Close** button, and then select the **Yes** button to confirm exiting the installer. -### Install VAMT using the ADK +## Install VAMT using the ADK 1. Download the latest version of [Windows ADK](/windows-hardware/get-started/adk-install). @@ -78,7 +74,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 1. Once installation is complete, the **Welcome to the Windows Assessment and Deployment Kit!** page is displayed. Select the **Close** button. -### Configure VAMT to connect to SQL Server Express or full SQL Server +## Configure VAMT to connect to SQL Server Express or full SQL Server 1. In the Start Menu under **Windows Kits**, select **Volume Active Management Tool 3.1**. The **Database Connection Settings** window opens. From 73eb9bee83a47699a906ee46043459030cf337a3 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 11:39:32 -0400 Subject: [PATCH 083/151] VAMT Refresh 6 --- ...ivate-using-key-management-service-vamt.md | 2 +- .../volume-activation/install-vamt.md | 27 ++++++++++++++++--- 2 files changed, 24 insertions(+), 5 deletions(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 0e2ab42a94..8c36f27930 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -80,7 +80,7 @@ KMS can be activated on client versions of Windows by using the `slmgr.vbs`. To 1. In the elevated Command Prompt window, run the following command: ```cmd - cscript.exe slmgr.vbs /atp \ + cscript.exe slmgr.vbs /atp ``` ## Key Management Service in Windows Server diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 6e70f88b5c..0c58850102 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -50,7 +50,7 @@ This article describes how to install the Volume Activation Management Tool (VAM 1. In the **Specify SQL Server install location** screen under **INSTALL LOCATION \*:**, specify an install location or use the default path, and then select the **Install** button. -1. Once the installation is complete, in the **Installation Has completed successfully!** page, under **INSTANCE NAME**, note the instance name for the installation +1. Once the installation is complete, in the **Installation Has completed successfully!** page, under **INSTANCE NAME**, note the instance name for the installation. The instance name will be used later in the [Configure VAMT to connect to SQL Server Express or full SQL Server](#configure-vamt-to-connect-to-sql-server-express-or-full-sql-server) section. 1. Once the instance name has been noted, select the **Close** button, and then select the **Yes** button to confirm exiting the installer. @@ -90,8 +90,27 @@ This article describes how to install the Volume Activation Management Tool (VAM ## Uninstall VAMT -To uninstall VAMT using the **Programs and Features** Control Panel: +To uninstall VAMT: -1. Open **Control Panel** and select **Programs and Features**. +1. Right-click on the Start Menu and select **Settings**. -1. Select **Assessment and Deployment Kit** from the list of installed programs and select **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. +1. Select **Apps** in the left hand pane. + +1. In the right hand pane under **Apps**, select **Installed apps**. + + Alternatively, select the following link to automatically open the **Settings** app to the **Installed apps** page: + + > [!div class="nextstepaction"] + > [Activation](ms-settings:appsfeatures) + +1. Scroll through the list of installed apps and find **Windows Assessment and Deployment Kit**. + +1. Select the the three dots **...** next to **Windows Assessment and Deployment Kit** and then select **Modify**. The **Windows Assessment and Deployment Kit** window opens. + +1. In the **Windows Assessment and Deployment Kit** window: + + 1. In the **Maintain your Windows Assessment and Deployment Kit features** page, select **Change**, and then select the **Next** button. + + 1. In the **Select the features you want to change** page, uncheck **Volume Activation Management Tool (VAMT)**, and then select the **Change** button. + + 1. Once the uninstall is complete, the **Change is complete.** page is displayed. Select the **Close** button. From 3586648e374ccf0c80792bf41db0a63f531d519e Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Fri, 13 Oct 2023 09:06:05 -0700 Subject: [PATCH 084/151] Typo --- .../windows-autopatch/overview/windows-autopatch-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 66e6fd2e1d..6ac52fd9df 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -34,7 +34,7 @@ sections: Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Azure AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid). - question: Will Windows Autopatch be available for state and local government customers? answer: | - Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not suppported. + Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not supported. - question: What if I enrolled into Windows Autopatch using the promo code? Will I still have access to the service? answer: | Yes. For those who used the promo code to access Windows Autopatch during public preview, you'll continue to have access to Windows Autopatch even when the promo code expires. There's no additional action you have to take to continue using Windows Autopatch. From 618ae9ab7508a214115db6eafb143288e5472d5b Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 13 Oct 2023 14:12:13 -0400 Subject: [PATCH 085/151] VAMT Refresh 7 --- windows/deployment/volume-activation/install-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 0c58850102..c7d7ab007c 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -101,7 +101,7 @@ To uninstall VAMT: Alternatively, select the following link to automatically open the **Settings** app to the **Installed apps** page: > [!div class="nextstepaction"] - > [Activation](ms-settings:appsfeatures) + > [Installed apps](ms-settings:appsfeatures) 1. Scroll through the list of installed apps and find **Windows Assessment and Deployment Kit**. From c1d9391ebb8256775a62247264291a1c9f0be802 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 13 Oct 2023 11:26:04 -0700 Subject: [PATCH 086/151] edits --- windows/deployment/update/wufb-compliancedeadlines.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index f2c57cfa7d..714ea509f5 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -37,7 +37,7 @@ With a current version, it's best to use the new policy introduced in June 2019 | Policy | Location | Quality updates deadline in days | Quality updates grace period in days | Feature updates deadline in days | Feature updates grace period in days | |-|-|-|-|-|-| -| Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 2 | 2 | 2 | +| Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 2 | 2 | 7 | When **Specify deadlines for automatic updates and restarts** is set: @@ -58,7 +58,7 @@ The grace period for both quality and feature updates starts its countdown from |Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| |-|-|-|-|-| -|(Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 2 | 2 | 5 | +|(Windows 10, version 1709 and later) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 2 | 7 | 2 | When **Specify deadlines for automatic updates and restarts** is set (Windows 10, version 1709 and later): From 32b0bf95a948cb1f55a6911997ea5ca235c0fbfc Mon Sep 17 00:00:00 2001 From: Carmen Date: Fri, 13 Oct 2023 12:48:43 -0600 Subject: [PATCH 087/151] Update DO docs --- .../do/waas-delivery-optimization-reference.md | 14 ++++++++++++++ .../deployment/do/waas-delivery-optimization.md | 1 + windows/deployment/update/wufb-reports-do.md | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index a3302aa5c3..b96431fff7 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -48,6 +48,8 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Monthly upload data cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 | Default value is 20 GB. | | [Minimum background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 | Recommend setting this to 500 KB/s. Default value is 2500 KB/s. | | [Enable peer caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 | Default is to not allow peering while on VPN. | +| [VPN Keywords](#vpn-keywords) | DOVpnKeywords | 22H2 September Moment | Allows you to set one or more keywords used to recognize VPN connections. | +| [Disallow Cache Server Downloads from VPN](#disallow-cache-server-downloads-on-vpn) | DODisallowCacheServerDownloadsOnVPN | 22H2 September Moment | Disallow downloads from Microsoft Connected Cache servers when the device connects via VPN. By default, the device is allowed to download from Microsoft Connected Cache when connected via VPN. | | [Allow uploads while the device is on battery while under set battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1709 | Default is to not allow peering while on battery. | | [Maximum foreground download bandwidth (percentage)](#maximum-foreground-download-bandwidth) | DOPercentageMaxForegroundBandwidth | 1803 | Default is '0' which will dynamically adjust. | | [Maximum background download bandwidth (percentage)](#maximum-background-download-bandwidth) | DOPercentageMaxBackgroundBandwidth | 1803 | Default is '0' which will dynamically adjust. | @@ -307,6 +309,18 @@ MDM Setting: **DOAllowVPNPeerCaching** This setting determines whether a device will be allowed to participate in Peer Caching while connected to VPN. **By default, if a VPN connection is detected, peering isn't allowed, except when the 'Local Discovery' (DNS-SD) option is chosen.** Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network. The device can download from or upload to other domain network devices, either on VPN or on the corporate domain network. +### VPN Keywords + +MDM Setting: **DOVpnKeywords** + +This policy allows you to set one or more keywords used to recognize VPN connections. **By default, this policy is not set so if a VPN is detected, the device will not use peering.** Delivery Optimization automatically detects a VPN connection by looking at a pre-defined set of VPN names. As the number of VPNs grow it’s difficult to support an ever-changing list of VPN names. To address this, we’ve introduced this new setting to set unique VPN names, which will be recognized by Delivery Optimization and therefore resulting in the expected behavior to help manage peering. + +### Disallow Cache Server Downloads on VPN + +MDM Setting: **DODisallowCacheServerDownloadsOnVPN** + +This policy disallows downloads from Connected Cache servers when the device connects via VPN. **By default, the device is allowed to download from Connected Cache when connected via VPN.** + ### Allow uploads while the device is on battery while under set Battery level MDM Setting: **DOMinBatteryPercentageAllowedToUpload** diff --git a/windows/deployment/do/waas-delivery-optimization.md b/windows/deployment/do/waas-delivery-optimization.md index d16c8dbb78..dcfbe153c3 100644 --- a/windows/deployment/do/waas-delivery-optimization.md +++ b/windows/deployment/do/waas-delivery-optimization.md @@ -62,6 +62,7 @@ The following table lists the minimum Windows 10 version that supports Delivery | Xbox Game Pass (PC) | Windows 10 1809, Windows 11 | :heavy_check_mark: | | :heavy_check_mark: | | Windows Package Manager| Windows 10 1809, Windows 11 | :heavy_check_mark: | | | | MSIX Installer| Windows 10 2004, Windows 11 | :heavy_check_mark: | | | +| Teams | Windows 10 2004, Windows 11 | :heavy_check_mark: | | | #### Windows Server diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 05cfa795ab..d71d76d0be 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -95,7 +95,7 @@ Each calculated values used in the Delivery Optimization report are listed below ## Mapping GroupID -In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash. You can create a mapping of original to encoded GroupIDs using the following PowerShell example: +In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash and is case sensitive. You can create a mapping of original to encoded GroupIDs using the following PowerShell example: ```powershell $text = "`0" ; # The `0 null terminator is required From 52e689ba12ac21b2923bfdb2adce3e724c41765e Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Fri, 13 Oct 2023 15:26:19 -0500 Subject: [PATCH 088/151] Update windows/deployment/volume-activation/install-vamt.md --- windows/deployment/volume-activation/install-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index c7d7ab007c..455f978c0a 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -105,7 +105,7 @@ To uninstall VAMT: 1. Scroll through the list of installed apps and find **Windows Assessment and Deployment Kit**. -1. Select the the three dots **...** next to **Windows Assessment and Deployment Kit** and then select **Modify**. The **Windows Assessment and Deployment Kit** window opens. +1. Select the three dots **...** next to **Windows Assessment and Deployment Kit** and then select **Modify**. The **Windows Assessment and Deployment Kit** window opens. 1. In the **Windows Assessment and Deployment Kit** window: From cc5c3d9a607d7f46fb9fb401b8c7c5ccd626de7e Mon Sep 17 00:00:00 2001 From: Rei Ikei <47890550+reiikei@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:35:54 +0900 Subject: [PATCH 089/151] Update policy-csp-controlpolicyconflict.md Most users are now using 1809 or later versions, and I think this statement is misleading customers. --- .../client-management/mdm/policy-csp-controlpolicyconflict.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 485f675610..4c27326f83 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -49,7 +49,7 @@ If set to 1 then any MDM policy that's set that has an equivalent GP policy will This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. > [!NOTE] -> This policy doesn't support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. Windows 10 version 1809 will support using the Delete command to set the value to 0 again, if it was previously set to 1. +> In Windows 10 version 1803, this policy doesn't support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: From 54f1a411e866d58dfff95e61a9c5b1a6c40d2cff Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:53:44 -0400 Subject: [PATCH 090/151] Add additional links Add additional links --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 8c36f27930..6d911b23fc 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -191,7 +191,7 @@ For more information about the use and syntax of the script `slmgr.vbs`, see [Sl > [!IMPORTANT] > -> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. +> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see (Key Management Services (KMS) activation planning: Network requirements)[/windows-server/get-started/kms-activation-planning#network-requirements] and (Remote Procedure Call (RPC) errors troubleshooting guidance)[/troubleshoot/windows-client/networking/rpc-errors-troubleshooting] ## Related articles From 5ed70a1ef89cb807beb4fab0104f7cdb0fe836d7 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:58:28 -0400 Subject: [PATCH 091/151] Update ms.date Update ms.date --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 6d911b23fc..12f1d9ac39 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -8,7 +8,7 @@ author: frankroj manager: aaroncz ms.author: frankroj ms.localizationpriority: medium -ms.date: 10/13/2023 +ms.date: 10/16/2023 ms.topic: how-to ms.collection: - highpri From c499dc1ffcdb2971da2102b2b48362181be3a103 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 12:04:14 -0400 Subject: [PATCH 092/151] Fix links Fix links --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 12f1d9ac39..b1056c9728 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -191,7 +191,7 @@ For more information about the use and syntax of the script `slmgr.vbs`, see [Sl > [!IMPORTANT] > -> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see (Key Management Services (KMS) activation planning: Network requirements)[/windows-server/get-started/kms-activation-planning#network-requirements] and (Remote Procedure Call (RPC) errors troubleshooting guidance)[/troubleshoot/windows-client/networking/rpc-errors-troubleshooting] +> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see [Key Management Services (KMS) activation planning: Network requirements](/windows-server/get-started/kms-activation-planning#network-requirements) and [Remote Procedure Call (RPC) errors troubleshooting guidance](/troubleshoot/windows-client/networking/rpc-errors-troubleshooting). ## Related articles From da7de5b5aeac0397eccdd5f5e37c2bdf9dcde53e Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 16 Oct 2023 12:47:35 -0400 Subject: [PATCH 093/151] Added new rules and updates since 2309 --- ...icrosoft-recommended-driver-block-rules.md | 367 +++++++++++++++++- 1 file changed, 362 insertions(+), 5 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 398a529b8e..3eac346b20 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -81,7 +81,7 @@ To check that the policy was successfully applied on your computer: ```xml - 10.0.25930.0 + 10.0.25965.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -662,6 +662,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -691,6 +695,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -889,6 +977,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -915,6 +1023,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -1171,6 +1295,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1213,10 +1387,10 @@ To check that the policy was successfully applied on your computer: - + - + @@ -1225,7 +1399,7 @@ To check that the policy was successfully applied on your computer: - + @@ -1241,6 +1415,7 @@ To check that the policy was successfully applied on your computer: + @@ -1353,6 +1528,7 @@ To check that the policy was successfully applied on your computer: + @@ -1476,6 +1652,7 @@ To check that the policy was successfully applied on your computer: + @@ -1994,6 +2171,11 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -2195,6 +2377,7 @@ To check that the policy was successfully applied on your computer: + @@ -2811,6 +2994,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -2840,6 +3027,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3039,6 +3310,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -3065,6 +3356,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -3325,6 +3632,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3357,7 +3714,7 @@ To check that the policy was successfully applied on your computer: - 10.0.25930.0 + 10.0.25965.0 From 3eee0549fa3661728c2f9bfe57911751f346407c Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 11:19:10 -0600 Subject: [PATCH 094/151] More additions --- .../deployment/do/waas-delivery-optimization-faq.yml | 1 - .../do/waas-delivery-optimization-reference.md | 12 ++++++------ windows/privacy/manage-windows-11-endpoints.md | 2 +- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 96509b2f68..92ff9cd2d4 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -51,7 +51,6 @@ sections: **For the payloads (optional)**: - - `*.download.windowsupdate.com` - `*.windowsupdate.com` **For group peers across multiple NATs (Teredo)**: diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index b96431fff7..76133cf655 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -34,7 +34,7 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | Group Policy setting | MDM setting | Supported from version | Notes | | --- | --- | --- | ------- | -| [Download mode](#download-mode) | DODownloadMode | 1511 | Default is set to LAN(1). The Group [Download mode](#download-mode) (2) combined with [Group ID](#group-id), enables administrators to create custom device groups that will share content between devices in the group.| +| [Download mode](#download-mode) | DODownloadMode | 1511 | Default is set to LAN(1). The Group [Download mode](#download-mode) (2) combined with [Group ID](#group-id), enables administrators to create custom device groups that share content between devices in the group.| | [Group ID](#group-id) | DOGroupID | 1511 | Used with Group [Download mode](#download-mode). If not set, check [GroupIDSource](#select-the-source-of-group-ids). When GroupID or GroupIDSource policies aren't set, the GroupID is defined as the AD Site (1), Authenticated domain SID (2) or Azure AD Tenant ID (5), in that order. | | [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | If not set, check [Group ID](#group-id). When the GroupID or GroupIDSource policies aren't set, the Group is defined as the AD Site (1), Authenticated domain SID (2) or Azure AD Tenant ID (5), in that order. | | [Select a method to restrict peer selection](#select-a-method-to-restrict-peer-selection) | DORestrictPeerSelectionBy | 1803 | Starting in Windows 11, a new option to use 'Local discovery (DNS-SD)' is available to set via this policy. | @@ -176,19 +176,19 @@ MDM Setting: **DOMinDiskSizeAllowedToPeer** This setting specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The recommended values are 64 to 256, and **the default value is 32 GB**. >[!NOTE] ->If the [Modify Cache Drive](#modify-cache-drive) policy is set, the disk size check will apply to the new working directory specified by this policy. +>If the [Modify Cache Drive](#modify-cache-drive) policy is set, the disk size check applies to the new working directory specified by this policy. ### Max Cache Age MDM Setting: **DOMaxCacheAge** -In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. Alternatively, organizations might choose to set this value to "0" which means "unlimited" to avoid peers redownloading content. When "Unlimited" value is set, Delivery Optimization holds the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). **The default value is 259,200 seconds (three days)**. +In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. Alternatively, organizations might choose to set this value to "0" which means "unlimited" to avoid peers redownloading content. When "Unlimited" value is set, Delivery Optimization holds the files in the cache longer and cleans up the cache as needed (for example when the cache size exceeded the maximum space allowed). **The default value is 259,200 seconds (three days)**. ### Max Cache Size MDM Setting: **DOMaxCacheSize** -This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows client device that has 100 GB of available drive space, then Delivery Optimization uses up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. **The default value is 20%**. +This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows client device that has 100 GB of available drive space, then Delivery Optimization uses up to 10 GB of that space. Delivery Optimization constantly assesses the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. **The default value is 20%**. ### Absolute Max Cache Size @@ -207,7 +207,7 @@ This setting specifies the minimum content file size in MB enabled to use Peer C MDM Setting: **DOMaxUploadBandwidth** Deprecated in Windows 10, version 2004. -This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). **A default value of "0"** means that Delivery Optimization will dynamically adjust and optimize the maximum bandwidth used. +This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). **A default value of "0"** means that Delivery Optimization dynamically adjusts and optimize the maximum bandwidth used. ### Maximum Foreground Download Bandwidth @@ -257,7 +257,7 @@ MDM Setting: **DORestrictPeerSelectionBy** Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option. In Windows 11, the 'Local Peer Discovery' option was introduced to restrict peer discovery to the local network. Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. These options apply to both Download Modes LAN (1) and Group (2) and therefore means there's no peering between subnets. -If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID). +If Group mode is set, Delivery Optimization connects to locally discovered peers that are also part of the same Group (have the same Group ID). The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 79bba0d70f..229303a26c 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -165,7 +165,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| -|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization](../deployment/update/wufb-reports-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| |||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| From c95d8fcc14bfd1a3e259fae8d21dbe64a6ffe422 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:36:17 -0700 Subject: [PATCH 095/151] edits --- windows/whats-new/deprecated-features.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index a5dc0afb27..8f1918afe9 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 10/09/2023 +ms.date: 10/18/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Timeline for Azure AD accounts | Cross-device syncing of Azure AD user activity history will stop starting in March 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | +| Timeline for Microsoft Entra accounts | Cross-device syncing of Azure AD user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | From 159485d9508c5fa17ebe511404e5fea10f8d8974 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:41:47 -0700 Subject: [PATCH 096/151] edits --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 8f1918afe9..75c9ea7697 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Timeline for Microsoft Entra accounts | Cross-device syncing of Azure AD user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | +| Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | From 73d1a25dc143090f5856dde935764d90a417979b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 13:09:19 -0700 Subject: [PATCH 097/151] edit gpo path --- windows/client-management/manage-windows-copilot.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index d8b9867283..bc4adbca9d 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -2,7 +2,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows using MDM and group policy. ms.topic: article -ms.date: 09/26/2023 +ms.date: 10/16/2023 appliesto: - ✅ Windows 11 --- @@ -20,7 +20,7 @@ This policy setting allows you to turn off Copilot in Windows. If you enable thi | | Setting | |------------------|---------------------------------------------------------------------------------------------------------| | **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | -| **Group policy** | User Configuration > Administrative Templates > Windows Copilot > **Turn off Windows Copilot** | +| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | From 1091c060ffaf96e47e118ec802faf19fc0740366 Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 15:11:42 -0600 Subject: [PATCH 098/151] Fix link --- windows/privacy/manage-windows-11-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 229303a26c..41b8d6a06f 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -165,7 +165,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| -|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization](../deployment/update/wufb-reports-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| +|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| |||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| From 2b37b714afb6e7652c91d1a074f0b83cc72824c0 Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 15:55:34 -0600 Subject: [PATCH 099/151] Fix link --- windows/privacy/manage-windows-11-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 41b8d6a06f..12374dab54 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -165,7 +165,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| -|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| +|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml)| |||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| From 9386cd9cb2f6fdc063cc795f96f6e0e5a1053071 Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 16:09:47 -0600 Subject: [PATCH 100/151] Fix link --- windows/deployment/do/waas-delivery-optimization-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index 37bfca7312..f3843b3842 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -33,7 +33,7 @@ Starting with Microsoft Intune version 1902, you can set many Delivery Optimizat ## Allow service endpoints -When using a firewall, it's important that the Delivery Optimization Service endpoints are allowed and associated ports are open. For more information, see [Delivery Optimization FAQ](waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization). +When using a firewall, it's important that the Delivery Optimization Service endpoints are allowed and associated ports are open. For more information, see [Delivery Optimization FAQ](waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization). ## Allow content endpoints From 8fd4f7b392647a6464a60ad32f5ac7f63d92f67b Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 16:17:28 -0600 Subject: [PATCH 101/151] fix links --- windows/deployment/do/waas-delivery-optimization-setup.md | 2 +- windows/privacy/manage-windows-11-endpoints.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index f3843b3842..37bfca7312 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -33,7 +33,7 @@ Starting with Microsoft Intune version 1902, you can set many Delivery Optimizat ## Allow service endpoints -When using a firewall, it's important that the Delivery Optimization Service endpoints are allowed and associated ports are open. For more information, see [Delivery Optimization FAQ](waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization). +When using a firewall, it's important that the Delivery Optimization Service endpoints are allowed and associated ports are open. For more information, see [Delivery Optimization FAQ](waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization). ## Allow content endpoints diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 12374dab54..41b8d6a06f 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -165,7 +165,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| -|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml)| +|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| |||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| From 04d8654011a3931524918cdc1fa12de5041cbde1 Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 16:22:54 -0600 Subject: [PATCH 102/151] And again with the link --- windows/privacy/manage-windows-11-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 41b8d6a06f..12374dab54 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -165,7 +165,7 @@ To view endpoints for non-Enterprise Windows 11 editions, see [Windows 11 connec |||TLSv1.2/HTTP|www.msn.com| |||TLSv1.2/HTTP|fd.api.iris.microsoft.com| |||TLSv1.2|staticview.msn.com| -|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization)| +|Windows Update|||[Learn how to turn off traffic to all of the following endpoint(s) for Windows Update.](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)
[Hostnames to allow through firewall to support Delivery Optimization.](../deployment/do/waas-delivery-optimization-faq.yml)| |||TLSv1.2|definitionupdates.microsoft.com| ||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| From 7e9f82f00b667707fd381668bb05470322ca434e Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 16:40:03 -0600 Subject: [PATCH 103/151] New settings to what's new --- windows/deployment/do/whats-new-do.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/whats-new-do.md b/windows/deployment/do/whats-new-do.md index 050b3310f5..48a01fcf35 100644 --- a/windows/deployment/do/whats-new-do.md +++ b/windows/deployment/do/whats-new-do.md @@ -32,8 +32,11 @@ There are two different versions: ## New in Delivery Optimization for Windows -- Delivery Optimization introduced support for receiver side ledbat (rLedbat) in Windows 11 22H2. +### Windows 11 22H2 +- New setting: Customize Vpn detection by choosing custom keywords. Now, you don't have to rely on Delivery Optimization keywords to detect your Vpn. By using the new VpnKeywords configuration you can add keywords for Delivery Optimization to use when detecting a Vpn when in use. You can find this configuration in Group Policy or MDM under 'DOVpnKeywords'. +- New setting: Use the disallow downloads from a connected cache server, when a Vpn is detected and you want to prevent the download from the connected cache server. You can find this configuration in Group Policy or MDM under 'DODisallowCacheServerDownloadsOnVPN'. +- Delivery Optimization introduced support for receiver side ledbat (rLedbat). - New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization connects to locally discovered peers that are also part of the same Group (have the same Group ID)." - Local Peer Discovery: a new option for **[Restrict Peer Selection By](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection)** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization restricts peer selection to peers that are locally discovered (using DNS-SD). If Group mode is enabled, Delivery Optimization connects to locally discovered peers that are also part of the same group, for those devices with the same Group ID). From 5330268bc93cb2c4aeae5e7aae60885f8087a187 Mon Sep 17 00:00:00 2001 From: Carmen Date: Mon, 16 Oct 2023 17:04:41 -0600 Subject: [PATCH 104/151] More details to what's new page --- windows/deployment/do/whats-new-do.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/deployment/do/whats-new-do.md b/windows/deployment/do/whats-new-do.md index 48a01fcf35..7c18691ae6 100644 --- a/windows/deployment/do/whats-new-do.md +++ b/windows/deployment/do/whats-new-do.md @@ -34,11 +34,10 @@ There are two different versions: ### Windows 11 22H2 -- New setting: Customize Vpn detection by choosing custom keywords. Now, you don't have to rely on Delivery Optimization keywords to detect your Vpn. By using the new VpnKeywords configuration you can add keywords for Delivery Optimization to use when detecting a Vpn when in use. You can find this configuration in Group Policy or MDM under 'DOVpnKeywords'. -- New setting: Use the disallow downloads from a connected cache server, when a Vpn is detected and you want to prevent the download from the connected cache server. You can find this configuration in Group Policy or MDM under 'DODisallowCacheServerDownloadsOnVPN'. +- New setting: Customize vpn detection by choosing custom keywords. Now, you don't have to rely on Delivery Optimization keywords to detect your Vpn. By using the new VpnKeywords configuration you can add keywords for Delivery Optimization to use when detecting a Vpn when in use. You can find this configuration **[VPN Keywords](waas-delivery-optimization-reference.md#vpn-keywords)** in Group Policy or MDM under **DOVpnKeywords**. +- New setting: Use the disallow downloads from a connected cache server, when a Vpn is detected and you want to prevent the download from the connected cache server. You can find this configuration **[Disallow download from MCC over VPN](waas-delivery-optimization-reference.md#disallow-cache-server-downloads-on-vpn) in Group Policy or MDM under **DODisallowCacheServerDownloadsOnVPN**. - Delivery Optimization introduced support for receiver side ledbat (rLedbat). -- New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization connects to locally discovered peers that are also part of the same Group (have the same Group ID)." -- Local Peer Discovery: a new option for **[Restrict Peer Selection By](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection)** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization restricts peer selection to peers that are locally discovered (using DNS-SD). If Group mode is enabled, Delivery Optimization connects to locally discovered peers that are also part of the same group, for those devices with the same Group ID). +- New setting: Local Peer Discovery, a new option for **[Restrict Peer Selection By](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection)** in Group Policy or MDM **DORestrictPeerSelectionBy**. This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization restricts peer selection to peers that are locally discovered (using DNS-SD). If Group mode is enabled, Delivery Optimization connects to locally discovered peers that are also part of the same group, for those devices with the same Group ID).Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). > [!NOTE] > The Local Peer Discovery (DNS-SD, [RFC 6763](https://datatracker.ietf.org/doc/html/rfc6763)) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). From c0d04ac4c410b9d1ed38fb295233fde8cb13cf11 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 17 Oct 2023 06:22:27 -0400 Subject: [PATCH 105/151] removed retired content links --- .../credential-guard/considerations-known-issues.md | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/considerations-known-issues.md b/windows/security/identity-protection/credential-guard/considerations-known-issues.md index 26ee36124b..dbf52336f8 100644 --- a/windows/security/identity-protection/credential-guard/considerations-known-issues.md +++ b/windows/security/identity-protection/credential-guard/considerations-known-issues.md @@ -209,19 +209,6 @@ The following issue affects the Java GSS API. See the following Oracle bug datab When Credential Guard is enabled on Windows, the Java GSS API doesn't authenticate. Credential Guard blocks specific application authentication capabilities and doesn't provide the TGT session key to applications, regardless of registry key settings. For more information, see [Application requirements](index.md#application-requirements). -The following issue affects McAfee Application and Change Control (MACC): - -- [KB88869 Windows machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Credential Guard is enabled](https://kcm.trellix.com/corporate/index?page=content&id=KB88869) - -The following issue affects Citrix applications: - -- Windows machines exhibit high CPU usage with Citrix applications installed when Credential Guard is enabled. - -> [!NOTE] -> Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled devices to exhibit high CPU usage. For technical and troubleshooting information, see [KB4032786 High CPU usage in the LSAISO process on Windows](/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage). -> -> For more technical information on LSAISO.exe, see [Isolated User Mode (IUM) Processes](/windows/win32/procthread/isolated-user-mode--ium--processes). - #### Vendor support The following products and services don't support Credential Guard: From 17c6af725c0f3f3bc0867c9ec62d3b04b7d09940 Mon Sep 17 00:00:00 2001 From: yunakam-msft <63231957+yukinakamori@users.noreply.github.com> Date: Tue, 17 Oct 2023 23:16:28 +0900 Subject: [PATCH 106/151] Update using-event-viewer-with-applocker.md Update to the latest event level and message. --- .../using-event-viewer-with-applocker.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index 35cecd0bee..f237a5b23c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -38,24 +38,24 @@ The following table contains information about the events that you can use to de | Event ID | Level | Event message | Description | | --- | --- | --- | --- | -| 8000 | Error| Application Identity Policy conversion failed. Status * <%1> *| Indicates that the policy wasn't applied correctly to the computer. The status message is provided for troubleshooting purposes.| +| 8000 | Error| AppID policy conversion failed. Status * <%1> *| Indicates that the policy wasn't applied correctly to the computer. The status message is provided for troubleshooting purposes.| | 8001 | Information| The AppLocker policy was applied successfully to this computer.| Indicates that the AppLocker policy was successfully applied to the computer.| | 8002 | Information| *<File name> * was allowed to run.| Specifies that the .exe or .dll file is allowed by an AppLocker rule.| -| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy was enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules** enforcement mode were enabled. | -| 8004 | Error| *<File name> * was not allowed to run.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file can't run.| +| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules** enforcement mode were enabled. | +| 8004 | Error| *<File name> * was prevented from running.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file can't run.| | 8005| Information| *<File name> * was allowed to run.| Specifies that the script or .msi file is allowed by an AppLocker rule.| -| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy was enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules** enforcement mode were enabled. | -| 8007 | Error| *<File name> * was not allowed to run.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file can't run.| -| 8008| Error| AppLocker disabled on the SKU.| Added in Windows Server 2012 and Windows 8.| -| 8020| Information| Packaged app allowed.| Added in Windows Server 2012 and Windows 8.| -| 8021| Information| Packaged app audited.| Added in Windows Server 2012 and Windows 8.| -| 8022| Information| Packaged app disabled.| Added in Windows Server 2012 and Windows 8.| -| 8023 | Information| Packaged app installation allowed.| Added in Windows Server 2012 and Windows 8.| -| 8024 | Information| Packaged app installation audited.| Added in Windows Server 2012 and Windows 8.| -| 8025 | Warning| Packaged app installation disabled.| Added in Windows Server 2012 and Windows 8.| -| 8027 | Warning| No Packaged app rule configured.| Added in Windows Server 2012 and Windows 8.| -| 8028 | Warning | * was allowed to run but would have been prevented if the Config CI policy was enforced.| Added in Windows Server 2016 and Windows 10.| -| 8029 | Error | * was prevented from running due to Config CI policy.| Added in Windows Server 2016 and Windows 10.| +| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules** enforcement mode were enabled. | +| 8007 | Error| *<File name> * was prevented from running.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file can't run.| +| 8008| Warning| *<File name> *: AppLocker component not available on this SKU.| Added in Windows Server 2012 and Windows 8.| +| 8020| Information| *<File name> * was allowed to run.| Added in Windows Server 2012 and Windows 8.| +| 8021| Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Added in Windows Server 2012 and Windows 8.| +| 8022| Error| *<File name> * was prevented from running.| Added in Windows Server 2012 and Windows 8.| +| 8023 | Information| *<File name> * was allowed to be installed.| Added in Windows Server 2012 and Windows 8.| +| 8024 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Added in Windows Server 2012 and Windows 8.| +| 8025 | Error| *<File name> * was prevented from running.| Added in Windows Server 2012 and Windows 8.| +| 8027 | Error| No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.| Added in Windows Server 2012 and Windows 8.| +| 8028 | Warning | *<File name> * was allowed to run but would have been prevented if the Config CI policy were enforced.| Added in Windows Server 2016 and Windows 10.| +| 8029 | Error | *<File name> * was prevented from running due to Config CI policy.| Added in Windows Server 2016 and Windows 10.| | 8030 | Information | ManagedInstaller check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| | 8031 | Information | SmartlockerFilter detected file * being written by process * | Added in Windows Server 2016 and Windows 10.| | 8032 | Error | ManagedInstaller check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| @@ -63,9 +63,9 @@ The following table contains information about the events that you can use to de | 8034 | Information | ManagedInstaller Script check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| | 8035 | Error | ManagedInstaller Script check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| | 8036 | Error | * was prevented from running due to Config CI policy | Added in Windows Server 2016 and Windows 10.| -| 8037 | Information | * passed Config CI policy and was allowed to run | Added in Windows Server 2016 and Windows 10.| +| 8037 | Information | * passed Config CI policy and was allowed to run.| Added in Windows Server 2016 and Windows 10.| | 8038 | Information | Publisher info: Subject: * Issuer: * Signature index * (* total) | Added in Windows Server 2016 and Windows 10.| -| 8039 | Warning | * passed Config CI policy and was allowed to run | Added in Windows Server 2016 and Windows 10.| +| 8039 | Warning | Package family name * version * was allowed to install or update but would have been prevented if the Config CI policy | Added in Windows Server 2016 and Windows 10.| | 8040 | Error | Package family name * version * was prevented from installing or updating due to Config CI policy | Added in Windows Server 2016 and Windows 10.| From 710cfe8cca823f8ace97c489c9249b3a89551eee Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 17 Oct 2023 10:39:00 -0400 Subject: [PATCH 107/151] Update windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 449f99f377..d4c07f3415 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, then select OK. - *User-defined input* of the SDDL representation of the groups and privileges From af383407f685b2696cd9d9ee0cda7689b0fed290 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 17 Oct 2023 13:58:34 -0700 Subject: [PATCH 108/151] Add image borders to screenshots without visible borders type="content" adds 1-pixel grey borders --- .../windows-firewall/best-practices-configuring.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index a61bf25eec..4c281e49a8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -105,7 +105,7 @@ To determine why some applications are blocked from communicating in the network Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. -![Windows Firewall prompt.](images/fw04-userquery.png) +:::image type="content" alt-text="Windows Firewall prompt." source="images/fw04-userquery.png"::: *Figure 4: Dialog box to allow access* @@ -185,7 +185,7 @@ incoming connections, including those in the list of allowed apps** setting foun *Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* -![Firewall cpl.](images/fw07-legacy.png) +:::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: *Figure 7: Legacy firewall.cpl* From d81b5b3a59551541a647e1afad0acc322eb86d89 Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:07:08 -0400 Subject: [PATCH 109/151] [BULK] - DocuTune - Rebranding of Azure Active Dir --- .../private-app-repository-mdm-company-portal-windows-11.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index 93ceaacb2c..cb4377d22d 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -63,7 +63,7 @@ To install the Company Portal app, you have some options: - [What is co-management?](/mem/configmgr/comanage/overview) - [Use the Company Portal app on co-managed devices](/mem/configmgr/comanage/company-portal) -- **Use Windows Autopilot**: Windows Autopilot automatically provisions devices, registers them in your Azure AD organization (tenant), and gets them ready for production. If you're purchasing new devices, then we recommend using Windows Autopilot to preconfigure the devices, and get them ready for use. +- **Use Windows Autopilot**: Windows Autopilot automatically provisions devices, registers them in your Microsoft Entra organization (tenant), and gets them ready for production. If you're purchasing new devices, then we recommend using Windows Autopilot to preconfigure the devices, and get them ready for use. - In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), you add the Company Portal app from the Microsoft Store. Once it's added, the app can be included in your Windows Autopilot deployment. When the device turns on and is getting ready, the Company Portal app is also installed, before users sign in. From e5038ce1d7539be68da0e56bce9c0c1214d6ee6c Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:15:18 -0400 Subject: [PATCH 110/151] [BULK] - DocuTune - Rebranding of Azure Active Dir --- ...e-active-directory-integration-with-mdm.md | 172 ++++++++++-------- ...omatic-mdm-enrollment-in-the-new-portal.md | 6 +- ...ollment-using-windows-provisioning-tool.md | 6 +- .../client-tools/connect-to-remote-aadj-pc.md | 64 ++++--- .../client-tools/quick-assist.md | 4 +- .../client-management/client-tools/toc.yml | 2 +- .../disconnecting-from-mdm-unenrollment.md | 14 +- ...device-automatically-using-group-policy.md | 24 +-- .../enterprise-app-management.md | 8 +- .../esim-enterprise-management.md | 2 +- ...rver-side-mobile-application-management.md | 28 +-- windows/client-management/index.yml | 4 +- ...-in-your-organization-modern-management.md | 12 +- .../mdm-diagnose-enrollment.md | 16 +- .../mdm-enrollment-of-windows-devices.md | 70 +++---- windows/client-management/mdm-known-issues.md | 8 +- windows/client-management/mdm-overview.md | 6 +- windows/client-management/toc.yml | 2 +- 18 files changed, 242 insertions(+), 206 deletions(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 7f11d203d5..fdff4dbb1a 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,6 +1,6 @@ --- -title: Azure Active Directory integration with MDM -description: Azure Active Directory is the world's largest enterprise cloud identity management service. +title: Microsoft Entra integration with MDM +description: Microsoft Entra ID is the world's largest enterprise cloud identity management service. ms.topic: article ms.collection: - highpri @@ -8,90 +8,94 @@ ms.collection: ms.date: 08/10/2023 --- -# Azure Active Directory integration with MDM +# Microsoft Entra integration with MDM -Azure Active Directory is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Azure AD as the underlying identity infrastructure. Windows integrates with Azure AD, allowing devices to be registered in Azure AD and enrolled into MDM in an integrated flow. +Microsoft Entra ID is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Microsoft Entra ID as the underlying identity infrastructure. Windows integrates with Microsoft Entra ID, allowing devices to be registered in Microsoft Entra ID and enrolled into MDM in an integrated flow. Once a device is enrolled in MDM, the MDM: - Can enforce compliance with organization policies, add or remove apps, and more. -- Can report a device's compliance in Azure AD. -- Azure AD can allow access to organization resources or applications secured by Azure AD to devices that comply with policies. +- Can report a device's compliance in Microsoft Entra ID. +- Microsoft Entra ID can allow access to organization resources or applications secured by Microsoft Entra ID to devices that comply with policies. -To support these rich experiences with their MDM product, MDM vendors can integrate with Azure AD. +To support these rich experiences with their MDM product, MDM vendors can integrate with Microsoft Entra ID. ## Integrated MDM enrollment and UX -There are several ways to connect your devices to Azure AD: +There are several ways to connect your devices to Microsoft Entra ID: -- [Join device to Azure AD](/azure/active-directory/devices/concept-azure-ad-join) -- [Join device to on-premises AD and Azure AD](/azure/active-directory/devices/concept-azure-ad-join-hybrid) +- [Join device to Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join) +- [Join device to on-premises AD and Microsoft Entra ID](/azure/active-directory/devices/concept-azure-ad-join-hybrid) - [Add a Microsoft work account to Windows](/azure/active-directory/devices/concept-azure-ad-register) -In each scenario, Azure AD authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. +In each scenario, Microsoft Entra authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. -In Windows 10, the web view during the out-of-the-box scenario is displayed as full-screen by default, providing MDM vendors with the capability to create a seamless edge-to-edge user experience. However, in Windows 11 the web view is rendered within an iframe. It's important that MDM vendors who integrate with Azure AD respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. +In Windows 10, the web view during the out-of-the-box scenario is displayed as full-screen by default, providing MDM vendors with the capability to create a seamless edge-to-edge user experience. However, in Windows 11 the web view is rendered within an iframe. It's important that MDM vendors who integrate with Microsoft Entra ID respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. -For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). +For Microsoft Entra enrollment to work for an Active Directory Federated Services (AD FS) backed Microsoft Entra account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). -Once a user has an Azure AD account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Access work or school**. Device management of either Azure AD Join for organization scenarios or BYOD scenarios is similar. +Once a user has a Microsoft Entra account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Access work or school**. Device management of either Microsoft Entra join for organization scenarios or BYOD scenarios is similar. > [!NOTE] -> Users can't remove the device enrollment through the **Access work or school** user interface because management is tied to the Azure AD or work account. +> Users can't remove the device enrollment through the **Access work or school** user interface because management is tied to the Microsoft Entra ID or work account. -### MDM endpoints involved in Azure AD integrated enrollment + -Azure AD MDM enrollment is a two-step process: +### MDM endpoints involved in Microsoft Entra integrated enrollment + +Microsoft Entra MDM enrollment is a two-step process: 1. Display the Terms of Use and gather user consent: This consent is a passive flow where the user is redirected in a browser control (webview) to the URL of the Terms of Use of the MDM. 1. Enroll the device: This step is an active flow where Windows OMA DM agent calls the MDM service to enroll the device. -To support Azure AD enrollment, MDM vendors must host and expose a **Terms of Use endpoint** and an **MDM enrollment endpoint**. +To support Microsoft Entra enrollment, MDM vendors must host and expose a **Terms of Use endpoint** and an **MDM enrollment endpoint**. - **Terms of Use endpoint**: Use this endpoint to inform users of the ways in which their organization can control their device. The **Terms of Use** page is responsible for collecting user's consent before the actual enrollment phase begins. - It's important to understand the Terms of Use flow is an "opaque box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL. The user should be redirected back after approving or rejecting the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios. For example, different levels of control are applied on BYOD vs. organization-owned devices. Or, implement user/group based targeting, like users in certain geographies may have stricter device management policies. + It's important to understand the Terms of Use flow is an "opaque box" to Windows and Microsoft Entra ID. The whole web view is redirected to the Terms of Use URL. The user should be redirected back after approving or rejecting the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios. For example, different levels of control are applied on BYOD vs. organization-owned devices. Or, implement user/group based targeting, like users in certain geographies may have stricter device management policies. - The Terms of Use endpoint can implement more business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which can be a degraded user experience. It's not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. + The Terms of Use endpoint can implement more business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which can be a degraded user experience. It's not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Microsoft Entra ID. -- **MDM enrollment endpoint**: After the users accept the Terms of Use, the device is registered in Azure AD. Automatic MDM enrollment begins. +- **MDM enrollment endpoint**: After the users accept the Terms of Use, the device is registered in Microsoft Entra ID. Automatic MDM enrollment begins. - The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. + The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Microsoft Entra ID. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Microsoft Entra ID (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Microsoft Entra ID. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. - [![azure ad enrollment flow](images/azure-ad-enrollment-flow.png)](images/azure-ad-enrollment-flow.png#lightbox) + [![Microsoft Entra enrollment flow](images/azure-ad-enrollment-flow.png)](images/azure-ad-enrollment-flow.png#lightbox) - The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. + The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Microsoft Entra ID using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. -## Make MDM a reliable party of Azure AD + -To participate in the integrated enrollment flow outlined in the previous section, the MDM must consume access tokens issued by Azure AD. To report compliance with Azure AD, the MDM must authenticate itself to Azure AD and obtain authorization in the form of an access token that allows it to invoke the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). +## Make MDM a reliable party of Microsoft Entra ID + +To participate in the integrated enrollment flow outlined in the previous section, the MDM must consume access tokens issued by Microsoft Entra ID. To report compliance with Microsoft Entra ID, the MDM must authenticate itself to Microsoft Entra ID and obtain authorization in the form of an access token that allows it to invoke the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). ### Cloud-based MDM -A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multi-tenant application. This application is registered with Azure AD in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. +A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multi-tenant application. This application is registered with Microsoft Entra ID in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. -The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. For more information about how to add multi-tenant applications to Azure AD, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multi-tenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. +The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. For more information about how to add multi-tenant applications to Microsoft Entra ID, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multi-tenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. > [!NOTE] -> For the MDM provider, if you don't have an existing Azure AD tenant with an Azure AD subscription that you manage, follow these step-by-step guides: +> For the MDM provider, if you don't have an existing Microsoft Entra tenant with a Microsoft Entra subscription that you manage, follow these step-by-step guides: > -> - [Quickstart: Create a new tenant in Azure Active Directory](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to set up a tenant. -> - [Associate or add an Azure subscription to your Azure Active Directory tenant](/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory) to add a subscription, and manage it via the Azure Portal. +> - [Quickstart: Create a new tenant in Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to set up a tenant. +> - [Associate or add an Azure subscription to your Microsoft Entra tenant](/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory) to add a subscription, and manage it via the Azure Portal. -The MDM application uses keys to request access tokens from Azure AD. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Azure AD, in the customer tenant where the managed device belongs. +The MDM application uses keys to request access tokens from Microsoft Entra ID. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Microsoft Entra ID, in the customer tenant where the managed device belongs. > [!NOTE] -> All MDM apps must implement Azure AD V2 tokens before we certify that integration works. Due to changes in the Azure AD app platform, using Azure AD V2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats). +> All MDM apps must implement Azure AD v2 tokens before we certify that integration works. Due to changes in the Microsoft Entra app platform, using Azure AD v2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats). ### On-premises MDM -An on-premises MDM application is different than a cloud MDM. It's a single-tenant application that is present uniquely within the tenant of the customer. Customers must add the application directly within their own tenant. Also, each instance of an on-premises MDM application must be registered separately and have a separate key for authentication with Azure AD. +An on-premises MDM application is different than a cloud MDM. It's a single-tenant application that is present uniquely within the tenant of the customer. Customers must add the application directly within their own tenant. Also, each instance of an on-premises MDM application must be registered separately and have a separate key for authentication with Microsoft Entra ID. -To add an on-premises MDM application to the tenant, use the Azure AD service, specifically under **Mobility (MDM and MAM)** > **Add application** > **Create your own application**. Administrators can configure the required URLs for enrollment and Terms of Use. +To add an on-premises MDM application to the tenant, use the Microsoft Entra service, specifically under **Mobility (MDM and MAM)** > **Add application** > **Create your own application**. Administrators can configure the required URLs for enrollment and Terms of Use. -Your on-premises MDM product must expose a configuration experience where administrators can provide the client ID, app ID, and the key configured in their directory for that MDM application. You can use this client ID and key to request tokens from Azure AD when reporting device compliance. +Your on-premises MDM product must expose a configuration experience where administrators can provide the client ID, app ID, and the key configured in their directory for that MDM application. You can use this client ID and key to request tokens from Microsoft Entra ID when reporting device compliance. -For more information about registering applications with Azure AD, see [Basics of Registering an Application in Azure AD](/previous-versions/azure/dn499820(v=azure.100)). +For more information about registering applications with Microsoft Entra ID, see [Basics of Registering an Application in Microsoft Entra ID](/previous-versions/azure/dn499820(v=azure.100)). ### Key management and security guidelines @@ -99,22 +103,24 @@ The application keys used by your MDM service are a sensitive resource. They sho For security best practices, see [Microsoft Azure Security Essentials](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). -For cloud-based MDM, you can roll over the application keys without requiring a customer interaction. There's a single set of keys across all customer tenants managed by the MDM vendor in their Azure AD tenant. +For cloud-based MDM, you can roll over the application keys without requiring a customer interaction. There's a single set of keys across all customer tenants managed by the MDM vendor in their Microsoft Entra tenant. -For the on-premises MDM, the Azure AD authentication keys are within the customer tenant and the customer's administrator must roll over the keys. To improve security, provide guidance to customers about rolling over and protecting the keys. +For the on-premises MDM, the Microsoft Entra authentication keys are within the customer tenant and the customer's administrator must roll over the keys. To improve security, provide guidance to customers about rolling over and protecting the keys. -## Publish your MDM app to Azure AD app gallery + -IT administrators use the Azure AD app gallery to add an MDM for their organization to use. The app gallery is a rich store with over 2400 SaaS applications that are integrated with Azure AD. +## Publish your MDM app to Microsoft Entra app gallery + +IT administrators use the Microsoft Entra app gallery to add an MDM for their organization to use. The app gallery is a rich store with over 2400 SaaS applications that are integrated with Microsoft Entra ID. ### Add cloud-based MDM to the app gallery > [!NOTE] -> You should work with the Azure AD engineering team if your MDM application is cloud-based and needs to be enabled as a multi-tenant MDM application +> You should work with the Microsoft Entra engineering team if your MDM application is cloud-based and needs to be enabled as a multi-tenant MDM application -To publish your application, [submit a request to publish your application in Azure Active Directory application gallery](/azure/active-directory/manage-apps/v2-howto-app-gallery-listing) +To publish your application, [submit a request to publish your application in Microsoft Entra application gallery](/azure/active-directory/manage-apps/v2-howto-app-gallery-listing) -The following table shows the required information to create an entry in the Azure AD app gallery. +The following table shows the required information to create an entry in the Microsoft Entra app gallery. | Item | Description | |---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -132,12 +138,12 @@ However, key management is different for on-premises MDM. You must obtain the cl ## Themes -The pages rendered by the MDM in the integrated enrollment process must use Windows templates ([Download the Windows templates and CSS files (1.1.4)](https://download.microsoft.com/download/0/7/0/0702afe3-dc1e-48f6-943e-886a4876f6ca/MDM-ISV_1.1.4.zip)). These templates are important for enrollment during the Azure AD Join experience in OOBE where all of the pages are edge-to-edge HTML pages. Avoid copying the templates because it is difficult to get the button placement right. +The pages rendered by the MDM in the integrated enrollment process must use Windows templates ([Download the Windows templates and CSS files (1.1.4)](https://download.microsoft.com/download/0/7/0/0702afe3-dc1e-48f6-943e-886a4876f6ca/MDM-ISV_1.1.4.zip)). These templates are important for enrollment during the Microsoft Entra join experience in OOBE where all of the pages are edge-to-edge HTML pages. Avoid copying the templates because it is difficult to get the button placement right. There are three distinct scenarios: -1. MDM enrollment as part of Azure AD Join in Windows OOBE. -1. MDM enrollment as part of Azure AD Join, after Windows OOBE from **Settings**. +1. MDM enrollment as part of Microsoft Entra join in Windows OOBE. +1. MDM enrollment as part of Microsoft Entra join, after Windows OOBE from **Settings**. 1. MDM enrollment as part of adding a Microsoft work account on a personal device (BYOD). These scenarios support Windows Pro, Enterprise, and Education. @@ -158,7 +164,7 @@ An MDM page must adhere to a predefined theme depending on the scenario that is ## Terms of Use protocol semantics -The MDM server hosts the **Terms of Use** endpoint. During the Azure AD Join protocol flow, Windows does a full-page redirect to this endpoint. This redirect enables the MDM to display the terms and conditions that apply. It allows the user to accept or reject the terms associated with enrollment. After the user accepts the terms, the MDM redirects back to Windows for the enrollment process to continue. +The MDM server hosts the **Terms of Use** endpoint. During the Microsoft Entra join protocol flow, Windows does a full-page redirect to this endpoint. This redirect enables the MDM to display the terms and conditions that apply. It allows the user to accept or reject the terms associated with enrollment. After the user accepts the terms, the MDM redirects back to Windows for the enrollment process to continue. ### Redirect to the Terms of Use endpoint @@ -175,7 +181,7 @@ The following parameters are passed in the query string: ### Access token -Azure AD issues a bearer access token. The token is passed in the authorization header of the HTTP request. Here's a typical format: +Microsoft Entra ID issues a bearer access token. The token is passed in the authorization header of the HTTP request. Here's a typical format: **Authorization: Bearer** CI6MTQxmCF5xgu6yYcmV9ng6vhQfaJYw... @@ -200,7 +206,7 @@ https://fabrikam.contosomdm.com/TermsOfUse?redirect_uri=ms-appx-web://ContosoMdm Authorization: Bearer eyJ0eXAiOi ``` -The MDM is expected to validate the signature of the access token to ensure it is issued by Azure AD and that the recipient is appropriate. +The MDM is expected to validate the signature of the access token to ensure it is issued by Microsoft Entra ID and that the recipient is appropriate. ### Terms of Use content @@ -225,7 +231,7 @@ At this point, the user is on the Terms of Use page shown during the OOBE or fro - **IsAccepted** - This Boolean value is required, and must be set to false. This option also applies if the user skipped the Terms of Use. - **OpaqueBlob** - This parameter isn't expected to be used. The enrollment is stopped with an error message shown to the user. -Users skip the Terms of Use when they're adding a Microsoft work account to their device. However, they can't skip it during the Azure AD Join process. Don't show the decline button in the Azure AD Join process. The user can't decline the MDM enrollment if configured by the administrator for the Azure AD Join. +Users skip the Terms of Use when they're adding a Microsoft work account to their device. However, they can't skip it during the Microsoft Entra join process. Don't show the decline button in the Microsoft Entra join process. The user can't decline the MDM enrollment if configured by the administrator for the Microsoft Entra join. We recommend that you send the client-request-id parameters in the query string as part of this redirect response. @@ -251,14 +257,16 @@ The following table shows the error codes. |--------------------------------------------------------------------------------------------------|-------------|---------------------|-----------------------------| | api-version | 302 | invalid_request | unsupported version | | Tenant or user data are missing or other required prerequisites for device enrollment aren't met | 302 | unauthorized_client | unauthorized user or tenant | -| Azure AD token validation failed | 302 | unauthorized_client | unauthorized_client | +| Microsoft Entra token validation failed | 302 | unauthorized_client | unauthorized_client | | internal service error | 302 | server_error | internal service error | -## Enrollment protocol with Azure AD + + +## Enrollment protocol with Microsoft Entra ID With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments. -|Detail|Traditional MDM enrollment|Azure AD Join (organization-owned device)|Azure AD adds a work account (user-owned device)| +|Detail|Traditional MDM enrollment|Microsoft Entra join (organization-owned device)|Microsoft Entra ID adds a work account (user-owned device)| |--- |--- |--- |--- | |MDM auto-discovery using email address to retrieve MDM discovery URL|Enrollment|Not applicable
Discovery URL provisioned in Azure|| |Uses MDM discovery URL|Enrollment
Enrollment renewal
ROBO|Enrollment
Enrollment renewal
ROBO|Enrollment
Enrollment renewal
ROBO| @@ -268,7 +276,7 @@ With Azure integrated MDM enrollment, there's no discovery phase and the discove |EnrollmentServiceURL|Required (all auth)|Used (all auth)|Used (all auth)| |EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL|Highly recommended|Highly recommended|Highly recommended| |AuthenticationServiceURL used|Used (Federated auth)|Skipped|Skipped| -|BinarySecurityToken|Custom per MDM|Azure AD issued token|Azure AD issued token| +|BinarySecurityToken|Custom per MDM|Microsoft Entra ID issued token|Microsoft Entra ID issued token| |EnrollmentType|Full|Device|Full| |Enrolled certificate type|User certificate|Device certificate|User certificate| |Enrolled certificate store|My/User|My/System|My/User| @@ -276,41 +284,45 @@ With Azure integrated MDM enrollment, there's no discovery phase and the discove |EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported| |CSPs accessible during enrollment|Windows 10 support:
- DMClient
- CertificateStore
- RootCATrustedCertificates
- ClientCertificateInstall
- EnterpriseModernAppManagement
- PassportForWork
- Policy
- w7 APPLICATION||| -## Management protocol with Azure AD + -There are two different MDM enrollment types that integrate with Azure AD, and use Azure AD user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users. +## Management protocol with Microsoft Entra ID -- **Multiple user management for Azure AD-joined devices** +There are two different MDM enrollment types that integrate with Microsoft Entra ID, and use Microsoft Entra user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users. - In this scenario, the MDM enrollment applies to every Azure AD user who signs in to the Azure AD joined device - call this enrollment type a device enrollment or a multi-user enrollment. The management server can determine the user identity, determine what policies are targeted for this user, and send corresponding policies to the device. To allow management server to identify current user that is logged on to the device, the OMA DM client uses the Azure AD user tokens. Each management session contains an extra HTTP header that contains an Azure AD user token. This information is provided in the DM package sent to the management server. However, in some circumstances Azure AD user token isn't sent over to the management server. One such scenario happens immediately after MDM enrollments completes during Azure AD join process. Until Azure AD join process is finished and Azure AD user signs on to the machine, Azure AD user token isn't available to OMA-DM process. Typically, MDM enrollment completes before Azure AD user sign in to machine and the initial management session doesn't contain an Azure AD user token. The management server should check if the token is missing and only send device policies in such case. Another possible reason for a missing Azure AD token in the OMA-DM payload is when a guest is logged on to the device. +- **Multiple user management for Microsoft Entra joined devices** + + In this scenario, the MDM enrollment applies to every Microsoft Entra user who signs in to the Microsoft Entra joined device - call this enrollment type a device enrollment or a multi-user enrollment. The management server can determine the user identity, determine what policies are targeted for this user, and send corresponding policies to the device. To allow management server to identify current user that is logged on to the device, the OMA DM client uses the Microsoft Entra user tokens. Each management session contains an extra HTTP header that contains a Microsoft Entra user token. This information is provided in the DM package sent to the management server. However, in some circumstances Microsoft Entra user token isn't sent over to the management server. One such scenario happens immediately after MDM enrollments completes during Microsoft Entra join process. Until Microsoft Entra join process is finished and Microsoft Entra user signs on to the machine, Microsoft Entra user token isn't available to OMA-DM process. Typically, MDM enrollment completes before Microsoft Entra user sign in to machine and the initial management session doesn't contain a Microsoft Entra user token. The management server should check if the token is missing and only send device policies in such case. Another possible reason for a missing Microsoft Entra token in the OMA-DM payload is when a guest is logged on to the device. - **Adding a work account and MDM enrollment to a device**: - In this scenario, the MDM enrollment applies to a single user who initially added their work account and enrolled the device. In this enrollment type, the management server can ignore Azure AD tokens that may be sent over during management session. Whether Azure AD token is present or missing, the management server sends both user and device policies to the device. + In this scenario, the MDM enrollment applies to a single user who initially added their work account and enrolled the device. In this enrollment type, the management server can ignore Microsoft Entra tokens that may be sent over during management session. Whether Microsoft Entra token is present or missing, the management server sends both user and device policies to the device. -- **Evaluating Azure AD user tokens**: +- **Evaluating Microsoft Entra user tokens**: - The Azure AD token is in the HTTP Authorization header in the following format: + The Microsoft Entra token is in the HTTP Authorization header in the following format: ```console Authorization:Bearer ``` - More claims may be present in the Azure AD token, such as: + More claims may be present in the Microsoft Entra token, such as: - User - user currently logged in - Device compliance - value set the MDM service into Azure - Device ID - identifies the device that is checking in - Tenant ID - Access tokens issued by Azure AD are JSON web tokens (JWTs). Windows presents a valid JWT token to the MDM enrollment endpoint to start the enrollment process. There are a couple of options to evaluate the tokens: + Access tokens issued by Microsoft Entra ID are JSON web tokens (JWTs). Windows presents a valid JWT token to the MDM enrollment endpoint to start the enrollment process. There are a couple of options to evaluate the tokens: - Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). - - Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). + - Refer to the Microsoft Entra authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). -## Device Alert 1224 for Azure AD user token + -An alert is sent when the DM session starts and there's an Azure AD user logged in. The alert is sent in OMA DM package #1. Here's an example: +## Device Alert 1224 for Microsoft Entra user token + +An alert is sent when the DM session starts and there's a Microsoft Entra user logged in. The alert is sent in OMA DM package #1. Here's an example: ```xml Alert Type: com.microsoft/MDM/AADUserToken @@ -338,8 +350,8 @@ An alert is sent to the MDM server in DM package \#1. - Alert type - `com.microsoft/MDM/LoginStatus` - Alert format - `chr` - Alert data - provide sign-in status information for the current active logged in user. - - Signed-in user who has an Azure AD account - predefined text: user. - - Signed-in user without an Azure AD account- predefined text: others. + - Signed-in user who has a Microsoft Entra account - predefined text: user. + - Signed-in user without a Microsoft Entra account- predefined text: others. - No active user - predefined text:none Here's an example. @@ -360,14 +372,16 @@ Here's an example. ``` -## Report device compliance to Azure AD + -Once a device is enrolled with the MDM for management, organization policies configured by the IT administrator are enforced on the device. MDM evaluates the device compliance with configured policies and then reports it to Azure AD. This section covers the Graph API call you can use to report a device compliance status to Azure AD. +## Report device compliance to Microsoft Entra ID + +Once a device is enrolled with the MDM for management, organization policies configured by the IT administrator are enforced on the device. MDM evaluates the device compliance with configured policies and then reports it to Microsoft Entra ID. This section covers the Graph API call you can use to report a device compliance status to Microsoft Entra ID. For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613822). -- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Azure AD. -- **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Azure AD. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Azure AD. +- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Microsoft Entra ID. +- **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Microsoft Entra ID. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Microsoft Entra ID. ### Use Microsoft Graph API @@ -390,9 +404,9 @@ Content-Type: application/json Where: -- **contoso.com** - This value is the name of the Azure AD tenant to whose directory the device has been joined. -- **db7ab579-3759-4492-a03f-655ca7f52ae1** - This value is the device identifier for the device whose compliance information is being reported to Azure AD. -- **eyJ0eXAiO**......... - This value is the bearer access token issued by Azure AD to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. +- **contoso.com** - This value is the name of the Microsoft Entra tenant to whose directory the device has been joined. +- **db7ab579-3759-4492-a03f-655ca7f52ae1** - This value is the device identifier for the device whose compliance information is being reported to Microsoft Entra ID. +- **eyJ0eXAiO**......... - This value is the bearer access token issued by Microsoft Entra ID to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. - **isManaged** and **isCompliant** - These Boolean attributes indicates compliance status. - **api-version** - Use this parameter to specify which version of the graph API is being requested. @@ -401,9 +415,11 @@ Response: - Success - HTTP 204 with No Content. - Failure/Error - HTTP 404 Not Found. This error may be returned if the specified device or tenant can't be found. -## Data loss during unenrollment from Azure Active Directory Join + -When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. +## Data loss during unenrollment from Microsoft Entra join + +When a user is enrolled into MDM through Microsoft Entra join and then disconnects the enrollment, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. ![aadj unenrollment.](images/azure-ad-unenrollment.png) diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 636a885451..e1c894e2c5 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -7,12 +7,12 @@ ms.date: 08/10/2023 # Automatic MDM enrollment in the Intune admin center -Windows devices can be enrolled in to Intune automatically when they join or register with Azure Active Directory. Automatic enrollment can be configured in Azure portal. +Windows devices can be enrolled in to Intune automatically when they join or register with Microsoft Entra ID. Automatic enrollment can be configured in Azure portal. -1. Go to your Azure AD portal. +1. Go to your Microsoft Entra admin center. 1. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. 1. Select **Microsoft Intune** and configure the enrollment options. You can specify settings to allow **All** users to enroll a device, or choose to allow **Some** users (and specify a group). ![Configure the Blade.](images/azure-intune-configure-scope.png) -1. Select **Save** to configure MDM autoenrollment for Azure AD joined devices and bring-your-own-device scenarios. +1. Select **Save** to configure MDM autoenrollment for Microsoft Entra joined devices and bring-your-own-device scenarios. diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 84c1486cec..522b5d05b6 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -7,7 +7,7 @@ ms.date: 08/10/2023 # Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join enrollment scenario. +Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Microsoft Entra join enrollment scenario. ## Typical use cases @@ -23,10 +23,10 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro > [!NOTE] > -> - Bulk-join is not supported in Azure Active Directory Join. +> - Bulk-join is not supported in Microsoft Entra join. > - Bulk enrollment does not work in Intune standalone environment. > - Bulk enrollment works in Microsoft Intune where the ppkg is generated from the Configuration Manager console. -> - To change bulk enrollment settings, login to **Azure AD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. +> - To change bulk enrollment settings, login to **Microsoft Entra ID**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. > - Bulk Token creation is not supported with federated accounts. ## What you need diff --git a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md index 56f57c950e..2e3e741284 100644 --- a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md +++ b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md @@ -1,6 +1,6 @@ --- -title: Connect to remote Azure Active Directory joined device -description: Learn how to use Remote Desktop Connection to connect to an Azure AD joined device. +title: Connect to remote Microsoft Entra joined device +description: Learn how to use Remote Desktop Connection to connect to a Microsoft Entra joined device. ms.localizationpriority: medium ms.date: 08/10/2023 ms.topic: article @@ -9,36 +9,38 @@ ms.collection: - tier2 --- -# Connect to remote Azure Active Directory joined device +# Connect to remote Microsoft Entra joined device -Windows supports remote connections to devices joined to Active Directory s well as devices joined to Azure Active Directory (Azure AD) using Remote Desktop Protocol (RDP). +Windows supports remote connections to devices joined to Active Directory s well as devices joined to Microsoft Entra ID using Remote Desktop Protocol (RDP). - Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). -- Starting in Windows 10/11, with 2022-10 update installed, you can [use Azure AD authentication to connect to the remote Azure AD device](#connect-with-azure-ad-authentication). +- Starting in Windows 10/11, with 2022-10 update installed, you can [use Microsoft Entra authentication to connect to the remote Microsoft Entra device](#connect-with-azure-ad-authentication). ## Prerequisites - Both devices (local and remote) must be running a supported version of Windows. - Remote device must have the **Connect to and use this PC from another device using the Remote Desktop app** option selected under **Settings** > **System** > **Remote Desktop**. - It's recommended to select **Require devices to use Network Level Authentication to connect** option. -- If the user who joined the device to Azure AD is the only one who is going to connect remotely, no other configuration is needed. To allow more users or groups to connect to the device remotely, you must [add users to the Remote Desktop Users group](#add-users-to-remote-desktop-users-group) on the remote device. +- If the user who joined the device to Microsoft Entra ID is the only one who is going to connect remotely, no other configuration is needed. To allow more users or groups to connect to the device remotely, you must [add users to the Remote Desktop Users group](#add-users-to-remote-desktop-users-group) on the remote device. - Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard) is turned off on the device you're using to connect to the remote device. -## Connect with Azure AD Authentication + -Azure AD Authentication can be used on the following operating systems for both the local and remote device: +## Connect with Microsoft Entra authentication + +Microsoft Entra authentication can be used on the following operating systems for both the local and remote device: - Windows 11 with [2022-10 Cumulative Updates for Windows 11 (KB5018418)](https://support.microsoft.com/kb/KB5018418) or later installed. - Windows 10, version 20H2 or later with [2022-10 Cumulative Updates for Windows 10 (KB5018410)](https://support.microsoft.com/kb/KB5018410) or later installed. - Windows Server 2022 with [2022-10 Cumulative Update for Microsoft server operating system (KB5018421)](https://support.microsoft.com/kb/KB5018421) or later installed. -There's no requirement for the local device to be joined to a domain or Azure AD. As a result, this method allows you to connect to the remote Azure AD joined device from: +There's no requirement for the local device to be joined to a domain or Microsoft Entra ID. As a result, this method allows you to connect to the remote Microsoft Entra joined device from: -- [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [Hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) device. +- [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) device. - Active Directory joined device. - Workgroup device. -Azure AD authentication can also be used to connect to Hybrid Azure AD joined devices. +Microsoft Entra authentication can also be used to connect to Microsoft Entra hybrid joined devices. To connect to the remote computer: @@ -48,29 +50,31 @@ To connect to the remote computer: > [!NOTE] > IP address cannot be used when **Use a web account to sign in to the remote computer** option is used. - > The name must match the hostname of the remote device in Azure AD and be network addressable, resolving to the IP address of the remote device. + > The name must match the hostname of the remote device in Microsoft Entra ID and be network addressable, resolving to the IP address of the remote device. - When prompted for credentials, specify your user name in `user@domain.com` format. -- You're then prompted to allow the remote desktop connection when connecting to a new PC. Azure AD remembers up to 15 hosts for 30 days before prompting again. If you see this dialogue, select **Yes** to connect. +- You're then prompted to allow the remote desktop connection when connecting to a new PC. Microsoft Entra remembers up to 15 hosts for 30 days before prompting again. If you see this dialogue, select **Yes** to connect. > [!IMPORTANT] -> If your organization has configured and is using [Azure AD Conditional Access](/azure/active-directory/conditional-access/overview), your device must satisfy the conditional access requirements to allow connection to the remote computer. Conditional Access policies with [grant controls](/azure/active-directory/conditional-access/concept-conditional-access-grant) and [session controls](/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) may be applied to the application **Microsoft Remote Desktop (a4a365df-50f1-4397-bc59-1a1564b8bb9c)** for controlled access. +> If your organization has configured and is using [Microsoft Entra Conditional Access](/azure/active-directory/conditional-access/overview), your device must satisfy the conditional access requirements to allow connection to the remote computer. Conditional Access policies with [grant controls](/azure/active-directory/conditional-access/concept-conditional-access-grant) and [session controls](/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) may be applied to the application **Microsoft Remote Desktop (a4a365df-50f1-4397-bc59-1a1564b8bb9c)** for controlled access. ### Disconnection when the session is locked -The Windows lock screen in the remote session doesn't support Azure AD authentication tokens or passwordless authentication methods like FIDO keys. The lack of support for these authentication methods means that users can't unlock their screens in a remote session. When you try to lock a remote session, either through user action or system policy, the session is instead disconnected and the service sends a message to the user explaining they've been disconnected. +The Windows lock screen in the remote session doesn't support Microsoft Entra authentication tokens or passwordless authentication methods like FIDO keys. The lack of support for these authentication methods means that users can't unlock their screens in a remote session. When you try to lock a remote session, either through user action or system policy, the session is instead disconnected and the service sends a message to the user explaining they've been disconnected. -Disconnecting the session also ensures that when the connection is relaunched after a period of inactivity, Azure AD reevaluates the applicable conditional access policies. +Disconnecting the session also ensures that when the connection is relaunched after a period of inactivity, Microsoft Entra ID reevaluates the applicable conditional access policies. -## Connect without Azure AD Authentication + -By default, RDP doesn't use Azure AD authentication, even if the remote PC supports it. This method allows you to connect to the remote Azure AD joined device from: +## Connect without Microsoft Entra authentication -- [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [Hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) device using Windows 10, version 1607 or later. -- [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) device using Windows 10, version 2004 or later. +By default, RDP doesn't use Microsoft Entra authentication, even if the remote PC supports it. This method allows you to connect to the remote Microsoft Entra joined device from: + +- [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) device using Windows 10, version 1607 or later. +- [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) device using Windows 10, version 2004 or later. > [!NOTE] -> Both the local and remote device must be in the same Azure AD tenant. Azure AD B2B guests aren't supported for Remote desktop. +> Both the local and remote device must be in the same Microsoft Entra tenant. Microsoft Entra B2B guests aren't supported for Remote desktop. To connect to the remote computer: @@ -79,26 +83,26 @@ To connect to the remote computer: - When prompted for credentials, specify your user name in either `user@domain.com` or `AzureAD\user@domain.com` format. > [!TIP] -> If you specify your user name in `domain\user` format, you may receive an error indicating the logon attempt failed with the message **Remote machine is AAD joined. If you are signing in to your work account, try using your work email address**. +> If you specify your user name in `domain\user` format, you may receive an error indicating the logon attempt failed with the message **Remote machine is Microsoft Entra joined. If you are signing in to your work account, try using your work email address**. > [!NOTE] > For devices running Windows 10, version 1703 or earlier, the user must sign in to the remote device first before attempting remote connections. ### Supported configurations -This table lists the supported configurations for remotely connecting to an Azure AD joined device without using Azure AD authentication: +This table lists the supported configurations for remotely connecting to a Microsoft Entra joined device without using Microsoft Entra authentication: | **Criteria** | **Client operating system** | **Supported credentials** | |--------------------------------------------|-----------------------------------|--------------------------------------------------------------------| -| RDP from **Azure AD registered device** | Windows 10, version 2004 or later | Password, smart card | -| RDP from **Azure AD joined device** | Windows 10, version 1607 or later | Password, smart card, Windows Hello for Business certificate trust | -| RDP from **hybrid Azure AD joined device** | Windows 10, version 1607 or later | Password, smart card, Windows Hello for Business certificate trust | +| RDP from **Microsoft Entra registered device** | Windows 10, version 2004 or later | Password, smart card | +| RDP from **Microsoft Entra joined device** | Windows 10, version 1607 or later | Password, smart card, Windows Hello for Business certificate trust | +| RDP from **Microsoft Entra hybrid joined device** | Windows 10, version 1607 or later | Password, smart card, Windows Hello for Business certificate trust | > [!NOTE] -> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure AD joined devices, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities). +> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Microsoft Entra joined devices, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities). > [!NOTE] -> When an Azure AD group is added to the **Remote Desktop Users** group on a Windows device, it isn't honored when the user that belongs to the Azure AD group logs in through RDP, resulting in failure to establish the remote connection. In this scenario, Network Level Authentication should be disabled to allow the connection. +> When a Microsoft Entra group is added to the **Remote Desktop Users** group on a Windows device, it isn't honored when the user that belongs to the Microsoft Entra group logs in through RDP, resulting in failure to establish the remote connection. In this scenario, Network Level Authentication should be disabled to allow the connection. ## Add users to Remote Desktop Users group @@ -106,7 +110,7 @@ Remote Desktop Users group is used to grant users and groups permissions to remo - **Adding users manually**: - You can specify individual Azure AD accounts for remote connections by running the following command, where `` is the UPN of the user, for example `user@domain.com`: + You can specify individual Microsoft Entra accounts for remote connections by running the following command, where `` is the UPN of the user, for example `user@domain.com`: ```cmd net localgroup "Remote Desktop Users" /add "AzureAD\" @@ -116,7 +120,7 @@ Remote Desktop Users group is used to grant users and groups permissions to remo - **Adding users using policy**: - Starting in Windows 10, version 2004, you can add users to the Remote Desktop Users using MDM policies as described in [How to manage the local administrators group on Azure AD-joined devices](/azure/active-directory/devices/assign-local-admin#manage-administrator-privileges-using-azure-ad-groups-preview). + Starting in Windows 10, version 2004, you can add users to the Remote Desktop Users using MDM policies as described in [How to manage the local administrators group on Microsoft Entra joined devices](/azure/active-directory/devices/assign-local-admin#manage-administrator-privileges-using-azure-ad-groups-preview). ## Related articles diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index 615806cfd5..58eceea5e1 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -19,7 +19,7 @@ All that's required to use Quick Assist is suitable network and internet connect ### Authentication -The helper can authenticate when they sign in by using a Microsoft account (MSA) or Azure Active Directory (Azure AD). Local Active Directory authentication isn't currently supported. +The helper can authenticate when they sign in by using a Microsoft account (MSA) or Microsoft Entra ID. Local Active Directory authentication isn't currently supported. ### Network considerations @@ -36,7 +36,7 @@ Quick Assist communicates over port 443 (https) and connects to the Remote Assis | `*.registrar.skype.com` | Required for Azure Communication Service. | | `*.support.services.microsoft.com` | Primary endpoint used for Quick Assist application | | `*.trouter.skype.com` | Used for Azure Communication Service for chat and connection between parties. | -| `aadcdn.msauth.net` | Required for logging in to the application (Azure AD). | +| `aadcdn.msauth.net` | Required for logging in to the application (Microsoft Entra ID). | | `edge.skype.com` | Used for Azure Communication Service for chat and connection between parties. | | `login.microsoftonline.com` | Required for Microsoft login service. | | `remoteassistanceprodacs.communication.azure.com` | Used for Azure Communication Service for chat and connection between parties. | diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml index 311cb0c84f..115ff9afd8 100644 --- a/windows/client-management/client-tools/toc.yml +++ b/windows/client-management/client-tools/toc.yml @@ -3,7 +3,7 @@ items: href: administrative-tools-in-windows.md - name: Use Quick Assist to help users href: quick-assist.md - - name: Connect to remote Azure Active Directory-joined PC + - name: Connect to remote Microsoft Entra joined PC href: connect-to-remote-aadj-pc.md - name: Create mandatory user profiles href: mandatory-user-profile.md diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 9b12683d3e..00e2645545 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -100,24 +100,26 @@ When the server initiates disconnection, all undergoing sessions for the enrollm ## Unenrollment from Work Access settings page -If the user is enrolled into MDM using an Azure Active Directory (Azure AD Join or by adding a Microsoft work account), the MDM account shows up under the Work Access page. However, the **Disconnect** button is greyed out and not accessible. Users can remove that MDM account by removing the Azure AD association to the device. +If the user is enrolled into MDM using a Microsoft Entra ID (Microsoft Entra join or by adding a Microsoft work account), the MDM account shows up under the Work Access page. However, the **Disconnect** button is greyed out and not accessible. Users can remove that MDM account by removing the Microsoft Entra association to the device. You can only use the Work Access page to unenroll under the following conditions: - Enrollment was done using bulk enrollment. - Enrollment was created using the Work Access page. -## Unenrollment from Azure Active Directory Join + -When a user is enrolled into MDM through Azure Active Directory Join and later, the enrollment disconnects, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. +## Unenrollment from Microsoft Entra join + +When a user is enrolled into MDM through Microsoft Entra join and later, the enrollment disconnects, there's no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message doesn't indicate the loss of WIP data. ![aadj unenerollment.](images/azure-ad-unenrollment.png) -During the process in which a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Azure Active Directory association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. +During the process in which a device is enrolled into MDM through Microsoft Entra join and then remotely unenrolled, the device may get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Microsoft Entra association is also removed. This safeguard is in place to avoid leaving the corporate devices in unmanaged state. -Before remotely unenrolling corporate devices, you must ensure that there is at least one admin user on the device that isn't part of Azure AD, otherwise the device won't have any admin user after the operation. +Before remotely unenrolling corporate devices, you must ensure that there is at least one admin user on the device that isn't part of Microsoft Entra ID, otherwise the device won't have any admin user after the operation. -In mobile devices, remote unenrollment for Azure Active Directory Joined devices fails. To remove corporate content from these devices, we recommend you remotely wipe the device. +In mobile devices, remote unenrollment for Microsoft Entra joined devices fails. To remove corporate content from these devices, we recommend you remotely wipe the device. ## IT admin-requested disconnection diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 62fce24e34..e711afcc6a 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -12,31 +12,31 @@ ms.collection: You can use a Group Policy to trigger autoenrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. -The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. +The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Microsoft Entra account. **Requirements**: - The Active Directory joined device must be running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). - The enterprise has configured a Mobile Device Management (MDM) service. -- The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad). +- The on-premises Active Directory must be [integrated with Microsoft Entra ID (via Microsoft Entra Connect)](/azure/architecture/reference-architectures/identity/azure-ad). - Service connection point (SCP) configuration. For more information see [configuring the SCP using Microsoft Entra Connect](/azure/active-directory/devices/how-to-hybrid-join). For environments not publishing SCP data to AD, see [Microsoft Entra hybrid join targeted deployment](/azure/active-directory/devices/hybrid-join-control#targeted-deployment-of-microsoft-entra-hybrid-join-on-windows-current-devices). - The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents fail enrollment with `error 0x80180026`). -- The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. For more information, see [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan). +- The minimum Windows Server version requirement is based on the Microsoft Entra hybrid join requirement. For more information, see [How to plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan). > [!TIP] > For more information, see the following topics: > -> - [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) -> - [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) -> - [Azure Active Directory integration with MDM](./azure-active-directory-integration-with-mdm.md) +> - [How to configure automatic registration of Windows domain-joined devices with Microsoft Entra ID](/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) +> - [How to plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) +> - [Microsoft Entra integration with MDM](./azure-active-directory-integration-with-mdm.md) -The autoenrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD-registered. +The autoenrollment relies on the presence of an MDM service and the Microsoft Entra registration for the PC. Once the enterprise has registered its AD with Microsoft Entra ID, a Windows PC that is domain joined is automatically Microsoft Entra registered. > [!NOTE] > In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. -When the autoenrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task uses the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user gets prompted to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. +When the autoenrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task uses the existing MDM service configuration from the Microsoft Entra information of the user. If multi-factor authentication is required, the user gets prompted to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. - Starting in Windows 10, version 1709, when the same policy is configured in Group Policy and MDM, Group Policy policy takes precedence over MDM. - Starting in Windows 10, version 1803, a new setting allows you to change precedence to MDM. For more information, see [Windows Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins). @@ -47,7 +47,7 @@ For this policy to work, you must verify that the MDM service provider allows Gr To configure autoenrollment using a group policy, use the following steps: -1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. +1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Microsoft Entra credentials**. 1. Create a Security Group for the PCs. 1. Link the GPO. 1. Filter using Security Groups. @@ -87,7 +87,7 @@ This procedure is only for illustration purposes to show how the new autoenrollm 1. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**. -1. Double-click **Enable automatic MDM enrollment using default Azure AD credentials**. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. +1. Double-click **Enable automatic MDM enrollment using default Microsoft Entra credentials**. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: @@ -96,14 +96,14 @@ This procedure is only for illustration purposes to show how the new autoenrollm > > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or [Azure Virtual Desktop multi-session host pools](/mem/intune/fundamentals/azure-virtual-desktop-multi-session) because the Intune subscription is user centric. User credentials are supported for [Azure Virtual Desktop personal host pools](/mem/intune/fundamentals/azure-virtual-desktop). -When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called **Schedule created by enrollment client for automatically enrolling in MDM from Azure Active Directory**. To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). +When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called **Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID**. To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). If two-factor authentication is required, you are prompted to complete the process. Here's an example screenshot. :::image type="content" source="images/autoenrollment-2-factor-auth.png" alt-text="Screenshot of Two-factor authentication notification."::: > [!TIP] -> You can avoid this behavior by using Conditional Access Policies in Azure AD. Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). +> You can avoid this behavior by using Conditional Access Policies in Microsoft Entra ID. Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). ## Verify enrollment diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index 56d0b0809b..976b340e5a 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -200,10 +200,10 @@ If you purchased an app from the Store for Business and the app is specified for Here are the requirements for this scenario: -- The app is assigned to a user Azure Active Directory (Azure AD) identity in the Store for Business. You can assign directly in the Store for Business or through a management server. +- The app is assigned to a user Microsoft Entra identity in the Store for Business. You can assign directly in the Store for Business or through a management server. - The device requires connectivity to the Microsoft Store. - Microsoft Store services must be enabled on the device. The UI for the Microsoft Store can be disabled by the enterprise admin. -- The user must be signed in with their Azure AD identity. +- The user must be signed in with their Microsoft Entra identity. Here's an example: @@ -267,7 +267,7 @@ Here are the requirements for this scenario: - The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (`https://contoso.com/app1.appx`). - The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. - The device doesn't need to have connectivity to the Microsoft Store, store services, or have the Microsoft Store UI be enabled. -- The user must be logged in, but association with Azure AD identity isn't required. +- The user must be logged in, but association with Microsoft Entra identity isn't required. > [!NOTE] > You must unlock the device to deploy nonStore apps or you must deploy the app license before deploying the offline apps. For details, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). @@ -384,7 +384,7 @@ Here are the requirements for this scenario: - The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (`https://contoso.com/app1.appx\`) - The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. - The device doesn't need to have connectivity to the Microsoft Store, or store services enabled. -- The device doesn't need any Azure AD identity or domain membership. +- The device doesn't need any Microsoft Entra identity or domain membership. - For nonStore app, your device must be unlocked. - For Store offline apps, the required licenses must be deployed before deploying the apps. diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index 21cae9d2ac..970b5917af 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -14,7 +14,7 @@ The expectations from an MDM are that it uses the same sync mechanism that it us If you're a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: -- Onboard to Azure Active Directory +- Onboard to Microsoft Entra ID - Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for MDM providers to manager eSIM profiles for enterprise use cases. However, Windows doesn't limit how ecosystem partners offer this service to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This characteristic makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you're looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding and as a mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index 9f3374bb96..ae35a82630 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -11,13 +11,15 @@ Windows Information Protection (WIP) is a lightweight solution for managing comp [!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)] -## Integration with Azure AD + -WIP is integrated with Azure Active Directory (Azure AD) identity service. The WIP service supports Azure AD-integrated authentication for the user and the device during enrollment and the downloading of WIP policies. WIP integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md). +## Integration with Microsoft Entra ID -WIP uses Workplace Join (WPJ). WPJ is integrated with adding a work account flow to a personal device. If a user adds their work or school Entra ID account as a secondary account to the machine, their device registered with WPJ. If a user joins their device to Azure AD, it's enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be registered with WPJ. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices. +WIP is integrated with Microsoft Entra identity service. The WIP service supports Microsoft Entra integrated authentication for the user and the device during enrollment and the downloading of WIP policies. WIP integration with Microsoft Entra ID is similar to mobile device management (MDM) integration. See [Microsoft Entra integration with MDM](azure-active-directory-integration-with-mdm.md). -On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD-integrated application, such as the next update of Microsoft 365 apps. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**. +WIP uses Workplace Join (WPJ). WPJ is integrated with adding a work account flow to a personal device. If a user adds their work or school Microsoft Entra account as a secondary account to the machine, their device registered with WPJ. If a user joins their device to Microsoft Entra ID, it's enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be registered with WPJ. A Microsoft Entra join, and enrollment to MDM, should be used to manage corporate devices. + +On personal devices, users can add a Microsoft Entra account as a secondary account to the device while keeping their personal account as primary. Users can add a Microsoft Entra account to the device from a supported Microsoft Entra integrated application, such as the next update of Microsoft 365 apps. Alternatively, users can add a Microsoft Entra account from **Settings > Accounts > Access work or school**. Regular non administrator users can enroll to MAM. @@ -35,26 +37,28 @@ MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID END ``` -## Configuring an Azure AD tenant for MAM enrollment + -MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. The same cloud-based Management MDM app in Azure AD supports both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. This screenshot illustrates the management app for an IT admin configuration. +## Configuring a Microsoft Entra tenant for MAM enrollment + +MAM enrollment requires integration with Microsoft Entra ID. The MAM service provider needs to publish the Management MDM app to the Microsoft Entra app gallery. The same cloud-based Management MDM app in Microsoft Entra ID supports both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. This screenshot illustrates the management app for an IT admin configuration. :::image type="content" alt-text="Mobile application management app." source="images/implement-server-side-mobile-application-management.png"::: -MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that contains both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. +MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Microsoft Entra Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that contains both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Microsoft Entra ID: one for MAM and one for MDM. > [!NOTE] -> If the MDM service in an organization isn't integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured. +> If the MDM service in an organization isn't integrated with Microsoft Entra ID and uses auto-discovery, only one Management app for MAM needs to be configured. ## MAM enrollment -MAM enrollment is based on the MAM extension of [[MS-MDE2] protocol](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). MAM enrollment supports Azure AD [federated authentication](federated-authentication-device-enrollment.md) as the only authentication method. +MAM enrollment is based on the MAM extension of [[MS-MDE2] protocol](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). MAM enrollment supports Microsoft Entra ID [federated authentication](federated-authentication-device-enrollment.md) as the only authentication method. These are the protocol changes for MAM enrollment: - MDM discovery isn't supported. - APPAUTH node in [DMAcc CSP](mdm/dmacc-csp.md) is optional. -- MAM enrollment variation of [MS-MDE2] protocol doesn't support the client authentication certificate, and therefore doesn't support the [MS-XCEP] protocol. Servers must use an Azure AD token for client authentication during policy syncs. Policy sync sessions must be performed over one-way TLS/SSL using server certificate authentication. +- MAM enrollment variation of [MS-MDE2] protocol doesn't support the client authentication certificate, and therefore doesn't support the [MS-XCEP] protocol. Servers must use a Microsoft Entra token for client authentication during policy syncs. Policy sync sessions must be performed over one-way TLS/SSL using server certificate authentication. Here's an example provisioning XML for MAM enrollment. @@ -104,7 +108,7 @@ We don't recommend configuring both Exchange ActiveSync (EAS) and MAM policies f ## Policy sync -MAM policy syncs are modeled after MDM. The MAM client uses an Azure AD token to authenticate to the service for policy syncs. +MAM policy syncs are modeled after MDM. The MAM client uses a Microsoft Entra token to authenticate to the service for policy syncs. ## Change MAM enrollment to MDM @@ -121,4 +125,4 @@ In the process of changing MAM enrollment to MDM, MAM policies will be removed f - EDP CSP Enterprise ID is the same for both MAM and MDM. - EDP CSP RevokeOnMDMHandoff is set to false. -If the MAM device is properly configured for MDM enrollment, then the *Enroll only to device management* link is displayed in **Settings > Accounts > Access work or school**. The user can select this link, provide their credentials, and the enrollment will be changed to MDM. Their Azure AD account won't be affected. +If the MAM device is properly configured for MDM enrollment, then the *Enroll only to device management* link is displayed in **Settings > Accounts > Access work or school**. The user can select this link, provide their credentials, and the enrollment will be changed to MDM. Their Microsoft Entra account won't be affected. diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index b0c40d0dca..40f4cb654f 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -87,7 +87,7 @@ landingContent: links: - text: Enroll Windows devices url: mdm-enrollment-of-windows-devices.md - - text: Automatic enrollment using Azure AD + - text: Automatic enrollment using Microsoft Entra ID url: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md - text: Automatic enrollment using group policy url: enroll-a-windows-10-device-automatically-using-group-policy.md @@ -102,7 +102,7 @@ landingContent: url: client-tools/administrative-tools-in-windows.md - text: Use Quick assist url: client-tools/quick-assist.md - - text: Connect to Azure AD devices + - text: Connect to Microsoft Entra devices url: client-tools/connect-to-remote-aadj-pc.md - text: Create mandatory user profiles url: client-tools/mandatory-user-profile.md diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 5b432d5e1d..cd24637c71 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -32,7 +32,7 @@ Windows offers a range of management options, as shown in the following diagram: :::image type="content" source="images/windows-10-management-range-of-options.png" alt-text="Diagram of the path to modern IT." lightbox="images/windows-10-management-range-of-options.png"::: -As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like group Policy, Active Directory, and Configuration Manager. It also delivers a "mobile-first, cloud-first" approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, and Microsoft 365. +As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like group Policy, Active Directory, and Configuration Manager. It also delivers a "mobile-first, cloud-first" approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Microsoft Entra ID, Azure Information Protection, and Microsoft 365. ## Deployment and provisioning @@ -48,21 +48,21 @@ You have multiple options for [upgrading to Windows 10 and Windows 11](/windows/ ## Identity and authentication -You can use Windows and services like [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-whatis) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **"bring your own device" (BYOD)** or to **"choose your own device" (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. +You can use Windows and services like [Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-whatis) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **"bring your own device" (BYOD)** or to **"choose your own device" (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. You can envision user and device management as falling into these two categories: - **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your employees can self-provision their devices: - - For corporate devices, they can set up corporate access with [Azure AD join](/azure/active-directory/devices/overview). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. + - For corporate devices, they can set up corporate access with [Microsoft Entra join](/azure/active-directory/devices/overview). When you offer them Microsoft Entra join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. - Azure AD join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + Microsoft Entra join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These applications and resources may be traditional ones that require authentication or accessing highly sensitive or classified resources on-premises. - With Windows, if you have an on-premises [Active Directory](/windows-server/identity/whats-new-active-directory-domain-services) domain that's [integrated with Azure AD](/azure/active-directory/devices/hybrid-azuread-join-plan), when employee devices are joined, they automatically register with Azure AD. This registration provides: + With Windows, if you have an on-premises [Active Directory](/windows-server/identity/whats-new-active-directory-domain-services) domain that's [integrated with Microsoft Entra ID](/azure/active-directory/devices/hybrid-azuread-join-plan), when employee devices are joined, they automatically register with Microsoft Entra ID. This registration provides: - Single sign-on to cloud and on-premises resources from everywhere - [Enterprise roaming of settings](/azure/active-directory/devices/enterprise-state-roaming-enable) @@ -72,7 +72,7 @@ You can envision user and device management as falling into these two categories Domain joined PCs and tablets can continue to be managed with [Configuration Manager](/mem/configmgr/core/understand/introduction) client or group policy. -As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Azure AD. +As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Microsoft Entra ID. :::image type="content" source="images/windows-10-management-cyod-byod-flow.png" alt-text="Diagram of decision tree for device authentication options." lightbox="images/windows-10-management-cyod-byod-flow.png"::: diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index 08c2a6ed6b..c3dd757bb5 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -17,7 +17,7 @@ To ensure that the autoenrollment feature is working as expected, you must verif :::image type="content" alt-text="Screenshot of Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: -1. Verify that autoenrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). +1. Verify that autoenrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Microsoft Entra ID and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) @@ -28,7 +28,7 @@ To ensure that the autoenrollment feature is working as expected, you must verif 1. Verify that the device is running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). -1. Autoenrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. +1. Autoenrollment into Intune via Group Policy is valid only for devices that are Microsoft Entra hybrid joined. This condition means that the device must be joined into both local Active Directory and Microsoft Entra ID. To verify that the device is Microsoft Entra hybrid joined, run `dsregcmd /status` from the command line. You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. @@ -36,9 +36,9 @@ To ensure that the autoenrollment feature is working as expected, you must verif Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) + ![Auto-enrollment Microsoft Entra prt verification.](images/auto-enrollment-azureadprt-verification.png) - This information can also be found on the Azure AD device list. + This information can also be found on the Microsoft Entra device list. 1. Verify that the MDM discovery URL during autoenrollment is `https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc`. @@ -48,7 +48,7 @@ To ensure that the autoenrollment feature is working as expected, you must verif :::image type="content" alt-text="Screenshot of Mobility setting MDM Intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: -1. When using group policy for enrollment, verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. +1. When using group policy for enrollment, verify that the *Enable Automatic MDM enrollment using default Microsoft Entra credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 1. Verify that Microsoft Intune allows enrollment of Windows devices. @@ -79,14 +79,14 @@ If you can't find event ID 75 in the logs, it indicates that the autoenrollment - The autoenrollment didn't trigger at all. In this case, you won't find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described here: - The autoenrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: + The autoenrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Microsoft Entra credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: :::image type="content" alt-text="Screenshot of Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: > [!NOTE] > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. - This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. + This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID is triggered by event ID 107. :::image type="content" alt-text="Screenshot of Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: @@ -96,7 +96,7 @@ If you can't find event ID 75 in the logs, it indicates that the autoenrollment The task scheduler log displays event ID 102 (task completed) regardless of the autoenrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the autoenrollment task is triggered or not. It doesn't indicate the success or failure of autoenrollment. - If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. + If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: :::image type="content" alt-text="Screenshot of Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index 9c772124fe..d16c6d7207 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -17,16 +17,18 @@ In today's cloud-first world, enterprise IT departments increasingly want to let ## Connect corporate-owned Windows devices -You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. +You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to a Microsoft Entra domain. Windows doesn't require a personal Microsoft account on devices joined to Microsoft Entra ID or an on-premises Active Directory domain. -![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) +![active directory Microsoft Entra sign-in.](images/unifiedenrollment-rs1-1.png) > [!NOTE] > For devices joined to on-premises Active Directory, see [Group policy enrollment](enroll-a-windows-10-device-automatically-using-group-policy.md). -### Connect your device to an Azure AD domain (join Azure AD) + -All Windows devices can be connected to an Azure AD domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to an Azure AD domain using the Settings app. +### Connect your device to a Microsoft Entra domain (join Microsoft Entra ID) + +All Windows devices can be connected to a Microsoft Entra domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to a Microsoft Entra domain using the Settings app. #### Out-of-box-experience @@ -36,19 +38,19 @@ To join a domain: ![oobe - local account creation](images/unifiedenrollment-rs1-11.png) -1. Select **Join Azure AD**, and then select **Next.** +1. Select **Join Microsoft Entra ID**, and then select **Next.** - ![choose the domain or azure ad](images/unifiedenrollment-rs1-12.png) + ![choose the domain or Microsoft Entra ID](images/unifiedenrollment-rs1-12.png) -1. Type in your Azure AD username. This username is the email address you use to log into Microsoft Office 365 and similar services. +1. Type in your Microsoft Entra username. This username is the email address you use to log into Microsoft Office 365 and similar services. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you're able to enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as Active Directory Federation Services (AD FS) for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - If your Azure AD tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). After you complete the flow, your device will be connected to your organization's Azure AD domain. + If your Microsoft Entra tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). After you complete the flow, your device will be connected to your organization's Microsoft Entra domain. - ![azure ad signin.](images/unifiedenrollment-rs1-13.png) + ![Microsoft Entra sign-in.](images/unifiedenrollment-rs1-13.png) #### Use the Settings app @@ -70,36 +72,38 @@ To create a local account and connect the device: ![Option of connect to work or school](images/unifiedenrollment-rs1-17.png) -1. Under **Alternate Actions**, select **Join this device to Azure Active Directory**. +1. Under **Alternate Actions**, select **Join this device to Microsoft Entra ID**. - ![option to join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) + ![option to join work or school account to Microsoft Entra ID](images/unifiedenrollment-rs1-18.png) -1. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. +1. Type in your Microsoft Entra username. This username is the email address you use to log into Office 365 and similar services. - ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) + ![Microsoft Entra sign-in.](images/unifiedenrollment-rs1-19.png) If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - If your Azure AD tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to connect your device to MDM. + If your Microsoft Entra tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to connect your device to MDM. - After you reach the end of the flow, your device should be connected to your organization's Azure AD domain. You may now sign out of your current account and sign in using your Azure AD username. + After you reach the end of the flow, your device should be connected to your organization's Microsoft Entra domain. You may now sign out of your current account and sign in using your Microsoft Entra username. ![corporate sign in screen](images/unifiedenrollment-rs1-20.png) -#### Help with connecting to an Azure AD domain + -There are a few instances where your device can't be connected to an Azure AD domain. +#### Help with connecting to a Microsoft Entra domain + +There are a few instances where your device can't be connected to a Microsoft Entra domain. | Connection issue | Description | |--|--| -| Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | -| Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | -| Your device already has a user connected to a work account. | You can either connect to an Azure AD domain or connect to a work or school account. You can't connect to both simultaneously. | -| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You must switch to an administrator account to continue. | -| Your device is already managed by MDM. | The connect to Azure AD flow attempts to enroll your device into MDM if your Azure AD tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Azure AD in this case. | -| Your device is running Home edition. | This feature isn't available on Windows Home edition, so you can't connect to an Azure AD domain. You must upgrade to Pro, Enterprise, or Education edition to continue. | +| Your device is connected to a Microsoft Entra domain. | Your device can only be connected to a single Microsoft Entra domain at a time. | +| Your device is already connected to an Active Directory domain. | Your device can either be connected to a Microsoft Entra domain or an Active Directory domain. You can't connect to both simultaneously. | +| Your device already has a user connected to a work account. | You can either connect to a Microsoft Entra domain or connect to a work or school account. You can't connect to both simultaneously. | +| You're logged in as a standard user. | Your device can only be connected to a Microsoft Entra domain if you're logged in as an administrative user. You must switch to an administrator account to continue. | +| Your device is already managed by MDM. | The connect to Microsoft Entra ID flow attempts to enroll your device into MDM if your Microsoft Entra tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Microsoft Entra ID in this case. | +| Your device is running Home edition. | This feature isn't available on Windows Home edition, so you can't connect to a Microsoft Entra domain. You must upgrade to Pro, Enterprise, or Education edition to continue. | ## Connect personally owned devices @@ -107,7 +111,9 @@ Personally owned devices, also known as bring your own device (BYOD), can be con All Windows devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. -### Register device in Azure AD and enroll in MDM + + +### Register device in Microsoft Entra ID and enroll in MDM To create a local account and connect the device: @@ -123,15 +129,15 @@ To create a local account and connect the device: ![connect button to access the option of work or school.](images/unifiedenrollment-rs1-24-b.png) -1. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. +1. Type in your Microsoft Entra username. This username is the email address you use to log into Office 365 and similar services. - ![sync work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) + ![sync work or school account to Azure AD.](images/unifiedenrollment-rs1-25-b.png) 1. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - If your Azure AD tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). + If your Microsoft Entra tenant has autoenrollment configured, your device also gets enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for autoenrollment, you must go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). You can see the status page that shows the progress of your device being set up. @@ -147,8 +153,8 @@ There are a few instances where your device may not be able to connect to work. | Error Message | Description | |--|--| -| Your device is already connected to your organization's cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | -| We couldn't find your identity in your organization's cloud. | The username you entered wasn't found on your Azure AD tenant. | +| Your device is already connected to your organization's cloud. | Your device is already connected to either Microsoft Entra ID, a work or school account, or an AD domain. | +| We couldn't find your identity in your organization's cloud. | The username you entered wasn't found on your Microsoft Entra tenant. | | Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Configuration Manager. | | You don't have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | | We couldn't autodiscover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | @@ -195,7 +201,7 @@ The deep link used for connecting your device to work uses the following format. | Parameter | Description | Supported Value for Windows | |--|--|--| -| mode | Describes which mode is executed in the enrollment app. | Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | +| mode | Describes which mode is executed in the enrollment app. | Mobile Device Management (MDM), Adding Work Account (AWA), and Microsoft Entra joined. | | username | Specifies the email address or UPN of the user who should be enrolled into MDM. | string | | servername | Specifies the MDM server URL that is used to enroll the device. | string | | accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used as a token to validate the enrollment request. | string | @@ -248,7 +254,7 @@ To manage your work or school connections, select **Settings** > **Accounts** > The **Info** button can be found on work or school connections involving MDM. This button is included in the following scenarios: -- Connecting your device to an Azure AD domain that has autoenroll into MDM configured. +- Connecting your device to a Microsoft Entra domain that has autoenroll into MDM configured. - Connecting your device to a work or school account that has autoenroll into MDM configured. - Connecting your device to MDM. @@ -263,7 +269,7 @@ Selecting the **Info** button shows a list of policies and line-of-business apps The **Disconnect** button can be found on all work connections. Generally, selecting the **Disconnect** button removes the connection from the device. There are a few exceptions to this functionality: - Devices that enforce the AllowManualMDMUnenrollment policy don't allow users to remove MDM enrollments. These connections must be removed by a server-initiated unenroll command. -- On mobile devices, you can't disconnect from Azure AD. These connections can only be removed by wiping the device. +- On mobile devices, you can't disconnect from Microsoft Entra ID. These connections can only be removed by wiping the device. > [!WARNING] > Disconnecting might result in the loss of data on the device. diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 7676911fc4..3b715665e0 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -33,7 +33,7 @@ When the Windows device is configured to use a proxy that requires authenticatio Server-initiated unenrollment for a device enrolled by adding a work account silently fails to leave the MDM account active. MDM policies and resources are still in place and the client can continue to sync with the server. -Remote server unenrollment is disabled for mobile devices enrolled via Azure Active Directory Join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Azure AD joined is by remotely wiping the device. +Remote server unenrollment is disabled for mobile devices enrolled via Microsoft Entra join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Microsoft Entra joined is by remotely wiping the device. ## Certificates causing issues with Wi-Fi and VPN @@ -222,9 +222,11 @@ Alternatively you can use the following procedure to create an EAP Configuration After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. -## User provisioning failure in Azure Active Directory-joined devices + -For Azure AD joined devices, provisioning `.\User` resources fails when the user isn't logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. +## User provisioning failure in Microsoft Entra joined devices + +For Microsoft Entra joined devices, provisioning `.\User` resources fails when the user isn't logged in as a Microsoft Entra user. If you attempt to join Microsoft Entra ID from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Microsoft Entra credentials to get your organizational configuration from your MDM server. This behavior is by design. ## Requirements to note for VPN certificates also used for Kerberos Authentication diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index da0013abc4..4777c1d28c 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -56,10 +56,12 @@ For information about the MDM policies defined in the Intune security baseline, No. Only one MDM is allowed. -### How do I set the maximum number of Azure Active Directory-joined devices per user? + + +### How do I set the maximum number of Microsoft Entra joined devices per user? 1. Sign in to the portal as tenant admin: . -1. Navigate to **Azure AD**, then **Devices**, and then select **Device Settings**. +1. Navigate to **Microsoft Entra ID**, then **Devices**, and then select **Device Settings**. 1. Change the number under **Maximum number of devices per user**. ### What is dmwappushsvc? diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 2fa1371357..347afc4322 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -12,7 +12,7 @@ items: href: mdm-overview.md - name: What's new in MDM href: new-in-windows-mdm-enrollment-management.md - - name: Azure Active Directory integration + - name: Microsoft Entra integration href: azure-active-directory-integration-with-mdm.md - name: Transitioning to modern management href: manage-windows-10-in-your-organization-modern-management.md From 6ba4d24f5135e44a81b9fd655ecc52acdda0f997 Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:15:33 -0400 Subject: [PATCH 111/151] [BULK] - DocuTune - Rebranding of Azure Active Dir --- windows/configuration/TOC.yml | 4 +-- .../cortana-at-work/cortana-at-work-o365.md | 2 +- .../cortana-at-work-overview.md | 10 ++++--- .../cortana-at-work-policy-settings.md | 2 +- .../cortana-at-work-scenario-1.md | 6 ++-- .../cortana-at-work-testing-scenarios.md | 2 +- .../set-up-and-test-cortana-in-windows-10.md | 2 +- .../cortana-at-work/test-scenario-1.md | 4 +-- .../cortana-at-work/test-scenario-4.md | 2 +- .../cortana-at-work/test-scenario-5.md | 2 +- windows/configuration/kiosk-methods.md | 30 +++++++++---------- windows/configuration/kiosk-policies.md | 2 +- windows/configuration/kiosk-prepare.md | 2 +- windows/configuration/kiosk-shelllauncher.md | 2 +- windows/configuration/kiosk-single-app.md | 12 ++++---- .../lock-down-windows-10-to-specific-apps.md | 18 +++++------ .../lock-down-windows-11-to-specific-apps.md | 16 +++++----- .../diagnose-provisioning-packages.md | 6 ++-- .../provision-pcs-for-initial-deployment.md | 12 ++++---- .../provisioning-install-icd.md | 2 +- .../provisioning-packages.md | 4 +-- .../set-up-shared-or-guest-pc.md | 4 +-- windows/configuration/wcd/wcd-accounts.md | 4 +-- windows/configuration/wcd/wcd-sharedpc.md | 2 +- windows/configuration/wcd/wcd-takeatest.md | 2 +- .../wcd/wcd-windowsteamsettings.md | 4 +-- 26 files changed, 81 insertions(+), 77 deletions(-) diff --git a/windows/configuration/TOC.yml b/windows/configuration/TOC.yml index 5a140f98e2..97c1386a73 100644 --- a/windows/configuration/TOC.yml +++ b/windows/configuration/TOC.yml @@ -143,7 +143,7 @@ href: cortana-at-work/set-up-and-test-cortana-in-windows-10.md - name: Cortana at work testing scenarios href: cortana-at-work/cortana-at-work-testing-scenarios.md - - name: Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query + - name: Test scenario 1 - Sign into Microsoft Entra ID, enable the wake word, and try a voice query href: cortana-at-work/cortana-at-work-scenario-1.md - name: Test scenario 2 - Run a Bing search with Cortana href: cortana-at-work/cortana-at-work-scenario-2.md @@ -163,7 +163,7 @@ href: cortana-at-work/cortana-at-work-o365.md - name: Testing scenarios using Cortana in your business or organization href: cortana-at-work/testing-scenarios-using-cortana-in-business-org.md - - name: Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query + - name: Test scenario 1 - Sign into Microsoft Entra ID, enable the wake word, and try a voice query href: cortana-at-work/test-scenario-1.md - name: Test scenario 2 - Run a quick search with Cortana at work href: cortana-at-work/test-scenario-2.md diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 5dc0aa37ec..8cc906cd9f 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -29,7 +29,7 @@ Your employees can use Cortana to help manage their day and be more productive b ### Before you begin There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier. -- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana's notebook. They must also authorize Cortana to access Microsoft 365 on their behalf. +- **Microsoft Entra account.** Before your employees can use Cortana in your org, they must be logged in using their Microsoft Entra account through Cortana's notebook. They must also authorize Cortana to access Microsoft 365 on their behalf. - **Office 365 Trust Center.** Cortana in Windows 10, version 1909 and earlier, isn't a service governed by the [Online Services Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products). [Learn more about how Cortana in Windows 10, versions 1909 and earlier, treats your data](https://support.microsoft.com/en-us/help/4468233/cortana-and-privacy-microsoft-privacy). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index 2f8c615755..9bd3833b21 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -38,15 +38,17 @@ Cortana requires a PC running Windows 10, version 1703 or later, and the followi | Software | Minimum version | |---------|---------| |Client operating system | - Windows 10, version 2004 (recommended)

- Windows 10, version 1703 (legacy version of Cortana)

For more information on the differences between Cortana in Windows 10, version 2004 and earlier versions, see [**How is my data processed by Cortana**](#how-is-my-data-processed-by-cortana) below. | -|Azure Active Directory (Azure AD) | While all employees signing into Cortana need an Azure AD account, an Azure AD premium tenant isn't required. | +|Microsoft Entra ID | While all employees signing into Cortana need a Microsoft Entra account, a Microsoft Entra ID P1 or P2 tenant isn't required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There's a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana but won't turn off Cortana. For example, if you turn **Speech** off, your employees won't be able to use the wake word ("Cortana") for hands-free activation or voice commands to easily ask for help. | >[!NOTE] >For Windows 11, Cortana is no longer pinned to the taskbar by default. You can still pin the Cortana app to the taskbar as you would any other app. In addition, the keyboard shortcut that launched Cortana (Win+C) no longer opens Cortana. -## Signing in using Azure AD + -Your organization must have an Azure AD tenant and your employees' devices must all be Azure AD-joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but won't be able to use their enterprise email or calendar.) For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [Azure Active Directory documentation.](/azure/active-directory/) +## Signing in using Microsoft Entra ID + +Your organization must have a Microsoft Entra tenant and your employees' devices must all be Microsoft Entra joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but won't be able to use their enterprise email or calendar.) For info about what a Microsoft Entra tenant is, how to get your devices joined, and other Microsoft Entra maintenance info, see [Microsoft Entra documentation.](/azure/active-directory/) ## How is my data processed by Cortana? @@ -54,7 +56,7 @@ Cortana's approach to integration with Microsoft 365 has changed with Windows 10 ### Cortana in Windows 10, version 2004 and later, or Windows 11 -Cortana enterprise services that can be accessed using Azure AD through Cortana meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365&preserve-view=true). +Cortana enterprise services that can be accessed using Microsoft Entra ID through Cortana meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365&preserve-view=true). #### How does Microsoft store, retain, process, and use Customer Data in Cortana? diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index 8cfe781f37..e0881606c0 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -72,7 +72,7 @@ For specific info about how to set, manage, and use each of these MDM policies t - **AllowMicrosoftAccountConnection** - **Group policy**: None - **MDM policy CSP**: [Accounts/AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - - **Description**: Specifies whether to allow users to sign in using a Microsoft account (MSA) from Windows apps. If you only want to allow users to sign in with their Azure AD account, then disable this setting. + - **Description**: Specifies whether to allow users to sign in using a Microsoft account (MSA) from Windows apps. If you only want to allow users to sign in with their Microsoft Entra account, then disable this setting. - **Allow search and Cortana to use location** - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location` diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index 421e8959d9..28baf34fab 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -1,5 +1,5 @@ --- -title: Sign into Azure AD, enable the wake word, and try a voice query +title: Sign into Microsoft Entra ID, enable the wake word, and try a voice query description: A test scenario walking you through signing in and managing the notebook. ms.prod: windows-client ms.collection: tier3 @@ -13,14 +13,14 @@ ms.date: 12/31/2017 ms.topic: article --- -# Test scenario 1 – Sign into Azure AD, enable the wake word, and try a voice query +# Test scenario 1 – Sign into Microsoft Entra ID, enable the wake word, and try a voice query [!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] >[!NOTE] >The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. -1. Select the **Cortana** icon in the task bar and sign in using your Azure AD account. +1. Select the **Cortana** icon in the task bar and sign in using your Microsoft Entra account. 2. Select the "…" menu and select **Talking to Cortana**. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index 6a8fa6528d..9260043d11 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -19,7 +19,7 @@ ms.technology: itpro-configure We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: -- [Sign into Azure AD, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) +- [Sign into Microsoft Entra ID, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) - [Perform a Bing search with Cortana](cortana-at-work-scenario-2.md) - [Set a reminder](cortana-at-work-scenario-3.md) - [Use Cortana to find free time on your calendar](cortana-at-work-scenario-4.md) diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md index 01d6c2db85..b9fd7b9023 100644 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -49,4 +49,4 @@ When a user enters a search query (by speech or text), Cortana evaluates if the Bing Answers is enabled by default for all users. However, admins can configure and change this setting for specific users and user groups in their organization. ## How the Bing Answer policy configuration is applied -Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an Azure Active Directory group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. +Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of a Microsoft Entra group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. diff --git a/windows/configuration/cortana-at-work/test-scenario-1.md b/windows/configuration/cortana-at-work/test-scenario-1.md index 6f3ffd8173..cd72adceb2 100644 --- a/windows/configuration/cortana-at-work/test-scenario-1.md +++ b/windows/configuration/cortana-at-work/test-scenario-1.md @@ -16,11 +16,11 @@ ms.technology: itpro-configure [!INCLUDE [Deprecation of Cortana in Windows](./includes/cortana-deprecation.md)] -This scenario turns on Azure AD and lets your employee use Cortana to manage an entry in the notebook. +This scenario turns on Microsoft Entra ID and lets your employee use Cortana to manage an entry in the notebook. ## Sign in with your work or school account -This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. +This process helps you to sign out of a Microsoft Account and to sign into a Microsoft Entra account. 1. Click on the **Cortana** icon in the taskbar, then click the profile picture in the navigation to open Cortana settings. diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md index 081ea5877a..206010600b 100644 --- a/windows/configuration/cortana-at-work/test-scenario-4.md +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -28,7 +28,7 @@ This scenario helps you search for both general upcoming meetings, and specific This process helps you find your upcoming meetings. -1. Check to make sure your work calendar is connected and synchronized with your Azure AD account. +1. Check to make sure your work calendar is connected and synchronized with your Microsoft Entra account. 2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md index 17a27dc786..f8dfb7cf8e 100644 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -25,7 +25,7 @@ This scenario helps you to send an email to a co-worker listed in your work addr This process helps you to send a quick message to a co-worker from the work address book. -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. +1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Microsoft Entra account. 2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index 0fdc2d15c1..7dc2ae5f02 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -65,7 +65,7 @@ There are several kiosk configuration methods that you can choose from, dependin ![icon that represents a user account.](images/user.png) - The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. + The kiosk account can be a local standard user account, a local administrator account, a domain account, or a Microsoft Entra account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. >[!IMPORTANT] @@ -79,9 +79,9 @@ You can use this method | For this edition | For this kiosk account type --- | --- | --- [Assigned access in Settings](kiosk-single-app.md#local) | Pro, Ent, Edu | Local standard user [Assigned access cmdlets](kiosk-single-app.md#powershell) | Pro, Ent, Edu | Local standard user -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Azure AD -[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD -[Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Azure AD +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID +[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID +[Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID @@ -89,9 +89,9 @@ You can use this method | For this edition | For this kiosk account type You can use this method | For this edition | For this kiosk account type --- | --- | --- -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Ent, Edu | Local standard user, Active Directory, Azure AD -[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD -[Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Azure AD +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID +[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID +[Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID @@ -99,9 +99,9 @@ You can use this method | For this edition | For this kiosk account type You can use this method | For this edition | For this kiosk account type --- | --- | --- -[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Azure AD -[Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Azure AD -[MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Azure AD +[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID +[Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Microsoft Entra ID +[MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID ## Summary of kiosk configuration methods @@ -109,11 +109,11 @@ Method | App type | Account type | Single-app kiosk | Multi-app kiosk --- | --- | --- | :---: | :---: [Assigned access in Settings](kiosk-single-app.md#local) | UWP | Local account | ✔️ | [Assigned access cmdlets](kiosk-single-app.md#powershell) | UWP | Local account | ✔️ | -[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | ✔️ | -[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | ✔️ | ✔️ -Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md#mdm) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Azure AD | ✔️ | ✔️ -[Shell Launcher](kiosk-shelllauncher.md) |Windows desktop app | Local standard user, Active Directory, Azure AD | ✔️ | -[MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | | ✔️ +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | +[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | ✔️ +Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md#mdm) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Microsoft Entra ID | ✔️ | ✔️ +[Shell Launcher](kiosk-shelllauncher.md) |Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✔️ | +[MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | | ✔️ >[!NOTE] diff --git a/windows/configuration/kiosk-policies.md b/windows/configuration/kiosk-policies.md index 7891caf75d..9e599f8790 100644 --- a/windows/configuration/kiosk-policies.md +++ b/windows/configuration/kiosk-policies.md @@ -29,7 +29,7 @@ When the assigned access kiosk configuration is applied on the device, certain p ## Group Policy -The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. These users include local users, domain users, and Azure Active Directory users. +The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. These users include local users, domain users, and Microsoft Entra users. | Setting | Value | | --- | --- | diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index 0443a3047c..05323a4d02 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -216,7 +216,7 @@ Logs can help you [troubleshoot issues](/troubleshoot/windows-client/shell-exper You may also want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, from an update or power outage, you can sign in the assigned access account manually. Or, you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device don't prevent automatic sign in. > [!NOTE] -> If you are using a Windows client device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. +> If you are using a Windows client device restriction CSP to set "Preferred Microsoft Entra tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. > [!TIP] > If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index fc9e86e27c..4bd3071b0d 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -52,7 +52,7 @@ For sample XML configurations for the different app combinations, see [Samples f > >- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell. -- A domain, Azure Active Directory, or local user account. +- A domain, Microsoft Entra ID, or local user account. - A Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index db0f2a955f..e74ea773a1 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -85,7 +85,7 @@ You have several options for configuring your single-app kiosk. You can use **Settings** to quickly configure one or a few devices as a kiosk. -When your kiosk is a local device that isn't managed by Active Directory or Azure Active Directory, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts. +When your kiosk is a local device that isn't managed by Active Directory or Microsoft Entra ID, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts. - If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything. @@ -235,17 +235,17 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des 3. Enable account management: - :::image type="content" source="images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Azure AD, or create a local admin account."::: + :::image type="content" source="images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account."::: If you want to enable account management, select **Account Management**, and configure the following settings: - **Manage organization/school accounts**: Choose how devices are enrolled. Your options: - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - - **Azure Active Directory**: Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Azure AD tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. + - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Azure AD, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. + If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. - You must run Windows Configuration Designer on Windows client to configure Azure AD enrollment using any of the wizards. + You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in. @@ -323,7 +323,7 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des > >Account type: > - Local standard user -> - Azure AD +> - Microsoft Entra ID Microsoft Intune and other MDM services enable kiosk configuration through the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp). Assigned Access has a `KioskModeApp` setting. In the `KioskModeApp` setting, you enter the user account name and the [AUMID](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the app to run in kiosk mode. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 0df2e63128..89f93fc919 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -311,7 +311,7 @@ The following example hides the taskbar: ``` >[!IMPORTANT] ->The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information. +>The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information. #### Configs @@ -322,8 +322,8 @@ The full multi-app assigned access experience can only work for non-admin users. You can assign: - [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only) -- [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts) -- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). +- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts) +- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). >[!NOTE] >Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. @@ -365,7 +365,7 @@ Individual accounts are specified using ``. - Local account can be entered as `machinename\account` or `.\account` or just `account`. - Domain account should be entered as `domain\account`. -- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Azure AD email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` +- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` >[!WARNING] >Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. @@ -373,7 +373,7 @@ Individual accounts are specified using ``. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. >[!NOTE] ->For both domain and Azure AD accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. +>For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. ```xml @@ -388,7 +388,7 @@ Before applying the multi-app configuration, make sure the specified user accoun Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience. -- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Azure AD accounts that are added to the local group won't have the kiosk settings applied. +- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. ```xml @@ -406,7 +406,7 @@ Group accounts are specified using ``. Nested groups aren't supported ``` -- Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. +- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. ```xml @@ -416,7 +416,7 @@ Group accounts are specified using ``. Nested groups aren't supported ``` >[!NOTE] - >If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. + >If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. @@ -588,7 +588,7 @@ When the multi-app assigned access configuration is applied on the device, certa ### Group policy -The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This list includes local users, domain users, and Azure Active Directory users. +The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This list includes local users, domain users, and Microsoft Entra users. | Setting | Value | | --- | --- | diff --git a/windows/configuration/lock-down-windows-11-to-specific-apps.md b/windows/configuration/lock-down-windows-11-to-specific-apps.md index 80c498eb6e..b2c6c66985 100644 --- a/windows/configuration/lock-down-windows-11-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-11-to-specific-apps.md @@ -203,7 +203,7 @@ The following example hides the taskbar: ``` > [!IMPORTANT] -> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information. +> The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Microsoft Entra account could potentially compromise confidential information. #### Configs @@ -214,8 +214,8 @@ The full multi-app assigned access experience can only work for non-admin users. You can assign: - [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only) -- [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts) -- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). +- [An individual account, which can be local, domain, or Microsoft Entra ID](#config-for-individual-accounts) +- [A group account, which can be local, Active Directory (domain), or Microsoft Entra ID](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). > [!NOTE] > Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. @@ -257,7 +257,7 @@ Individual accounts are specified using ``. - Local account can be entered as `machinename\account` or `.\account` or just `account`. - Domain account should be entered as `domain\account`. -- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Azure AD email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` +- Microsoft Entra account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided _as is_, and consider it's a fixed domain name. Then follow with the Microsoft Entra ID email address. For example, `AzureAD\someone@contoso.onmicrosoft.com` > [!WARNING] > Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. @@ -265,7 +265,7 @@ Individual accounts are specified using ``. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. > [!NOTE] -> For both domain and Azure AD accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. +> For both domain and Microsoft Entra accounts, it's not required that target account is explicitly added to the device. As long as the device is AD-joined or Microsoft Entra joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. ```xml @@ -280,7 +280,7 @@ Before applying the multi-app configuration, make sure the specified user accoun Group accounts are specified using ``. Nested groups aren't supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A won't have the kiosk experience. -- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Azure AD accounts that are added to the local group won't have the kiosk settings applied. +- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Microsoft Entra accounts that are added to the local group won't have the kiosk settings applied. ```xml @@ -298,7 +298,7 @@ Group accounts are specified using ``. Nested groups aren't supported ``` -- Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. +- Microsoft Entra group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign-in. ```xml @@ -308,7 +308,7 @@ Group accounts are specified using ``. Nested groups aren't supported ``` > [!NOTE] - > If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. + > If a Microsoft Entra group is configured with a lockdown profile on a device, a user in the Microsoft Entra group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index b3207522a4..5a71baac61 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -22,9 +22,11 @@ When applying a provisioning package (PPKG) containing power settings, elevated To apply the power settings successfully with the [correct security context](/windows/win32/services/localsystem-account), place the PPKG in `%WINDIR%/Provisioning/Packages` directory, and reboot the device. For more information, see [Configure power settings](/windows-hardware/customize/power-settings/configure-power-settings). -## Unable to perform bulk enrollment in Azure AD + -When [enrolling devices into Azure AD using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request will be rejected, if the user requesting a bulk token is not authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). +## Unable to perform bulk enrollment in Microsoft Entra ID + +When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request will be rejected, if the user requesting a bulk token is not authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). > [!NOTE] > When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request may be rejected. diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 4ea1962aa4..46ddabb9da 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -44,12 +44,12 @@ The desktop wizard helps you configure the following settings in a provisioning - Configure the device for shared use - Remove pre-installed software - Configure Wi-Fi network -- Enroll device in Active Directory or Azure Active Directory +- Enroll device in Active Directory or Microsoft Entra ID - Create local administrator account - Add applications and certificates >[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Azure Active Directory enrollment using any of the wizards. +>You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. @@ -100,17 +100,17 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 3. Enable account management: - :::image type="content" source="../images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Azure AD, or create a local admin account."::: + :::image type="content" source="../images/account-management-details.png" alt-text="In Windows Configuration Designer, join Active Directory, Microsoft Entra ID, or create a local admin account."::: If you want to enable account management, select **Account Management**, and configure the following settings: - **Manage organization/school accounts**: Choose how devices are enrolled. Your options: - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - - **Azure Active Directory**: Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Azure AD tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. + - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Azure AD, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. + If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. - You must run Windows Configuration Designer on Windows client to configure Azure AD enrollment using any of the wizards. + You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. - **Local administrator**: If you select this option, enter a user name and password. If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password isn't changed during that period, the account might be locked out, and unable to sign in. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index e92747be63..22b8f9ad65 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -47,7 +47,7 @@ Windows Configuration Designer can create provisioning packages for Windows clie - Windows Server 2008 R2 >[!WARNING] ->You must run Windows Configuration Designer on Windows client to configure Azure Active Directory enrollment using any of the wizards. +>You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. ## Install Windows Configuration Designer diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index a778b86f70..96dce6d256 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -73,8 +73,8 @@ The following table describes settings that you can configure using the wizards | --- | --- | --- | --- | --- | | Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove pre-installed software | ✔️ | ✔️ | ✔️ | | Set up network | Connect to a Wi-Fi network | ✔️ | ✔️ | ✔️ | -| Account management | Enroll device in Active Directory, enroll device in Azure Active Directory, or create a local administrator account | ✔️ | ✔️ | ✔️ | -| Bulk Enrollment in Azure AD | Enroll device in Azure Active Directory using Bulk Token

[Set up Azure AD join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Azure AD enrollment. | ✔️ | ✔️ | ✔️ | +| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | ✔️ | ✔️ | ✔️ | +| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token

[Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | ✔️ | ✔️ | ✔️ | | Add applications | Install applications using the provisioning package. | ✔️ | ✔️ | ❌ | | Add certificates | Include a certificate file in the provisioning package. | ✔️ | ✔️ | ✔️ | | Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✔️ | ❌ | diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 41f4968fe9..c8ef487740 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -105,7 +105,7 @@ For more information, see [Using PowerShell scripting with the WMI Bridge Provid ## Guidance for accounts on shared PCs -- When a device is configured in *shared PC mode* with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will be deleted automatically at sign out. +- When a device is configured in *shared PC mode* with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Microsoft Entra ID and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will be deleted automatically at sign out. - Local accounts that already exist on a PC won't be deleted when turning on shared PC mode. New local accounts that are created using **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new guest accounts created by the **Guest** and **Kiosk** options on the sign-in screen (if enabled) will automatically be deleted at sign out. To set a general policy on all local accounts, you can configure the following local Group Policy setting: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles**: **Delete User Profiles Older Than A Specified Number Of Days On System Restart**. @@ -150,4 +150,4 @@ To troubleshoot Shared PC, you can use the following tools: [UWP-1]: /uwp/api/windows.system.profile.sharedmodesettings [UWP-2]: /uwp/api/windows.system.profile.educationsettings -[UWP-3]: /uwp/api/windows.system.profile.sharedmodesettings.shouldavoidlocalstorage \ No newline at end of file +[UWP-3]: /uwp/api/windows.system.profile.sharedmodesettings.shouldavoidlocalstorage diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index 1678247efe..20e2c8f6fc 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -15,7 +15,7 @@ ms.technology: itpro-configure # Accounts (Windows Configuration Designer reference) -Use these settings to join a device to an Active Directory domain or an Azure Active Directory tenant, or to add local user accounts to the device. +Use these settings to join a device to an Active Directory domain or a Microsoft Entra tenant, or to add local user accounts to the device. ## Applies to @@ -28,7 +28,7 @@ Use these settings to join a device to an Active Directory domain or an Azure Ac ## Azure -The **Azure > Authority** and **Azure > BPRT** settings for bulk Azure Active Directory (Azure AD) enrollment can only be configured using one of the provisioning wizards. After you get a bulk token for Azure AD enrollment in a wizard, you can switch to the advanced editor to configure more provisioning settings. For information about using the wizards, see: +The **Azure > Authority** and **Azure > BPRT** settings for bulk Microsoft Entra enrollment can only be configured using one of the provisioning wizards. After you get a bulk token for Microsoft Entra enrollment in a wizard, you can switch to the advanced editor to configure more provisioning settings. For information about using the wizards, see: - [Instructions for desktop wizard](../provisioning-packages/provision-pcs-for-initial-deployment.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md index fbfb42be13..9bff17847b 100644 --- a/windows/configuration/wcd/wcd-sharedpc.md +++ b/windows/configuration/wcd/wcd-sharedpc.md @@ -29,7 +29,7 @@ Use these settings to configure settings for accounts allowed on the shared PC. | Setting | Value | Description | | --- | --- | --- | -| AccountModel | - Only guest
- Domain-joined only
- Domain-joined and guest | This option controls how users can sign in on the PC. Choosing domain-joined will enable any user in the domain to sign in. Specifying the guest option will add the Guest option to the sign in screen and enable anonymous guest access to the PC.

- Only guest allows anyone to use the PC as a local standard (non-admin) account.
- Domain-joined only allows users to sign in with an Active Directory or Azure AD account.
- Domain-joined and guest allows users to sign in with an Active Directory, Azure AD, or local standard account. | +| AccountModel | - Only guest
- Domain-joined only
- Domain-joined and guest | This option controls how users can sign in on the PC. Choosing domain-joined will enable any user in the domain to sign in. Specifying the guest option will add the Guest option to the sign in screen and enable anonymous guest access to the PC.

- Only guest allows anyone to use the PC as a local standard (non-admin) account.
- Domain-joined only allows users to sign in with an Active Directory or Microsoft Entra account.
- Domain-joined and guest allows users to sign in with an Active Directory, Microsoft Entra ID, or local standard account. | | DeletionPolicy | - Delete immediately
- Delete at disk space threshold
- Delete at disk space threshold and inactive threshold | - **Delete immediately** deletes the account on sign out.
- **Delete at disk space threshold** starts deleting accounts when available disk space falls below the threshold you set for `DiskLevelDeletion`. It stops deleting accounts when the available disk space reaches the threshold you set for `DiskLevelCaching`. Accounts are deleted in order of oldest accessed to most recently accessed.
- **Delete at disk space threshold and inactive threshold** applies the same disk space checks as noted above. It also deletes accounts if they haven't signed in within the number of days in `InactiveThreshold`. | | DiskLevelCaching | A number between 0 and 100 | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. | | DiskLevelDeletion | A number between 0 and 100 | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. | diff --git a/windows/configuration/wcd/wcd-takeatest.md b/windows/configuration/wcd/wcd-takeatest.md index 2fd7a6d426..d5071fb0e0 100644 --- a/windows/configuration/wcd/wcd-takeatest.md +++ b/windows/configuration/wcd/wcd-takeatest.md @@ -43,7 +43,7 @@ When set to True, students can print in the Take A Test app. Enter the account to use when taking a test. -To specify a domain account, enter **domain\user**. To specify an Azure AD account, enter `username@tenant.com`. To specify a local account, enter the username. +To specify a domain account, enter **domain\user**. To specify a Microsoft Entra account, enter `username@tenant.com`. To specify a local account, enter the username. ## Related articles diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md index d5e531d913..f2ae2c2447 100644 --- a/windows/configuration/wcd/wcd-windowsteamsettings.md +++ b/windows/configuration/wcd/wcd-windowsteamsettings.md @@ -45,10 +45,10 @@ A device account is a Microsoft Exchange account that's connected with Skype for | Email | Email address | Email address of the device account. | | ExchangeServer | Exchange Server | Normally, the device will try to automatically discover the Exchange server. This field is only required if automatic discovery fails. | | Password | Password | Password for the device account. | -| PasswordRotationEnabled | 0 = enabled
1 = disabled | Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, then use this setting to allow the device to manage its own password. It can change the password frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory or Azure AD. | +| PasswordRotationEnabled | 0 = enabled
1 = disabled | Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, then use this setting to allow the device to manage its own password. It can change the password frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory or Microsoft Entra ID. | | SipAddress | Session Initiation Protocol (SIP) address | Normally, the device will try to automatically discover the SIP. This field is only required if automatic discovery fails. | | UserName | User name | Username of the device account when using Active Directory. | -| UserPrincipalName | User principal name (UPN) | To use a device account from Azure Active Directory or a hybrid deployment, you should specify the UPN of the device account. | +| UserPrincipalName | User principal name (UPN) | To use a device account from Microsoft Entra ID or a hybrid deployment, you should specify the UPN of the device account. | | ValidateAndCommit | Any text | Validates the data provided and then commits the changes. This process occurs automatically after the other DeviceAccount settings are applied. The text you enter for the ValidateAndCommit setting doesn't matter. | ## Dot3 From cf6e614c6747ba48b65ae45f140d26fbf4d7bfc5 Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:15:47 -0400 Subject: [PATCH 112/151] [BULK] - DocuTune - Rebranding of Azure Active Dir --- .../deployment/deploy-enterprise-licenses.md | 68 +++++++++++-------- .../waas-delivery-optimization-reference.md | 10 +-- .../do/waas-delivery-optimization-setup.md | 4 +- .../windows-10-deployment-considerations.md | 4 +- windows/deployment/s-mode.md | 2 +- .../update/deployment-service-drivers.md | 6 +- .../deployment-service-expedited-updates.md | 4 +- .../deployment-service-feature-updates.md | 4 +- .../deployment-service-prerequisites.md | 12 ++-- .../update/deployment-service-troubleshoot.md | 4 +- ...wufb-deployment-audience-graph-explorer.md | 2 +- ...deployment-enroll-device-graph-explorer.md | 2 +- ...loyment-find-device-name-graph-explorer.md | 6 +- .../wufb-deployment-graph-explorer.md | 2 +- .../wufb-deployment-graph-unenroll.md | 2 +- .../wufb-reports-admin-center-permissions.md | 12 ++-- .../wufb-reports-script-error-codes.md | 4 +- ...s-servicing-channels-windows-10-updates.md | 5 +- windows/deployment/update/waas-wu-settings.md | 12 ++-- .../deployment/update/wufb-reports-faq.yml | 4 +- .../update/wufb-reports-overview.md | 4 +- .../update/wufb-reports-prerequisites.md | 12 ++-- .../update/wufb-reports-schema-ucclient.md | 4 +- ...-reports-schema-ucclientreadinessstatus.md | 4 +- ...ufb-reports-schema-ucclientupdatestatus.md | 6 +- .../wufb-reports-schema-ucdevicealert.md | 4 +- ...ufb-reports-schema-ucdoaggregatedstatus.md | 4 +- .../update/wufb-reports-schema-ucdostatus.md | 4 +- ...fb-reports-schema-ucserviceupdatestatus.md | 4 +- .../wufb-reports-schema-ucupdatealert.md | 6 +- 30 files changed, 118 insertions(+), 103 deletions(-) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 92d3cab701..8ad4658ea1 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -19,7 +19,7 @@ ms.date: 11/23/2022 # Deploy Windows Enterprise licenses -This article describes how to deploy Windows 10 or Windows 11 Enterprise E3 or E5 licenses with [subscription activation](windows-10-subscription-activation.md) or [Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Azure Active Directory (Azure AD). +This article describes how to deploy Windows 10 or Windows 11 Enterprise E3 or E5 licenses with [subscription activation](windows-10-subscription-activation.md) or [Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) and Microsoft Entra ID. These activation features require a supported and licensed version of Windows 10 Pro or Windows 11 Pro: @@ -66,24 +66,26 @@ If you need to update contact information and resend the activation email, use t ## Preparing for deployment: reviewing requirements - Devices must be running a supported version of Windows 10 Pro or Windows 11 Pro -- Azure AD-joined, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. +- Microsoft Entra joined, or hybrid domain joined with Microsoft Entra Connect. Customers who are federated with Microsoft Entra ID are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices), later in this article. -### Active Directory synchronization with Azure AD + -If you have an on-premises Active Directory Domain Services (AD DS) domain, you need to synchronize the identities in the on-premises AD DS domain with Azure AD. This synchronization is required for users to have a _single identity_ that they can use to access their on-premises apps and cloud services that use Azure AD. An example of a cloud service is Windows Enterprise E3 or E5. +### Active Directory synchronization with Microsoft Entra ID -**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. Azure AD Connect is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. +If you have an on-premises Active Directory Domain Services (AD DS) domain, you need to synchronize the identities in the on-premises AD DS domain with Microsoft Entra ID. This synchronization is required for users to have a _single identity_ that they can use to access their on-premises apps and cloud services that use Microsoft Entra ID. An example of a cloud service is Windows Enterprise E3 or E5. + +**Figure 1** illustrates the integration between the on-premises AD DS domain with Microsoft Entra ID. Microsoft Entra Connect is responsible for synchronization of identities between the on-premises AD DS domain and Microsoft Entra ID. Microsoft Entra Connect is a service that you can install on-premises or in a virtual machine in Azure. :::image type="content" source="images/enterprise-e3-ad-connect.png" alt-text="Figure 1 illustrates the integration between the on-premises AD DS domain with Azure AD."::: -Figure 1: On-premises AD DS integrated with Azure AD +Figure 1: On-premises AD DS integrated with Microsoft Entra ID -For more information about integrating on-premises AD DS domains with Azure AD, see the following resources: +For more information about integrating on-premises AD DS domains with Microsoft Entra ID, see the following resources: -- [What is hybrid identity with Azure Active Directory?](/azure/active-directory/hybrid/whatis-hybrid-identity) -- [Azure AD Connect and Azure AD Connect Health installation roadmap](/azure/active-directory/hybrid/how-to-connect-install-roadmap) +- [What is hybrid identity with Microsoft Entra ID?](/azure/active-directory/hybrid/whatis-hybrid-identity) +- [Microsoft Entra Connect and Microsoft Entra Connect Health installation roadmap](/azure/active-directory/hybrid/how-to-connect-install-roadmap) ## Assigning licenses to users @@ -93,7 +95,7 @@ After you've ordered the Windows subscription (Windows 10 Business, E3 or E5), y The following methods are available to assign licenses: -- When you have the required Azure AD subscription, [group-based licensing](/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal) is the preferred method to assign Enterprise E3 or E5 licenses to users. +- When you have the required Microsoft Entra subscription, [group-based licensing](/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal) is the preferred method to assign Enterprise E3 or E5 licenses to users. - You can sign in to the Microsoft 365 admin center and manually assign licenses: @@ -113,11 +115,15 @@ Now that you've established a subscription and assigned licenses to users, you c > [!NOTE] > The following experiences are specific to Windows 10. The general concepts also apply to Windows 11. -### Step 1: Join Windows Pro devices to Azure AD + -You can join a Windows Pro device to Azure AD during setup, the first time the device starts. You can also join a device that's already set up. +### Step 1: Join Windows Pro devices to Microsoft Entra ID -#### Join a device to Azure AD the first time the device is started +You can join a Windows Pro device to Microsoft Entra ID during setup, the first time the device starts. You can also join a device that's already set up. + + + +#### Join a device to Microsoft Entra ID the first time the device is started 1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then select **Next**. @@ -125,21 +131,23 @@ You can join a Windows Pro device to Azure AD during setup, the first time the d Figure 2: The "Who owns this PC?" page in initial Windows 10 setup. -1. On the **Choose how you'll connect** page, select **Join Azure AD**, and then select **Next**. +1. On the **Choose how you'll connect** page, select **Join Microsoft Entra ID**, and then select **Next**. :::image type="content" source="images/enterprise-e3-choose-how.png" alt-text="A screenshot of the 'Choose how you'll connect' page in Windows 10 setup."::: Figure 3: The "Choose how you'll connect" page in initial Windows 10 setup. -1. On the **Let's get you signed in** page, enter your Azure AD credentials, and then select **Sign in**. +1. On the **Let's get you signed in** page, enter your Microsoft Entra credentials, and then select **Sign in**. :::image type="content" source="images/enterprise-e3-lets-get.png" alt-text="A screenshot of the 'Let's get you signed in' page in Windows 10 setup."::: Figure 4: The "Let's get you signed in" page in initial Windows 10 setup. -Now the device is Azure AD-joined to the organization's subscription. +Now the device is Microsoft Entra joined to the organization's subscription. -#### Join a device to Azure AD when the device is already set up with Windows 10 Pro + + +#### Join a device to Microsoft Entra ID when the device is already set up with Windows 10 Pro > [!IMPORTANT] > Make sure that the user you're signing in with is _not_ the **BUILTIN/Administrator** account. That user can't use the `+ Connect` action to join a work or school account. @@ -150,31 +158,33 @@ Now the device is Azure AD-joined to the organization's subscription. Figure 5: "Connect to work or school" configuration in Settings. -1. In **Set up a work or school account**, select **Join this device to Azure Active Directory**. +1. In **Set up a work or school account**, select **Join this device to Microsoft Entra ID**. :::image type="content" source="images/enterprise-e3-set-up-work-or-school.png" alt-text="A screenshot of the 'Set up a work or school account' wizard."::: Figure 6: Set up a work or school account. -1. On the **Let's get you signed in** page, enter your Azure AD credentials, and then select **Sign in**. +1. On the **Let's get you signed in** page, enter your Microsoft Entra credentials, and then select **Sign in**. :::image type="content" source="images/enterprise-e3-lets-get-2.png" alt-text="A screenshot of the 'Let's get you signed in' window."::: Figure 7: The "Let's get you signed in" window. -Now the device is Azure AD-joined to the organization's subscription. +Now the device is Microsoft Entra joined to the organization's subscription. ### Step 2: Pro edition activation If the device is running a supported version of Windows 10 or Windows 11, it automatically activates Windows Enterprise edition using the firmware-embedded activation key. -### Step 3: Sign in using Azure AD account + -Once the device is joined to Azure AD, users will sign in with their Azure AD account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 or E5 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device. +### Step 3: Sign in using Microsoft Entra account -:::image type="content" source="images/enterprise-e3-sign-in.png" alt-text="A screenshot of signing in to Windows 10 as an Azure AD user."::: +Once the device is joined to Microsoft Entra ID, users will sign in with their Microsoft Entra account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 or E5 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device. -Figure 8: Sign in to Windows 10 with an Azure AD account. +:::image type="content" source="images/enterprise-e3-sign-in.png" alt-text="A screenshot of signing in to Windows 10 as a Microsoft Entra user."::: + +Figure 8: Sign in to Windows 10 with a Microsoft Entra account. ### Step 4: Verify that Enterprise edition is enabled @@ -246,7 +256,7 @@ It displays both of the previously mentioned error messages. Devices must be running a supported version of Windows 10 Pro or Windows 11 Pro. Earlier versions of Windows 10, such as version 1703, don't support this feature. -Devices must also be joined to Azure AD, or hybrid domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. +Devices must also be joined to Microsoft Entra ID, or hybrid domain joined with Microsoft Entra Connect. Customers who are federated with Microsoft Entra ID are also eligible. Use the following procedures to review whether a particular device meets these requirements. @@ -260,11 +270,13 @@ To determine if the computer has a firmware-embedded activation key, enter the f If the device has a firmware-embedded activation key, it will be displayed in the output. If the output is blank, the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. -#### Determine if a device is Azure AD-joined + + +#### Determine if a device is Microsoft Entra joined 1. Open a command prompt and enter `dsregcmd /status`. -1. Review the output in the **Device State** section. If the **AzureAdJoined** value is **YES**, the device is joined to Azure AD. +1. Review the output in the **Device State** section. If the **AzureAdJoined** value is **YES**, the device is joined to Microsoft Entra ID. #### Determine the version of Windows @@ -296,4 +308,4 @@ If a device isn't able to connect to Windows Update, it can lose activation stat Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another [qualified multitenant hoster](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf) (PDF download). -Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Azure AD-joined clients are supported. For more information, see [Enable VDA for Enterprise subscription activation](vda-subscription-activation.md). +Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. For more information, see [Enable VDA for Enterprise subscription activation](vda-subscription-activation.md). diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index a3302aa5c3..30981a369f 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -35,8 +35,8 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | Group Policy setting | MDM setting | Supported from version | Notes | | --- | --- | --- | ------- | | [Download mode](#download-mode) | DODownloadMode | 1511 | Default is set to LAN(1). The Group [Download mode](#download-mode) (2) combined with [Group ID](#group-id), enables administrators to create custom device groups that will share content between devices in the group.| -| [Group ID](#group-id) | DOGroupID | 1511 | Used with Group [Download mode](#download-mode). If not set, check [GroupIDSource](#select-the-source-of-group-ids). When GroupID or GroupIDSource policies aren't set, the GroupID is defined as the AD Site (1), Authenticated domain SID (2) or Azure AD Tenant ID (5), in that order. | -| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | If not set, check [Group ID](#group-id). When the GroupID or GroupIDSource policies aren't set, the Group is defined as the AD Site (1), Authenticated domain SID (2) or Azure AD Tenant ID (5), in that order. | +| [Group ID](#group-id) | DOGroupID | 1511 | Used with Group [Download mode](#download-mode). If not set, check [GroupIDSource](#select-the-source-of-group-ids). When GroupID or GroupIDSource policies aren't set, the GroupID is defined as the AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. | +| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | If not set, check [Group ID](#group-id). When the GroupID or GroupIDSource policies aren't set, the Group is defined as the AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. | | [Select a method to restrict peer selection](#select-a-method-to-restrict-peer-selection) | DORestrictPeerSelectionBy | 1803 | Starting in Windows 11, a new option to use 'Local discovery (DNS-SD)' is available to set via this policy. | | [Minimum RAM (inclusive) allowed to use peer caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | Default value is 4 GB. | | [Minimum disk size allowed to use peer caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 | Default value is 32 GB. | @@ -133,7 +133,7 @@ Download mode dictates which download sources clients are allowed to use when do | Bypass (100) | Starting in Windows 11, this option is deprecated. Don't set **Download mode** to '100' (Bypass), which can cause some content to fail to download. If you want to disable peer-to-peer functionality, set DownloadMode to (0). If your device doesn't have internet access, set Download Mode to (99). When you set Bypass (100), the download bypasses Delivery Optimization and uses BITS instead. You don't need to set this option if you're using Configuration Manager. | > [!NOTE] -> When you use Azure Active Directory tenant, AD Site, or AD Domain as the source of group IDs, the association of devices participating in the group should not be relied on for an authentication of identity of those devices. +> When you use Microsoft Entra tenant, AD Site, or AD Domain as the source of group IDs, the association of devices participating in the group should not be relied on for an authentication of identity of those devices. ### Group ID @@ -157,9 +157,9 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection - 2 = Authenticated domain SID - 3 = DHCP Option ID (with this option, the client queries DHCP Option ID 234 and use the returned GUID value as the Group ID) - 4 = DNS Suffix -- 5 = Starting with Windows 10, version 1903, you can use the Azure AD Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. +- 5 = Starting with Windows 10, version 1903, you can use the Microsoft Entra tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. -When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy is ignored. The default behavior, when the GroupID or GroupIDSource policies aren't set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or Azure AD Tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored. +When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy is ignored. The default behavior, when the GroupID or GroupIDSource policies aren't set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored. ### Minimum RAM (inclusive) allowed to use Peer Caching diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index 37bfca7312..40c469034e 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -29,7 +29,7 @@ You find the Delivery Optimization settings in Group Policy under **Computer Con Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile, which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](/mem/intune/configuration/delivery-optimization-windows). -**Starting with Windows 10, version 1903**, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To set the value for [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) to its new maximum value of 5. +**Starting with Windows 10, version 1903**, you can use the Microsoft Entra tenant ID as a means to define groups. To set the value for [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) to its new maximum value of 5. ## Allow service endpoints @@ -66,7 +66,7 @@ Quick-reference table: ### Hybrid WAN scenario -For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group, when the GroupID or GroupIDSource policies aren't set, is the AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider other options for dynamically creating groups, for example by using the [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) policy. +For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group, when the GroupID or GroupIDSource policies aren't set, is the AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider other options for dynamically creating groups, for example by using the [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) policy. In Group Policy go to **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md index 2a900b672d..66a91fea26 100644 --- a/windows/deployment/planning/windows-10-deployment-considerations.md +++ b/windows/deployment/planning/windows-10-deployment-considerations.md @@ -53,7 +53,7 @@ For organizations that did not take advantage of the free upgrade offer and are For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: -- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their "work or school account" within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm). +- **User-driven, from the cloud.** By joining a device into Microsoft Entra ID and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Microsoft Entra account and password (called their "work or school account" within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Microsoft Entra integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm). - **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). @@ -80,4 +80,4 @@ The upgrade process is also optimized to reduce the overall time and network ban ## Related topics [Windows 10 compatibility](windows-10-compatibility.md)
-[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) \ No newline at end of file +[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md index d20d9c067f..f49339b0fd 100644 --- a/windows/deployment/s-mode.md +++ b/windows/deployment/s-mode.md @@ -37,7 +37,7 @@ Save your files to your favorite cloud, like OneDrive or Dropbox, and access the Windows in S mode is built for [modern management](/windows/client-management/manage-windows-10-in-your-organization-modern-management), which means using [Windows Autopilot](/mem/autopilot/windows-autopilot) for deployment, and a Mobile Device Management (MDM) solution for management, like Microsoft Intune. -Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic device that can only be used to join the company Azure AD tenant or Active Directory domain. Policies are then deployed automatically through MDM, to customize the device to the user and the desired environment. +Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic device that can only be used to join the company Microsoft Entra tenant or Active Directory domain. Policies are then deployed automatically through MDM, to customize the device to the user and the desired environment. For the devices that are shipped in S mode, you can either keep them in S mode, use Windows Autopilot to switch them out of S mode during the first run process, or later using MDM, if desired. diff --git a/windows/deployment/update/deployment-service-drivers.md b/windows/deployment/update/deployment-service-drivers.md index 39d270bf63..4373f59f58 100644 --- a/windows/deployment/update/deployment-service-drivers.md +++ b/windows/deployment/update/deployment-service-drivers.md @@ -187,7 +187,7 @@ content-type: application/json Once Windows Update for Business deployment service has scan results from devices, the applicability for driver and firmware updates can be displayed for a deployment audience. Each applicable update returns the following information: - An `id` for its [catalog entry](/graph/api/resources/windowsupdates-catalogentry) -- The **Azure AD ID** of the devices it's applicable to +- The **Microsoft Entra ID** of the devices it's applicable to - Information describing the update such as the name and version. To display [applicable content](/graph/api/resources/windowsupdates-applicablecontent), run a query using the **Audience ID**, for example `d39ad1ce-0123-4567-89ab-cdef01234567`: @@ -197,7 +197,7 @@ GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d ``` The following truncated response displays: - - An **Azure AD ID** of `01234567-89ab-cdef-0123-456789abcdef` + - An **Microsoft Entra ID** of `01234567-89ab-cdef-0123-456789abcdef` - The **Catalog ID** of `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c` ```json @@ -337,4 +337,4 @@ GET https://graph.microsoft.com/beta/admin/windows/updates/deployments?orderby=c ## Policy considerations for drivers -[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)] \ No newline at end of file +[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)] diff --git a/windows/deployment/update/deployment-service-expedited-updates.md b/windows/deployment/update/deployment-service-expedited-updates.md index a7e5e6a58f..9279a5e9d4 100644 --- a/windows/deployment/update/deployment-service-expedited-updates.md +++ b/windows/deployment/update/deployment-service-expedited-updates.md @@ -256,7 +256,7 @@ The request returns a 201 Created response code and a [deployment](/graph/api/re The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be expedited. -The following example adds two devices to the deployment audience using the **Azure AD ID** for each device: +The following example adds two devices to the deployment audience using the **Microsoft Entra ID** for each device: ```msgraph-interactive POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience @@ -295,4 +295,4 @@ DELETE https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e -[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)] \ No newline at end of file +[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)] diff --git a/windows/deployment/update/deployment-service-feature-updates.md b/windows/deployment/update/deployment-service-feature-updates.md index f9ba6dd147..070ecd8914 100644 --- a/windows/deployment/update/deployment-service-feature-updates.md +++ b/windows/deployment/update/deployment-service-feature-updates.md @@ -61,7 +61,7 @@ When you enroll devices into feature update management, the deployment service b As long as a device remains enrolled in feature update management through the deployment service, the device doesn't receive any other feature updates from Windows Update unless explicitly deployed using the deployment service. A device is offered the specified feature update if it hasn't already received the update. For example, if you deploy Windows 11 feature update version 22H2 to a device that's enrolled into feature update management and is currently on an older version of Windows 11, the device updates to version 22H2. If the device is already running version 22H2 or a later version, it stays on its current version. > [!TIP] -> Windows Update for Business reports has a [workbook](wufb-reports-workbook.md#feature-updates-tab) that displays the current operating system version for devices. In the workbook, go to the **Feature updates** tab and in the **In Service feature update** tile, select the **View details** link to open the details flyout. The OS version and Azure AD ID of devices can easily be exported into a .csv file or opened in [Azure Monitor Logs](/azure/azure-monitor/logs/log-query-overview) to help when creating a deployment audience. +> Windows Update for Business reports has a [workbook](wufb-reports-workbook.md#feature-updates-tab) that displays the current operating system version for devices. In the workbook, go to the **Feature updates** tab and in the **In Service feature update** tile, select the **View details** link to open the details flyout. The OS version and Microsoft Entra ID of devices can easily be exported into a .csv file or opened in [Azure Monitor Logs](/azure/azure-monitor/logs/log-query-overview) to help when creating a deployment audience. [!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-enroll-device-graph-explorer.md)] @@ -230,7 +230,7 @@ GET https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12- The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be offered. -The following example adds three devices to the deployment audience using the **Azure AD ID** for each device: +The following example adds three devices to the deployment audience using the **Microsoft Entra ID** for each device: ```msgraph-interactive POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience diff --git a/windows/deployment/update/deployment-service-prerequisites.md b/windows/deployment/update/deployment-service-prerequisites.md index de71ad0223..d4dbc2e5e1 100644 --- a/windows/deployment/update/deployment-service-prerequisites.md +++ b/windows/deployment/update/deployment-service-prerequisites.md @@ -21,12 +21,14 @@ ms.date: 02/14/2023 Before you begin the process of deploying updates with Windows Update for Business deployment service, ensure you meet the prerequisites. -## Azure and Azure Active Directory + -- An Azure subscription with [Azure Active Directory](/azure/active-directory/) -- Devices must be Azure Active Directory-joined and meet the below OSrequirements. - - Devices can be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid). - - Devices that are [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business +## Azure and Microsoft Entra ID + +- An Azure subscription with [Microsoft Entra ID](/azure/active-directory/) +- Devices must be Microsoft Entra joined and meet the below OSrequirements. + - Devices can be [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid). + - Devices that are [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business ## Licensing diff --git a/windows/deployment/update/deployment-service-troubleshoot.md b/windows/deployment/update/deployment-service-troubleshoot.md index 2d4052bbba..65a6b7777a 100644 --- a/windows/deployment/update/deployment-service-troubleshoot.md +++ b/windows/deployment/update/deployment-service-troubleshoot.md @@ -27,13 +27,13 @@ This troubleshooting guide addresses the most common issues that IT administrato - **Feature updates only**: The device might have a safeguard hold applied for the given feature update version. For more about safeguard holds, see [Safeguard holds](safeguard-holds.md) and [Opt out of safeguard holds](safeguard-opt-out.md). - Check that the deployment to which the device is assigned has the state *offering*. Deployments that have the states *paused* or *scheduled* won't deploy content to devices. - Check that the device has scanned for updates and is scanning the Windows Update service. To learn more about scanning for updates, see [Scanning updates](how-windows-update-works.md#scanning-updates). -- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is successfully enrolled will be represented by an Azure AD device resource with an update management enrollment for feature updates and have no Azure AD device registration errors. +- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is successfully enrolled will be represented by a Microsoft Entra device resource with an update management enrollment for feature updates and have no Microsoft Entra device registration errors. - **Expedited quality updates only**: Check that the device has the Update Health Tools installed (available for Windows 10 version 1809 or later in the update described in [KB 4023057 - Update for Windows 10 Update Service components](https://support.microsoft.com/topic/kb4023057-update-for-windows-10-update-service-components-fccad0ca-dc10-2e46-9ed1-7e392450fb3a), or a more recent quality update). The Update Health Tools are required for a device to receive an expedited quality update. On a device, the program can be located at **C:\\Program Files\\Microsoft Update Health Tools**. You can verify its presence by reviewing **Add or Remove Programs** or using the following PowerShell script: `Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Update Health Tools"}`. ## The device is receiving an update that I didn't deploy - Check that the device is scanning the Windows Update service and not a different endpoint. If the device is scanning for updates from a WSUS endpoint, for example, it might receive different updates. To learn more about scanning for updates, see [Scanning updates](how-windows-update-works.md#scanning-updates). -- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is not successfully enrolled might receive different updates according to its feature update deferral period, for example. A device that is successfully enrolled will be represented by an Azure AD device resource with an update management enrollment for feature updates and have no Azure AD device registration errors. +- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is not successfully enrolled might receive different updates according to its feature update deferral period, for example. A device that is successfully enrolled will be represented by a Microsoft Entra device resource with an update management enrollment for feature updates and have no Microsoft Entra device registration errors. ### The device installed a newer update then the expedited update I deployed diff --git a/windows/deployment/update/includes/wufb-deployment-audience-graph-explorer.md b/windows/deployment/update/includes/wufb-deployment-audience-graph-explorer.md index fda5f5a881..24da4ab44e 100644 --- a/windows/deployment/update/includes/wufb-deployment-audience-graph-explorer.md +++ b/windows/deployment/update/includes/wufb-deployment-audience-graph-explorer.md @@ -32,7 +32,7 @@ A deployment audience is a collection of devices that you want to deploy updates ``` -1. Add devices, using their **Azure AD ID**, to the deployment audience so they become audience members. Specify the deployment **Audience ID** in the URL field and the devices to add in the request body. The `id` property specifies the **Azure AD ID** of the device. +1. Add devices, using their **Microsoft Entra ID**, to the deployment audience so they become audience members. Specify the deployment **Audience ID** in the URL field and the devices to add in the request body. The `id` property specifies the **Microsoft Entra ID** of the device. ```msgraph-interactive POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience diff --git a/windows/deployment/update/includes/wufb-deployment-enroll-device-graph-explorer.md b/windows/deployment/update/includes/wufb-deployment-enroll-device-graph-explorer.md index 0ae067e62f..ed62f731f1 100644 --- a/windows/deployment/update/includes/wufb-deployment-enroll-device-graph-explorer.md +++ b/windows/deployment/update/includes/wufb-deployment-enroll-device-graph-explorer.md @@ -17,7 +17,7 @@ You enroll devices based on the types of updates you want them to receive. Curre 1. Enter the following request into the URL field:
`https://graph.microsoft.com/beta/admin/windows/updates/updatableAssets/enrollAssets` 1. In the **Request body** tab, enter the following JSON, supplying the following information: - - **Azure AD Device ID** as `id` + - **Microsoft Entra Device ID** as `id` - Either `feature` or `driver` for the updateCategory ```json diff --git a/windows/deployment/update/includes/wufb-deployment-find-device-name-graph-explorer.md b/windows/deployment/update/includes/wufb-deployment-find-device-name-graph-explorer.md index b2f438598f..336236ee43 100644 --- a/windows/deployment/update/includes/wufb-deployment-find-device-name-graph-explorer.md +++ b/windows/deployment/update/includes/wufb-deployment-find-device-name-graph-explorer.md @@ -27,7 +27,7 @@ Use the [device](/graph/api/resources/device) resource type to find clients to e ### Add a request header for advanced queries -For the next requests, set the **ConsistencyLevel** header to `eventual`. For more information about advanced query parameters, see [Advanced query capabilities on Azure AD directory objects](/graph/aad-advanced-queries). +For the next requests, set the **ConsistencyLevel** header to `eventual`. For more information about advanced query parameters, see [Advanced query capabilities on Microsoft Entra directory objects](/graph/aad-advanced-queries). 1. In Graph Explorer, select the **Request headers** tab. 1. For **Key** type in `ConsistencyLevel` and for **Value**, type `eventual`. @@ -49,6 +49,6 @@ For the next requests, set the **ConsistencyLevel** header to `eventual`. For mo > [!Tip] > Requests using the [device](/graph/api/resources/device) resource type typically have both an `id` and a `deviceid`: -> - The `deviceid` is the **Azure AD Device ID** and will be used in this article. +> - The `deviceid` is the **Microsoft Entra Device ID** and will be used in this article. > - Later in this article, this `deviceid` will be used as an `id` when you make certain requests such as adding a device to a deployment audience. -> - The `id` from the [device](/graph/api/resources/device) resource type is usually the Azure AD Object ID, which won't be used in this article. +> - The `id` from the [device](/graph/api/resources/device) resource type is usually the Microsoft Entra Object ID, which won't be used in this article. diff --git a/windows/deployment/update/includes/wufb-deployment-graph-explorer.md b/windows/deployment/update/includes/wufb-deployment-graph-explorer.md index 3b19cd934d..8d869d1f69 100644 --- a/windows/deployment/update/includes/wufb-deployment-graph-explorer.md +++ b/windows/deployment/update/includes/wufb-deployment-graph-explorer.md @@ -17,7 +17,7 @@ For this article, you'll use Graph Explorer to make requests to the [Microsoft G > - Requests listed in this article require signing in with a Microsoft 365 account. If needed, a free one month trial is available for [Microsoft 365 Business Premium](https://www.microsoft.com/microsoft-365/business/microsoft-365-business-premium). > - Using a test tenant to learn and verify the deployment process is highly recommended. Graph Explorer is intended to be a learning tool. Ensure you understand [granting consent](/graph/security-authorization) and the [consent type](/graph/api/resources/oauth2permissiongrant#properties) for Graph Explorer before proceeding. -1. From a browser, go to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in using an Azure Active Directory (Azure AD) user account. +1. From a browser, go to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in using a Microsoft Entra user account. 1. You may need to enable the [`WindowsUpdates.ReadWrite.All` permission](/graph/permissions-reference#windows-updates-permissions) to use the queries in this article. To enable the permission: 1. Select the **Modify permissions** tab in Graph Explorer. 1. In the permissions dialog box, select the **WindowsUpdates.ReadWrite.All** permission then select **Consent**. You may need to sign in again to grant consent. diff --git a/windows/deployment/update/includes/wufb-deployment-graph-unenroll.md b/windows/deployment/update/includes/wufb-deployment-graph-unenroll.md index f85f158a63..2bd37bd8ff 100644 --- a/windows/deployment/update/includes/wufb-deployment-graph-unenroll.md +++ b/windows/deployment/update/includes/wufb-deployment-graph-unenroll.md @@ -17,7 +17,7 @@ When a device no longer needs to be managed by the deployment service, unenroll - Drivers may start being installed from Windows Update depending on the device's configuration To unenroll a device, POST to [updatableAssets](/graph/api/resources/windowsupdates-updatableasset) using [unenrollAssets](/graph/api/windowsupdates-updatableasset-unenrollassets). In the request body, specify: -- **Azure AD Device ID** as `id` for the device +- **Microsoft Entra Device ID** as `id` for the device - Either `feature` or `driver` for the updateCategory The following example removes `driver` enrollment for two devices, `01234567-89ab-cdef-0123-456789abcdef` and `01234567-89ab-cdef-0123-456789abcde0`: diff --git a/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md b/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md index 342b6d4210..da738e8991 100644 --- a/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md +++ b/windows/deployment/update/includes/wufb-reports-admin-center-permissions.md @@ -11,17 +11,17 @@ ms.localizationpriority: medium Accessing Windows Update for Business reports typcially requires permissions from multiple sources including: -- [Azure Active Directory (Azure AD)](/azure/active-directory/roles/custom-overview) or [Intune](/mem/intune/fundamentals/role-based-access-control): Used for managing Windows Update for Business services through Microsoft Graph API, such as enrolling into reports +- [Microsoft Entra ID](/azure/active-directory/roles/custom-overview) or [Intune](/mem/intune/fundamentals/role-based-access-control): Used for managing Windows Update for Business services through Microsoft Graph API, such as enrolling into reports - [Azure](/azure/role-based-access-control/overview): Used for controlling access to Azure resources through Azure Resource Management, such as access to the Log Analytics workspace -- [Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles): Manages access to the Microsoft 365 admin center, which allows only users with certain Azure AD roles access to sign in +- [Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles): Manages access to the Microsoft 365 admin center, which allows only users with certain Microsoft Entra roles access to sign in **Roles that can enroll into Windows Update for Business reports** To [enroll](../wufb-reports-enable.md#bkmk_enroll) into Windows Update for Business reports from the [Azure portal](https://portal.azure.com) or the [Microsoft 365 admin center](https://admin.microsoft.com) requires one of the following roles: -- [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator) Azure AD role -- [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) Azure AD role -- [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator) Azure AD role +- [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator) Microsoft Entra role +- [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) Microsoft Entra role +- [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator) Microsoft Entra role - [Policy and profile manager](/mem/intune/fundamentals/role-based-access-control#built-in-roles) Microsoft Intune role - Microsoft Intune RBAC roles don't allow access to the Microsoft 365 admin center @@ -43,4 +43,4 @@ Examples of commonly assigned roles for Windows Update for Business reports user | [Global reader](/azure/active-directory/roles/permissions-reference#global-reader) + Log Analytics reader | No | No | Yes | Yes | No | > [!NOTE] -> The Azure AD roles discussed in this article for the Microsoft 365 admin center access apply specifically to the **Windows** tab of the **Software Updates** page. For more information about the **Microsoft 365 Apps** tab, see [Microsoft 365 Apps updates in the admin center](/DeployOffice/updates/software-update-status). +> The Microsoft Entra roles discussed in this article for the Microsoft 365 admin center access apply specifically to the **Windows** tab of the **Software Updates** page. For more information about the **Microsoft 365 Apps** tab, see [Microsoft 365 Apps updates in the admin center](/DeployOffice/updates/software-update-status). diff --git a/windows/deployment/update/includes/wufb-reports-script-error-codes.md b/windows/deployment/update/includes/wufb-reports-script-error-codes.md index a6ca5fedc8..479b5a9eff 100644 --- a/windows/deployment/update/includes/wufb-reports-script-error-codes.md +++ b/windows/deployment/update/includes/wufb-reports-script-error-codes.md @@ -44,6 +44,6 @@ ms.localizationpriority: medium | 66 | Failed to verify UTC connectivity and recent uploads.| | 67 | Unexpected failure when verifying UTC CSP.| | 99 | Device isn't Windows 10 or Windows 11.| -| 100 | Device must be Azure AD joined or hybrid Azure AD joined to use Windows Update for Business reports.| -| 101 | Check Azure AD join failed with unexpected exception.| +| 100 | Device must be Microsoft Entra joined or Microsoft Entra hybrid joined to use Windows Update for Business reports.| +| 101 | Check Microsoft Entra join failed with unexpected exception.| | 102 | DisableOneSettingsDownloads policy shouldn't be enabled. Please disable this policy.| diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index 3fd3990153..894cb7361b 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -44,8 +44,8 @@ The General Availability Channel is the default servicing channel for all Window To get started with the Windows Insider Program for Business, follow these steps: -1. On the [Windows Insider](https://www.microsoft.com/windowsinsider/for-business) website, select **Register** to register your organizational Azure AD account. -2. Follow the prompts to register your tenant.
**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register. +1. On the [Windows Insider](https://www.microsoft.com/windowsinsider/for-business) website, select **Register** to register your organizational Microsoft Entra account. +2. Follow the prompts to register your tenant.
**Note:** The signed-in user needs to be a **Global Administrator** of the Microsoft Entra domain in order to be able to register. 3. Make sure the **Allow Telemetry** setting is set to **2** or higher. 4. For Windows devices, set policies to manage preview builds and their delivery: @@ -70,4 +70,3 @@ To prevent devices in your organization from being enrolled in the Insider Progr >Starting with Windows 10, version 1709, this policy is replaced by **Manage preview builds** policy. > * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* > * MDM: **Update/ManagePreviewBuilds** - diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 5ffafc24a9..b370409adb 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -35,7 +35,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | -| | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | +| | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Microsoft Entra joined or registered | | | [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) (registry only)| Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or a later cumulative update | @@ -257,12 +257,12 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ ## Display organization name in Windows Update notifications -When Windows 11 clients are associated with an Azure AD tenant, the organization name appears in the Windows Update notifications. For instance, when you have a compliance deadline configured for Windows Update for Business, the user notification will display a message similar to **Contoso requires important updates to be installed**. The organization name will also display on the **Windows Update** page in the **Settings** for Windows 11. +When Windows 11 clients are associated with a Microsoft Entra tenant, the organization name appears in the Windows Update notifications. For instance, when you have a compliance deadline configured for Windows Update for Business, the user notification will display a message similar to **Contoso requires important updates to be installed**. The organization name will also display on the **Windows Update** page in the **Settings** for Windows 11. -The organization name appears automatically for Windows 11 clients that are associated with Azure AD in any of the following ways: -- [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) -- [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) -- [Hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) +The organization name appears automatically for Windows 11 clients that are associated with Microsoft Entra ID in any of the following ways: +- [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) +- [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) +- [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) To disable displaying the organization name in Windows Update notifications, add or modify the following in the registry: diff --git a/windows/deployment/update/wufb-reports-faq.yml b/windows/deployment/update/wufb-reports-faq.yml index 60f9460966..fe8f250ece 100644 --- a/windows/deployment/update/wufb-reports-faq.yml +++ b/windows/deployment/update/wufb-reports-faq.yml @@ -55,7 +55,7 @@ sections: questions: - question: What is Windows Update for Business reports? answer: | - Windows Update for Business reports is a cloud-based solution that provides information about your Azure Active Directory-joined devices' compliance with Windows updates. Windows Update for Business reports is offered through the [Azure portal](https://portal.azure.com), and it's included as part of the Windows 10 or Windows 11 prerequisite licenses. + Windows Update for Business reports is a cloud-based solution that provides information about your Microsoft Entra joined devices' compliance with Windows updates. Windows Update for Business reports is offered through the [Azure portal](https://portal.azure.com), and it's included as part of the Windows 10 or Windows 11 prerequisite licenses. - question: Is Windows Update for Business reports free? answer: | Data ingested into your Log Analytics workspace can be retained at no charge for up to first 31 days (or 90 days if [Microsoft Sentinel](/azure/sentinel/overview) is enabled on the workspace). Data ingested into [Application Insights](/azure/azure-monitor/app/app-insights-overview), either classic or workspace-based, is retained for 90 days without any charge. @@ -180,4 +180,4 @@ sections: [Delivery Optimization PowerShell cmdlets](waas-delivery-optimization-setup.md#monitor-delivery-optimization) can be a powerful tool used to monitor Delivery Optimization data on the device. These cmdlets use the cache on the device. The data calculated in the report is taken from the Delivery Optimization events. - question: The report represents the last 28 days of data, why do some queries include >= seven days? answer: | - The data in the report does represent the last 28 days of data. The query for last seven days is just to get the data for the latest snapshot from past seven days. It's possible that data is delayed for sometime and not available for current day, so we look for past seven day snapshot in log analytics and show the latest snapshot. \ No newline at end of file + The data in the report does represent the last 28 days of data. The query for last seven days is just to get the data for the latest snapshot from past seven days. It's possible that data is delayed for sometime and not available for current day, so we look for past seven day snapshot in log analytics and show the latest snapshot. diff --git a/windows/deployment/update/wufb-reports-overview.md b/windows/deployment/update/wufb-reports-overview.md index a4321c74d6..a38066595f 100644 --- a/windows/deployment/update/wufb-reports-overview.md +++ b/windows/deployment/update/wufb-reports-overview.md @@ -16,7 +16,7 @@ ms.date: 11/15/2022 # Windows Update for Business reports overview -Windows Update for Business reports is a cloud-based solution that provides information about your Azure Active Directory-joined devices' compliance with Windows updates. Windows Update for Business reports is offered through the [Azure portal](https://portal.azure.com), and it's included as part of the Windows 10 or Windows 11 prerequisite licenses. Windows Update for Business reports helps you: +Windows Update for Business reports is a cloud-based solution that provides information about your Microsoft Entra joined devices' compliance with Windows updates. Windows Update for Business reports is offered through the [Azure portal](https://portal.azure.com), and it's included as part of the Windows 10 or Windows 11 prerequisite licenses. Windows Update for Business reports helps you: - Monitor security, quality, driver, and feature updates for Windows 11 and Windows 10 devices - Report on devices with update compliance issues @@ -56,7 +56,7 @@ Windows Update for Business reports is a Windows service hosted in Azure that us ## How Windows Update for Business reports works -You'll set up Windows Update for Business reports by enrolling into the service from the Azure portal. Then you'll configure your Azure AD-joined devices to send Windows client diagnostic data to the service. Windows Update for Business reports uses [Log Analytics in Azure Monitor](/azure/azure-monitor/logs/log-analytics-overview) to store the diagnostic data the clients send. You can use this data for reporting on updates for your devices. Windows Update for Business reports collects system data such as: +You'll set up Windows Update for Business reports by enrolling into the service from the Azure portal. Then you'll configure your Microsoft Entra joined devices to send Windows client diagnostic data to the service. Windows Update for Business reports uses [Log Analytics in Azure Monitor](/azure/azure-monitor/logs/log-analytics-overview) to store the diagnostic data the clients send. You can use this data for reporting on updates for your devices. Windows Update for Business reports collects system data such as: - Update deployment progress - Delivery Optimization usage data diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md index b418f74af8..3b3527ba45 100644 --- a/windows/deployment/update/wufb-reports-prerequisites.md +++ b/windows/deployment/update/wufb-reports-prerequisites.md @@ -18,12 +18,14 @@ ms.date: 08/30/2023 Before you begin the process of adding Windows Update for Business reports to your Azure subscription, ensure you meet the prerequisites. -## Azure and Azure Active Directory + -- An Azure subscription with [Azure Active Directory](/azure/active-directory/) -- Devices must be Azure Active Directory-joined and meet the below OS, diagnostic, and endpoint access requirements. - - Devices can be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid). -- Devices that are [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business reports. +## Azure and Microsoft Entra ID + +- An Azure subscription with [Microsoft Entra ID](/azure/active-directory/) +- Devices must be Microsoft Entra joined and meet the below OS, diagnostic, and endpoint access requirements. + - Devices can be [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid). +- Devices that are [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business reports. - The Log Analytics workspace must be in a [supported region](#log-analytics-regions) - Data in the **Driver update** tab of the [workbook](wufb-reports-workbook.md) is only available for devices that receive driver and firmware updates from the [Windows Update for Business deployment service](deployment-service-overview.md) diff --git a/windows/deployment/update/wufb-reports-schema-ucclient.md b/windows/deployment/update/wufb-reports-schema-ucclient.md index 6cf7e6e2a8..9966c6a6ad 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclient.md +++ b/windows/deployment/update/wufb-reports-schema-ucclient.md @@ -22,8 +22,8 @@ UCClient acts as an individual device's record. It contains data such as the cur |Field |Type |Example |Description | |---|---|---|---| -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra Device ID | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID | | **Country** | [string](/azure/kusto/query/scalar-data-types/string) | `US` | The last-reported location of device (country or region), based on IP address. Shown as country code. | | **DeviceFamily** | [string](/azure/kusto/query/scalar-data-types/string) | `PC, Phone` | The device family such as PC, Phone. | | **DeviceName** | [string](/azure/kusto/query/scalar-data-types/string) | `JohnPC-Contoso` | Client-provided device name | diff --git a/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md b/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md index 2e6bcaa89c..a497b36832 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientreadinessstatus.md @@ -26,8 +26,8 @@ UCClientReadinessStatus is an individual device's record about its readiness for | **DeviceName** | [string](/azure/kusto/query/scalar-data-types/string) | `JohnPC-Contoso` | Client-provided device name | | **GlobalDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `g:9832741921341` | The global device identifier. | | **SCCMClientId** | [string](/azure/kusto/query/scalar-data-types/string) | `5AB72FAC-93AB-4954-9AB0-6557D0EFA245` | Configuration Manager Client ID, if available. | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID | -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra Device ID | | **OSName** | [string](/azure/kusto/query/scalar-data-types/string) | `Windows 10` | The operating system name. | | **OSVersion** | [string](/azure/kusto/query/scalar-data-types/string) | `1909` | The Win10 OS Version (such as 19H2, 20H1, 20H2) currently installed on the device. | | **OSBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `10.0.18363.836` | The full OS build installed on this device, such as Major.Minor.Build.Revision | diff --git a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md index 1373eed6d6..760d757558 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md @@ -23,8 +23,8 @@ Update Event that combines the latest client-based data with the latest service- | Field | Type | Example | Description | |---|---|---|---| -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | A string corresponding to the Azure AD tenant to which the device belongs. | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | A string corresponding to this device's Azure AD device ID | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | A string corresponding to the Microsoft Entra tenant to which the device belongs. | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | A string corresponding to this device's Microsoft Entra device ID | |**CatalogId** | [string](/azure/kusto/query/scalar-data-types/string) | `b0f410599615e2ce15e6614ac3fc4ec62d80324020351e172edef89091a64f2f` | The update catalog ID | | **ClientState** | [string](/azure/kusto/query/scalar-data-types/string) | `Installing` | Higher-level bucket of ClientSubstate. | | **ClientSubstate** | [string](/azure/kusto/query/scalar-data-types/string) | `DownloadStart` | Last-known state of this update relative to the device, from the client. | @@ -55,4 +55,4 @@ Update Event that combines the latest client-based data with the latest service- | **UpdateManufacturer** | [string](/azure/kusto/query/scalar-data-types/string) | `Microsoft` | Manufacturer of update. Microsoft for feature or quality updates, for drivers the name of driver manufacturer. | | **UpdateReleaseTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The release date of the update | | **UpdateSource** | [string](/azure/kusto/query/scalar-data-types/string) | `UUP` | The source of the update such as UUP, MUv6, Media | - \ No newline at end of file + diff --git a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md index 435324d2db..a449781e51 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdevicealert.md +++ b/windows/deployment/update/wufb-reports-schema-ucdevicealert.md @@ -28,8 +28,8 @@ These alerts are activated as a result of an issue that is device-specific. It i | **AlertStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Active` | Whether this alert is Active, Resolved, or Deleted | | **AlertSubtype** | [string](/azure/kusto/query/scalar-data-types/string) | `DiskFull` | The subtype of alert. | | **AlertType** | [string](/azure/kusto/query/scalar-data-types/string) | `ClientUpdateAlert` | The type of alert such as ClientUpdateAlert or ServiceUpdateAlert. Indicates which fields will be present. | -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD device ID of the device, if available. | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD tenant ID of the device. | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra device ID of the device, if available. | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID of the device. | | **ClientSubstate** | [string](/azure/kusto/query/scalar-data-types/string) | `DownloadStart` | If the alert is from the client, the ClientSubstate at the time this alert was activated or updated, else empty. | | **ClientSubstateRank** | [int](/azure/kusto/query/scalar-data-types/int) | `2300` | Rank of ClientSubstate | | **DeploymentId** | [string](/azure/kusto/query/scalar-data-types/string) | `cf1b12a3-3d84-4ce3-bc8e-de48459e252d` | The deployment this alert is relative to, if there's one. | diff --git a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md index a7012d9409..d6b10a0364 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdoaggregatedstatus.md @@ -24,8 +24,8 @@ UCDOAggregatedStatus is an aggregation of all individual UDDOStatus records acro |Field |Type |Example |Description | |---|---|---|---| -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra Device ID | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID | | **BWOptPercent28Days** | [real](/azure/kusto/query/scalar-data-types/real) | `10.61` | Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) for this device. A rolling 28-day basis.| | **BytesFromCache** | [long](/azure/kusto/query/scalar-data-types/long) | `285212672` | Total number of bytes that were delivered from Microsoft Connected Cache (MCC). | | **BytesFromCDN** | [long](/azure/kusto/query/scalar-data-types/long) | `11463008693388` | Total number of bytes that were delivered from a Content Delivery Network (CDN). | diff --git a/windows/deployment/update/wufb-reports-schema-ucdostatus.md b/windows/deployment/update/wufb-reports-schema-ucdostatus.md index a76acc8512..c9f8f9a935 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdostatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdostatus.md @@ -22,8 +22,8 @@ UCDOStatus provides information, for a single device, on its bandwidth utilizati |Field |Type |Example |Description | |---|---|---|---| -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra Device ID | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID | | **BWOptPercent28Days** | [real](/azure/kusto/query/scalar-data-types/real) | `10.61` | Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) for this device. A rolling 28-day basis.| | **BWOptPercent7Days** | [real](/azure/kusto/query/scalar-data-types/real) | `10.61` | Bandwidth optimization (as a percentage of savings of total bandwidth otherwise incurred) for this device. A rolling 7-day basis.| | **BytesFromCache** | [long](/azure/kusto/query/scalar-data-types/long) | `285212672` | Total number of bytes that were delivered from Microsoft Connected Cache (MCC). | diff --git a/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md index 52989b6baf..004f2def5e 100644 --- a/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucserviceupdatestatus.md @@ -23,7 +23,7 @@ Update Event that comes directly from the service-side. The event has only servi | Field | Type | Example | Description | |---|---|---|---| | **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | If this DeviceUpdateEvent is from content deployed by a deployment scheduler service policy, this GUID will map to that policy, otherwise it will be empty. | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | A GUID corresponding to the Azure AD tenant to which the device belongs. | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | A GUID corresponding to the Microsoft Entra tenant to which the device belongs. | |**CatalogId** | [string](/azure/kusto/query/scalar-data-types/string) | `b0f410599615e2ce15e6614ac3fc4ec62d80324020351e172edef89091a64f2f` | The update catalog ID | | **DeploymentApprovedTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2022-05-14 09:26:03.478039` | Date and time of the update approval | | **DeploymentId** | [string](/azure/kusto/query/scalar-data-types/string) |`cf1b12a3-3d84-4ce3-bc8e-de48459e252d` | If this DeviceUpdateEvent is from content deployed by a deployment scheduler service policy, this GUID will map to that policy, otherwise it will be empty. | @@ -41,7 +41,7 @@ Update Event that comes directly from the service-side. The event has only servi | **SourceSystem** | [string](/azure/kusto/query/scalar-data-types/string)| `Azure`| | | **TargetBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `10.0.18363.836` | The full build for the content this event is tracking. For Windows 10, this string corresponds to "10.0.Build.Revision" | | **TargetVersion** | [int](/azure/kusto/query/scalar-data-types/int) | `1909` | The version of content this DeviceUpdateEvent is tracking. For Windows 10 updates, this number would correspond to the year/month version format used, such as 1903. | -| **TenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `9011c330-1234-5678-9abc-def012345678` | Azure AD tenant ID | +| **TenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `9011c330-1234-5678-9abc-def012345678` | Microsoft Entra tenant ID | | **TimeGenerated** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | Time the snapshot ran can also be the same as EventDateTimeUTC in some cases. | | **Type** | [string](/azure/kusto/query/scalar-data-types/string) | `ServiceUpdateEvent` | The EntityType | | **UpdateCategory** | [string](/azure/kusto/query/scalar-data-types/string) | `WindowsFeatureUpdate` | The type of content this DeviceUpdateEvent is tracking. | diff --git a/windows/deployment/update/wufb-reports-schema-ucupdatealert.md b/windows/deployment/update/wufb-reports-schema-ucupdatealert.md index c85d070cc9..ba81be193a 100644 --- a/windows/deployment/update/wufb-reports-schema-ucupdatealert.md +++ b/windows/deployment/update/wufb-reports-schema-ucupdatealert.md @@ -29,8 +29,8 @@ Alert for both client and service updates. Contains information that needs atten | **AlertStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Active` | Whether this alert is Active, Resolved, or Deleted | | **AlertSubtype** | [string](/azure/kusto/query/scalar-data-types/string) | `DiskFull` | The subtype of alert | | **AlertType** | [string](/azure/kusto/query/scalar-data-types/string) | `ClientUpdateAlert` | The type of alert such as ClientUpdateAlert or ServiceUpdateAlert. Indicates which fields will be present | -| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD device ID of the device, if available. | -| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD tenant ID of the device. | +| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Microsoft Entra device ID of the device, if available. | +| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID of the device. | | **ClientSubstate** | [string](/azure/kusto/query/scalar-data-types/string) | `DownloadStart` | If the alert is from the client, the ClientSubstate at the time this alert was activated or updated, else empty. | | **ClientSubstateRank** | [int](/azure/kusto/query/scalar-data-types/int) | `2300` | Rank of ClientSubstate | | **DeploymentId** | [string](/azure/kusto/query/scalar-data-types/string) | `cf1b12a3-3d84-4ce3-bc8e-de48459e252d` | The deployment this alert is relative to, if there's one. | @@ -46,7 +46,7 @@ Alert for both client and service updates. Contains information that needs atten | **StartTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time this alert was activated. | | **TargetBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `18363.836` | The Windows 10 Major. Revision this UpdateAlert is relative to. | | **TargetVersion** | [string](/azure/kusto/query/scalar-data-types/string) | `1909` | The Windows 10 build this UpdateAlert is relative to. | -| **TenantId** |[string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD tenant ID of the device. | +| **TenantId** |[string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Microsoft Entra tenant ID of the device. | | **TimeGenerated** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time the snapshot generated this specific record. This is to determine to which batch snapshot this record belongs. | | **Type** | [string](/azure/kusto/query/scalar-data-types/string) | `UpdateAlert` | The entity type. | | **UpdateCategory** | [string](/azure/kusto/query/scalar-data-types/string) | `WindowsFeatureUpdate` | The type of content this DeviceUpdateEvent is tracking. | From f166bf1f4253304e476545725f78841df27ba24f Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Tue, 17 Oct 2023 23:16:26 -0400 Subject: [PATCH 113/151] [BULK] - DocuTune - Rebranding of Azure Active Dir --- ...ws-upgrade-and-migration-considerations.md | 2 +- .../usmt/usmt-what-does-usmt-migrate.md | 6 ++- .../deployment/vda-subscription-activation.md | 24 +++++----- .../windows-10-deployment-scenarios.md | 8 ++-- .../windows-10-enterprise-e3-overview.md | 6 +-- .../windows-10-subscription-activation.md | 36 ++++++++------- ...-autopatch-device-registration-overview.md | 22 ++++----- ...utopatch-groups-manage-autopatch-groups.md | 40 ++++++++-------- .../windows-autopatch-groups-overview.md | 38 +++++++-------- .../windows-autopatch-register-devices.md | 46 ++++++++++--------- .../windows-autopatch-device-alerts.md | 2 +- .../windows-autopatch-exclude-device.md | 8 ++-- ...dows-autopatch-groups-update-management.md | 2 +- ...-groups-windows-feature-update-overview.md | 6 +-- ...ps-windows-feature-update-status-report.md | 4 +- ...ps-windows-quality-update-status-report.md | 4 +- .../windows-autopatch-maintain-environment.md | 6 +-- .../windows-autopatch-unenroll-tenant.md | 4 +- .../windows-autopatch-deployment-guide.md | 6 +-- .../overview/windows-autopatch-faq.yml | 4 +- .../overview/windows-autopatch-privacy.md | 12 +++-- .../windows-autopatch-configure-network.md | 2 +- .../windows-autopatch-enroll-tenant.md | 12 +++-- .../prepare/windows-autopatch-fix-issues.md | 12 +++-- .../windows-autopatch-prerequisites.md | 4 +- .../windows-autopatch-changes-to-tenant.md | 8 ++-- ...irmware-updates-public-preview-addendum.md | 2 +- 27 files changed, 173 insertions(+), 153 deletions(-) diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md index 81fcb592e6..4a534442ee 100644 --- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md +++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md @@ -37,7 +37,7 @@ You can use USMT to automate migration during large deployments of the Windows o > [!IMPORTANT] > -> USMT only supports devices that are joined to a local Active Directory domain. USMT doesn't support Azure AD joined devices. +> USMT only supports devices that are joined to a local Active Directory domain. USMT doesn't support Microsoft Entra joined devices. ## Upgrade and migration considerations Whether you're upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index b8a8f9f4dc..e32b8c614c 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -248,9 +248,11 @@ You should also note the following items: Starting in Windows 10, version 1607 the USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). -### User profiles from Active Directory to Azure Active Directory + -USMT doesn't support migrating user profiles from Active Directory to Azure Active Directory. +### User profiles from Active Directory to Microsoft Entra ID + +USMT doesn't support migrating user profiles from Active Directory to Microsoft Entra ID. ## Related articles diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index bfd4b4c563..df89fc602d 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -24,13 +24,13 @@ This document describes how to configure virtual machines (VMs) to enable [Windo Deployment instructions are provided for the following scenarios: 1. [Active Directory-joined VMs](#active-directory-joined-vms) -2. [Azure Active Directory-joined VMs](#azure-active-directory-joined-vms) +2. [Microsoft Entra joined VMs](#azure-active-directory-joined-vms) 3. [Azure Gallery VMs](#azure-gallery-vms) ## Requirements - VMs must be running a supported version of Windows Pro edition. -- VMs must be joined to Active Directory or Azure Active Directory (Azure AD). +- VMs must be joined to Active Directory or Microsoft Entra ID. - VMs must be hosted by a Qualified Multitenant Hoster (QMTH). For more information, download the PDF that describes the [Qualified Multitenant Hoster Program](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). ## Activation @@ -40,13 +40,13 @@ Deployment instructions are provided for the following scenarios: - The VM is running a supported version of Windows. - The VM is hosted in Azure, an authorized outsourcer, or another Qualified Multitenant Hoster (QMTH). - When a user with VDA rights signs in to the VM using their Azure AD credentials, the VM is automatically stepped-up to Enterprise and activated. There's no need to do Windows Pro activation. This functionality eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. + When a user with VDA rights signs in to the VM using their Microsoft Entra credentials, the VM is automatically stepped-up to Enterprise and activated. There's no need to do Windows Pro activation. This functionality eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. ### Scenario 2 - The Hyper-V host and the VM are both running a supported version of Windows. - [Inherited Activation](./windows-10-subscription-activation.md#inherited-activation) is enabled. All VMs created by a user with a Windows E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure AD account. + [Inherited Activation](./windows-10-subscription-activation.md#inherited-activation) is enabled. All VMs created by a user with a Windows E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using a Microsoft Entra account. ### Scenario 3 @@ -91,7 +91,7 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl 6. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. > [!NOTE] - > This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). + > This step is different for [Microsoft Entra joined VMs](#azure-active-directory-joined-vms). 7. On the Add applications page, add applications if desired. This step is optional. @@ -111,16 +111,18 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl 8. See the instructions at [Upload and create VM from generalized VHD](/azure/virtual-machines/windows/upload-generalized-managed#upload-the-vhd) to sign in to Azure, get your storage account details, upload the VHD, and create a managed image. -## Azure Active Directory-joined VMs + + +## Microsoft Entra joined VMs > [!IMPORTANT] -> Azure AD provisioning packages have a 180 day limit on bulk token usage. After 180 days, you'll need to update the provisioning package and re-inject it into the image. Existing virtual machines that are Azure AD-joined and deployed won't need to be recreated. +> Microsoft Entra provisioning packages have a 180 day limit on bulk token usage. After 180 days, you'll need to update the provisioning package and re-inject it into the image. Existing virtual machines that are Microsoft Entra joined and deployed won't need to be recreated. -For Azure AD-joined VMs, follow the same instructions as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions: +For Microsoft Entra joined VMs, follow the same instructions as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions: - During setup with Windows Configuration Designer, under **Name**, enter a name for the project that indicates it isn't for Active Directory-joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**. -- During setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organization's credentials. +- During setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Microsoft Entra ID**, select **Get Bulk Token**, sign in, and add the bulk token using your organization's credentials. - When entering the PackagePath, use the project name you previously entered. For example, **Desktop Bulk Enrollment Token Pro GVLK.ppkg** @@ -154,7 +156,7 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j 9. On the Set up network page, choose **Off**. -10. On the Account Management page, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials. +10. On the Account Management page, choose **Enroll in Microsoft Entra ID**, select **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials. 11. On the Add applications page, add applications if desired. This step is optional. @@ -186,7 +188,7 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j The values `enablecredsspsupport` and `authentication level` should each appear only once in the file. -6. Save your changes, and then use this custom RDP file with your Azure AD credentials to connect to the Azure VM. +6. Save your changes, and then use this custom RDP file with your Microsoft Entra credentials to connect to the Azure VM. ## Related articles diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index 18e44ca25b..c216cfa830 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -44,7 +44,7 @@ The following tables summarize various Windows 10 deployment scenarios. The scen |Scenario|Description|More information| |--- |--- |--- | |[Subscription Activation](#windows-10-subscription-activation)|Switch from Windows 10 Pro to Enterprise when a subscribed user signs in.|[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation)| -|[Azure Active Directory / MDM](#dynamic-provisioning)|The device is automatically joined to Azure Active Directory and configured by MDM.|[Azure Active Directory integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm)| +|[Microsoft Entra ID / MDM](#dynamic-provisioning)|The device is automatically joined to Microsoft Entra ID and configured by MDM.|[Microsoft Entra integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm)| |[Provisioning packages](#dynamic-provisioning)|Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices.|[Configure devices without MDM](/windows/configuration/configure-devices-without-mdm)| ### Traditional @@ -110,9 +110,11 @@ The goal of dynamic provisioning is to take a new PC out of the box, turn it on, Windows 10 Subscription Activation is a dynamic deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation). -### Azure Active Directory (Azure AD) join with automatic mobile device management (MDM) enrollment + -In this scenario, the organization member just needs to provide their work or school user ID and password. The device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no other user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm). +### Microsoft Entra join with automatic mobile device management (MDM) enrollment + +In this scenario, the organization member just needs to provide their work or school user ID and password. The device can then be automatically joined to Microsoft Entra ID and enrolled in a mobile device management (MDM) solution with no other user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Microsoft Entra integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm). ### Provisioning package configuration diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index 241c5344cc..93cf409b93 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -23,9 +23,9 @@ Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel o Windows 10/11 Enterprise E3 in CSP delivers, by subscription, exclusive features reserved for Windows 10 or Windows 11 Enterprise editions. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10/11 Enterprise E3 in CSP provides a flexible, per-user subscription for small and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following prerequisites: - Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later (or Windows 11), installed and activated, on the devices to be upgraded. -- Azure Active Directory (Azure AD) available for identity management +- Microsoft Entra available for identity management -You can move from Windows 10 Pro or Windows 11 Pro to Windows 10 Enterprise or Windows 11 Enterprise more easily than ever before with no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10/11 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise or Windows 11 Pro to Windows 11 Enterprise, and all the appropriate Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Enterprise device seamlessly steps back down to Windows 10 Pro or Windows 11 Pro. +You can move from Windows 10 Pro or Windows 11 Pro to Windows 10 Enterprise or Windows 11 Enterprise more easily than ever before with no keys and no reboots. After one of your users enters the Microsoft Entra credentials associated with a Windows 10/11 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise or Windows 11 Pro to Windows 11 Enterprise, and all the appropriate Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Enterprise device seamlessly steps back down to Windows 10 Pro or Windows 11 Pro. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise or Windows 11 Enterprise to their users. Now, with Windows 10/11 Enterprise E3 in CSP, small- and medium-sized organizations can more easily take advantage of Enterprise edition features. @@ -183,6 +183,6 @@ The Managed User Experience feature is a set of Windows 10 Enterprise edition fe ## Related articles [Windows 10/11 Enterprise Subscription Activation](windows-10-subscription-activation.md)
-[Connect domain-joined devices to Azure AD for Windows 10 experiences](/azure/active-directory/devices/hybrid-azuread-join-plan)
+[Connect domain-joined devices to Microsoft Entra ID for Windows 10 experiences](/azure/active-directory/devices/hybrid-azuread-join-plan)
[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 59914650f4..6b8718bf68 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -48,7 +48,7 @@ Windows Enterprise E3 and E5 are available as online services via subscription. - Devices with a current Windows Pro edition license can be seamlessly upgraded to Windows Enterprise. - Product key-based Windows Enterprise software licenses can be transitioned to Windows Enterprise subscriptions. -Organizations that have an enterprise agreement can also benefit from the service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure Active Directory (Azure AD) using [Azure AD Connect Sync](/azure/active-directory/hybrid/how-to-connect-sync-whatis). +Organizations that have an enterprise agreement can also benefit from the service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Microsoft Entra ID using [Microsoft Entra Connect Sync](/azure/active-directory/hybrid/how-to-connect-sync-whatis). > [!NOTE] > Subscription activation is available for qualifying devices running Windows 10 or Windows 11. You can't use subscription activation to upgrade from Windows 10 to Windows 11. @@ -59,7 +59,7 @@ Subscription activation for Education works the same as the Enterprise edition, ## Inherited activation -Inherited activation allows Windows virtual machines to inherit activation state from their Windows client host. When a user with a Windows E3/E5 or A3/A5 license assigned creates a new Windows 10 or Windows 11 virtual machine (VM) using a Windows 10 or Windows 11 host, the VM inherits the activation state from a host machine. This behavior is independent of whether the user signs on with a local account or uses an Azure AD account on a VM. +Inherited activation allows Windows virtual machines to inherit activation state from their Windows client host. When a user with a Windows E3/E5 or A3/A5 license assigned creates a new Windows 10 or Windows 11 virtual machine (VM) using a Windows 10 or Windows 11 host, the VM inherits the activation state from a host machine. This behavior is independent of whether the user signs on with a local account or uses a Microsoft Entra account on a VM. To support inherited activation, both the host computer and the VM must be running a supported version of Windows 10 or Windows 11. The hypervisor platform must also be Windows Hyper-V. @@ -80,7 +80,7 @@ The following list illustrates how deploying Windows client has evolved with eac - **Windows 10, version 1703** made this "step-up" from Windows 10 Pro to Windows 10 Enterprise automatic for devices that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program. -- **Windows 10, version 1709** added support for Windows 10 subscription activation, similar to the CSP support but for large enterprises. This feature enabled the use of Azure AD for assigning licenses to users. When users sign in to a device that's joined to Active Directory or Azure AD, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise. +- **Windows 10, version 1709** added support for Windows 10 subscription activation, similar to the CSP support but for large enterprises. This feature enabled the use of Microsoft Entra ID for assigning licenses to users. When users sign in to a device that's joined to Active Directory or Microsoft Entra ID, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise. - **Windows 10, version 1803** updated Windows 10 subscription activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It was no longer necessary to run a script to activate Windows 10 Pro before activating Enterprise. For virtual machines and hosts running Windows 10, version 1803, [inherited activation](#inherited-activation) was also enabled. @@ -96,7 +96,7 @@ The following list illustrates how deploying Windows client has evolved with eac ### Windows Enterprise requirements > [!NOTE] -> The following requirements don't apply to general Windows client activation on Azure. Azure activation requires a connection to Azure KMS only. It supports workgroup, hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure virtual machines](/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems). +> The following requirements don't apply to general Windows client activation on Azure. Azure activation requires a connection to Azure KMS only. It supports workgroup, hybrid, and Microsoft Entra joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure virtual machines](/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems). > [!IMPORTANT] > As of October 1, 2022, subscription activation is available for *commercial* and *GCC* tenants. It's currently not available on GCC High or DoD tenants. For more information, see [Enable subscription activation with an existing EA](deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea). @@ -104,8 +104,8 @@ The following list illustrates how deploying Windows client has evolved with eac For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following requirements: - A supported version of Windows Pro or Enterprise edition installed on the devices to be upgraded. -- Azure AD available for identity management. -- Devices must be Azure AD-joined or hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices aren't supported. +- Microsoft Entra available for identity management. +- Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Workgroup-joined or Microsoft Entra registered devices aren't supported. For Microsoft customers that don't have EA or MPSA, you can get Windows Enterprise E3/E5 or A3/A5 licenses through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses. For more information about getting Windows Enterprise E3 through your CSP, see [Windows Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). @@ -114,7 +114,7 @@ For Microsoft customers that don't have EA or MPSA, you can get Windows Enterpri - A supported version of Windows Pro Education installed on the devices to be upgraded. - A device with a Windows Pro Education digital license. You can confirm this information in **Settings > Update & Security > Activation**. - The Education tenant must have an active subscription to Microsoft 365 with a Windows Enterprise license, or a Windows Enterprise or Education subscription. -- Devices must be Azure AD-joined or hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices aren't supported. +- Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Workgroup-joined or Microsoft Entra registered devices aren't supported. > [!IMPORTANT] > If Windows 10 Pro is converted to Windows 10 Pro Education by [using benefits available in Store for Education](/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. @@ -130,7 +130,7 @@ To compare Windows 10 editions and review pricing, see the following sites: You can benefit by moving to Windows as an online service in the following ways: -- Licenses for Windows Enterprise and Education are checked based on Azure AD credentials. You have a systematic way to assign licenses to end users and groups in your organization. +- Licenses for Windows Enterprise and Education are checked based on Microsoft Entra credentials. You have a systematic way to assign licenses to end users and groups in your organization. - User sign-in triggers a silent edition upgrade, with no reboot required. @@ -145,13 +145,13 @@ You can benefit by moving to Windows as an online service in the following ways: > [!NOTE] > The following examples use Windows 10 Pro to Enterprise edition. The examples also apply to Windows 11, and Education editions. -The device is Azure AD-joined from **Settings** > **Accounts** > **Access work or school**. +The device is Microsoft Entra joined from **Settings** > **Accounts** > **Access work or school**. You assign Windows 10 Enterprise to a user: ![A screenshot of assigning a Windows 10 Enterprise license in the Microsoft 365 admin center.](images/ent.png) -When a licensed user signs in to a device that meets requirements using their Azure AD credentials, Windows steps up from Pro edition to Enterprise. Then all of the Enterprise features are unlocked. When a user's subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro edition, once the current subscription validity expires. +When a licensed user signs in to a device that meets requirements using their Microsoft Entra credentials, Windows steps up from Pro edition to Enterprise. Then all of the Enterprise features are unlocked. When a user's subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro edition, once the current subscription validity expires. > [!NOTE] > Devices running a supported version of Windows 10 Pro Education can get Windows 10 Enterprise or Education general availability channel on up to five devices for each user covered by the license. This benefit doesn't include the long term servicing channel. @@ -176,7 +176,7 @@ All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise. When a #### Scenario #2 -You're using Azure AD-joined devices or Active Directory-joined devices running a supported version of Windows 10. You configured Azure AD synchronization. You follow the steps in [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md) to get a $0 SKU, and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. You then assign that license to all of your Azure AD users, which can be Active Directory-synced accounts. When that user signs in, the device will automatically change from Windows 10 Pro to Windows 10 Enterprise. +You're using Microsoft Entra joined devices or Active Directory-joined devices running a supported version of Windows 10. You configured Microsoft Entra synchronization. You follow the steps in [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md) to get a $0 SKU, and get a new Windows 10 Enterprise E3 or E5 license in Microsoft Entra ID. You then assign that license to all of your Microsoft Entra users, which can be Active Directory-synced accounts. When that user signs in, the device will automatically change from Windows 10 Pro to Windows 10 Enterprise. #### Earlier versions of Windows @@ -196,7 +196,7 @@ The following policies apply to acquisition and renewal of licenses on devices: Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. -When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal). +When you have the required Microsoft Entra subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal). ### Existing Enterprise deployments @@ -213,13 +213,15 @@ If the computer has never been activated with a Pro key, use the following scrip $(Get-WmiObject SoftwareLicensingService).OA3xOriginalProductKey | foreach{ if ( $null -ne $_ ) { Write-Host "Installing"$_;changepk.exe /Productkey $_ } else { Write-Host "No key present" } } ``` -### Obtaining an Azure AD license + + +### Obtaining a Microsoft Entra ID license If your organization has an Enterprise Agreement (EA) or Software Assurance (SA): -- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD. Ideally, you assign the licenses to groups using the Azure AD Premium feature for group assignment. For more information, see [Enable subscription activation with an existing EA](./deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea). +- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Microsoft Entra ID. Ideally, you assign the licenses to groups using the Microsoft Entra ID P1 or P2 feature for group assignment. For more information, see [Enable subscription activation with an existing EA](./deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea). -- The license administrator can assign seats to Azure AD users with the same process that's used for Microsoft 365 Apps. +- The license administrator can assign seats to Microsoft Entra users with the same process that's used for Microsoft 365 Apps. - New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. @@ -239,11 +241,11 @@ For more information, see [Deploy Windows Enterprise licenses](deploy-enterprise Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Microsoft Azure or in another [qualified multitenant hoster (QMTH)](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). -Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). +Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). ## Related sites -Connect domain-joined devices to Azure AD for Windows experiences. For more information, see [Plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) +Connect domain-joined devices to Microsoft Entra ID for Windows experiences. For more information, see [Plan your Microsoft Entra hybrid join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) [Compare Windows editions](https://www.microsoft.com/windows/business/compare-windows-11) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md index 7bb3547dba..f9ce34d2ae 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md @@ -26,12 +26,12 @@ The overall device registration process is as follows: :::image type="content" source="../media/windows-autopatch-device-registration-overview.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-device-registration-overview.png"::: 1. IT admin reviews [Windows Autopatch device registration prerequisites](windows-autopatch-register-devices.md#prerequisites-for-device-registration) prior to register devices with Windows Autopatch. -2. IT admin identifies devices to be managed by Windows Autopatch through either adding device-based Azure AD groups as part of the [Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md) or the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md). +2. IT admin identifies devices to be managed by Windows Autopatch through either adding device-based Microsoft Entra groups as part of the [Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md) or the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md). 3. Windows Autopatch then: 1. Performs device readiness prior registration (prerequisite checks). 2. Calculates the deployment ring distribution. 3. Assigns devices to one of the deployment rings based on the previous calculation. - 4. Assigns devices to other Azure AD groups required for management. + 4. Assigns devices to other Microsoft Entra groups required for management. 5. Marks devices as active for management so it can apply its update deployment policies. 4. IT admin then monitors the device registration trends and the update deployment reports. @@ -46,13 +46,13 @@ See the following detailed workflow diagram. The diagram covers the Windows Auto | Step | Description | | ----- | ----- | | **Step 1: Identify devices** | IT admin identifies devices to be managed by the Windows Autopatch service. | -| **Step 2: Add devices** | IT admin adds devices through Direct membership or nests other Azure AD assigned or dynamic groups into the **Windows Autopatch Device Registration** Azure AD assigned group when using adding existing device-based Azure AD groups while [creating](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group)/[editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) Custom Autopatch groups, or [editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) the Default Autopatch group | -| **Step 3: Discover devices** | The Windows Autopatch Discover Devices function discovers devices (hourly) that were previously added by the IT admin into the **Windows Autopatch Device Registration** Azure AD assigned group or from Azure AD groups used with Autopatch groups in **step #2**. The Azure AD device ID is used by Windows Autopatch to query device attributes in both Microsoft Intune and Azure AD when registering devices into its service.
  1. Once devices are discovered from the Azure AD group, the same function gathers additional device attributes and saves it into its memory during the discovery operation. The following device attributes are gathered from Azure AD in this step:
    1. **AzureADDeviceID**
    2. **OperatingSystem**
    3. **DisplayName (Device name)**
    4. **AccountEnabled**
    5. **RegistrationDateTime**
    6. **ApproximateLastSignInDateTime**
  2. In this same step, the Windows Autopatch discover devices function calls another function, the device prerequisite check function. The device prerequisite check function evaluates software-based device-level prerequisites to comply with Windows Autopatch device readiness requirements prior to registration.
| -| **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:
  1. **Serial number, model, and manufacturer.**
    1. Checks if the serial number already exists in the Windows Autopatch’s managed device database.
  2. **If the device is Intune-managed or not.**
    1. Windows Autopatch looks to see **if the Azure AD device ID has an Intune device ID associated with it**.
      1. If **yes**, it means this device is enrolled into Intune.
      2. If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.
    2. **If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Azure AD device attributes gathered and saved to its memory in **step 3a**.
      1. Once it has the device attributes gathered from Azure AD in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not registered** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn’t enrolled into Intune.
      2. A common reason is when the Azure AD device ID is stale, it doesn’t have an Intune device ID associated with it anymore. To remediate, [clean up any stale Azure AD device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).
    3. **If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.
  3. **If the device is a Windows device or not.**
    1. Windows Autopatch looks to see if the device is a Windows and corporate-owned device.
      1. **If yes**, it means this device can be registered with the service because it's a Windows corporate-owned device.
      2. **If not**, it means the device is a non-Windows device, or it's a Windows device but it's a personal device.
  4. **Windows Autopatch checks the Windows SKU family**. The SKU must be either:
    1. **Enterprise**
    2. **Pro**
    3. **Pro Workstation**
  5. **If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:
    1. **Only managed by Intune.**
      1. If the device is only managed by Intune, the device is marked as Passed all prerequisites.
    2. **Co-managed by both Configuration Manager and Intune.**
      1. If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:
        1. **Windows Updates Policies**
        2. **Device Configuration**
        3. **Office Click to Run**
      2. If Windows Autopatch determines that one of these workloads isn’t enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not registered** tab.
| +| **Step 2: Add devices** | IT admin adds devices through Direct membership or nests other Microsoft Entra ID assigned or dynamic groups into the **Windows Autopatch Device Registration** Microsoft Entra ID assigned group when using adding existing device-based Microsoft Entra groups while [creating](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group)/[editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) Custom Autopatch groups, or [editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) the Default Autopatch group | +| **Step 3: Discover devices** | The Windows Autopatch Discover Devices function discovers devices (hourly) that were previously added by the IT admin into the **Windows Autopatch Device Registration** Microsoft Entra ID assigned group or from Microsoft Entra groups used with Autopatch groups in **step #2**. The Microsoft Entra device ID is used by Windows Autopatch to query device attributes in both Microsoft Intune and Microsoft Entra ID when registering devices into its service.
  1. Once devices are discovered from the Microsoft Entra group, the same function gathers additional device attributes and saves it into its memory during the discovery operation. The following device attributes are gathered from Microsoft Entra ID in this step:
    1. **AzureADDeviceID**
    2. **OperatingSystem**
    3. **DisplayName (Device name)**
    4. **AccountEnabled**
    5. **RegistrationDateTime**
    6. **ApproximateLastSignInDateTime**
  2. In this same step, the Windows Autopatch discover devices function calls another function, the device prerequisite check function. The device prerequisite check function evaluates software-based device-level prerequisites to comply with Windows Autopatch device readiness requirements prior to registration.
| +| **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:
  1. **Serial number, model, and manufacturer.**
    1. Checks if the serial number already exists in the Windows Autopatch’s managed device database.
  2. **If the device is Intune-managed or not.**
    1. Windows Autopatch looks to see **if the Microsoft Entra device ID has an Intune device ID associated with it**.
      1. If **yes**, it means this device is enrolled into Intune.
      2. If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.
    2. **If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Microsoft Entra device attributes gathered and saved to its memory in **step 3a**.
      1. Once it has the device attributes gathered from Microsoft Entra ID in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not registered** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn’t enrolled into Intune.
      2. A common reason is when the Microsoft Entra device ID is stale, it doesn’t have an Intune device ID associated with it anymore. To remediate, [clean up any stale Microsoft Entra device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).
    3. **If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.
  3. **If the device is a Windows device or not.**
    1. Windows Autopatch looks to see if the device is a Windows and corporate-owned device.
      1. **If yes**, it means this device can be registered with the service because it's a Windows corporate-owned device.
      2. **If not**, it means the device is a non-Windows device, or it's a Windows device but it's a personal device.
  4. **Windows Autopatch checks the Windows SKU family**. The SKU must be either:
    1. **Enterprise**
    2. **Pro**
    3. **Pro Workstation**
  5. **If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:
    1. **Only managed by Intune.**
      1. If the device is only managed by Intune, the device is marked as Passed all prerequisites.
    2. **Co-managed by both Configuration Manager and Intune.**
      1. If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:
        1. **Windows Updates Policies**
        2. **Device Configuration**
        3. **Office Click to Run**
      2. If Windows Autopatch determines that one of these workloads isn’t enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not registered** tab.
| | **Step 5: Calculate deployment ring assignment** | Once the device passes all prerequisites described in **step #4**, Windows Autopatch starts its deployment ring assignment calculation. The following logic is used to calculate the Windows Autopatch deployment ring assignment:
  1. If the Windows Autopatch tenant’s existing managed device size is **≤ 200**, the deployment ring assignment is **First (5%)**, **Fast (15%)**, remaining devices go to the **Broad ring (80%)**.
  2. If the Windows Autopatch tenant’s existing managed device size is **>200**, the deployment ring assignment will be **First (1%)**, **Fast (9%)**, remaining devices go to the **Broad ring (90%)**.
| -| **Step 6: Assign devices to a deployment ring group** | Once the deployment ring calculation is done, Windows Autopatch assigns devices to two deployment ring sets, the first one being the service-based deployment ring set represented by the following Azure AD groups:
  1. **Modern Workplace Devices-Windows Autopatch-First**
    1. The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Azure AD group (**Modern Workplace Devices-Windows Autopatch-Test**). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.
  2. **Modern Workplace Devices-Windows Autopatch-Fast**
  3. **Modern Workplace Devices-Windows Autopatch-Broad**
    4. Then the second deployment ring set, the software updates-based deployment ring set represented by the following Azure AD groups:
    • **Windows Autopatch - Ring1**
      • The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Azure AD groups (**Windows Autopatch - Test**). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.
    • **Windows Autopatch - Ring2**
      • **Windows Autopatch - Ring3**
| -| **Step 7: Assign devices to an Azure AD group** | Windows Autopatch also assigns devices to the following Azure AD groups when certain conditions apply:
  1. **Modern Workplace Devices - All**
    1. This group has all devices managed by Windows Autopatch.
  2. **Modern Workplace Devices - Virtual Machine**
    1. This group has all **virtual devices** managed by Windows Autopatch.
    | -| **Step 8: Post-device registration** | In post-device registration, three actions occur:
    1. Windows Autopatch adds devices to its managed database.
    2. Flags devices as **Active** in the **Registered** tab.
    3. The Azure AD device ID of the device successfully registered is added into the Microsoft Cloud Managed Desktop Extension’s allowlist. Windows Autopatch installs the Microsoft Cloud Managed Desktop Extension agent once devices are registered, so the agent can communicate back to the Microsoft Cloud Managed Desktop Extension service.
      1. The agent is the **Modern Workplace - Autopatch Client setup** PowerShell script that was created during the Windows Autopatch tenant enrollment process. The script is executed once devices are successfully registered into the Windows Autopatch service.
      | +| **Step 6: Assign devices to a deployment ring group** | Once the deployment ring calculation is done, Windows Autopatch assigns devices to two deployment ring sets, the first one being the service-based deployment ring set represented by the following Microsoft Entra groups:
      1. **Modern Workplace Devices-Windows Autopatch-First**
        1. The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Microsoft Entra group (**Modern Workplace Devices-Windows Autopatch-Test**). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.
      2. **Modern Workplace Devices-Windows Autopatch-Fast**
      3. **Modern Workplace Devices-Windows Autopatch-Broad**
        4. Then the second deployment ring set, the software updates-based deployment ring set represented by the following Microsoft Entra groups:
        • **Windows Autopatch - Ring1**
          • The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Microsoft Entra groups (**Windows Autopatch - Test**). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.
        • **Windows Autopatch - Ring2**
          • **Windows Autopatch - Ring3**
      | +| **Step 7: Assign devices to a Microsoft Entra group** | Windows Autopatch also assigns devices to the following Microsoft Entra groups when certain conditions apply:
      1. **Modern Workplace Devices - All**
        1. This group has all devices managed by Windows Autopatch.
      2. **Modern Workplace Devices - Virtual Machine**
        1. This group has all **virtual devices** managed by Windows Autopatch.
        | +| **Step 8: Post-device registration** | In post-device registration, three actions occur:
        1. Windows Autopatch adds devices to its managed database.
        2. Flags devices as **Active** in the **Registered** tab.
        3. The Microsoft Entra device ID of the device successfully registered is added into the Microsoft Cloud Managed Desktop Extension’s allowlist. Windows Autopatch installs the Microsoft Cloud Managed Desktop Extension agent once devices are registered, so the agent can communicate back to the Microsoft Cloud Managed Desktop Extension service.
          1. The agent is the **Modern Workplace - Autopatch Client setup** PowerShell script that was created during the Windows Autopatch tenant enrollment process. The script is executed once devices are successfully registered into the Windows Autopatch service.
          | | **Step 9: Review device registration status** | IT admins review the device registration status in both the **Registered** and **Not registered** tabs.
          1. If the device was **successfully registered**, the device shows up in the **Registered** tab.
          2. If **not**, the device shows up in the **Not registered** tab.
          | | **Step 10: End of registration workflow** | This is the end of the Windows Autopatch device registration workflow. | @@ -69,7 +69,7 @@ During the tenant enrollment process, Windows Autopatch creates two different - [Service-based deployment ring set](../deploy/windows-autopatch-groups-overview.md#service-based-deployment-rings) - [Software update-based deployment ring set](../deploy/windows-autopatch-groups-overview.md#software-based-deployment-rings) -The following four Azure AD assigned groups are used to organize devices for the service-based deployment ring set: +The following four Microsoft Entra ID assigned groups are used to organize devices for the service-based deployment ring set: | Service-based deployment ring | Description | | ----- | ----- | @@ -78,7 +78,7 @@ The following four Azure AD assigned groups are used to organize devices for the | Modern Workplace Devices-Windows Autopatch-Fast | Fast deployment ring for quick rollout and adoption | | Modern Workplace Devices-Windows Autopatch-Broad | Final deployment ring for broad rollout into the organization | -The five Azure AD assigned groups that are used to organize devices for the software update-based deployment ring set within the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#default-deployment-ring-composition): +The five Microsoft Entra ID assigned groups that are used to organize devices for the software update-based deployment ring set within the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#default-deployment-ring-composition): | Software updates-based deployment ring | Description | | ----- | ----- | @@ -158,7 +158,7 @@ If you want to move devices to different deployment rings (either service or sof If you don't see the Ring assigned by column change to **Pending** in Step 5, check to see whether the device exists in Microsoft Intune or not by searching for it in its device blade. For more information, see [Device details in Intune](/mem/intune/remote-actions/device-inventory). > [!WARNING] -> Moving devices between deployment rings through directly changing Azure AD group membership isn't supported and may cause unintended configuration conflicts within the Windows Autopatch service. To avoid service interruption to devices, use the **Assign device to ring** action described previously to move devices between deployment rings. +> Moving devices between deployment rings through directly changing Microsoft Entra group membership isn't supported and may cause unintended configuration conflicts within the Windows Autopatch service. To avoid service interruption to devices, use the **Assign device to ring** action described previously to move devices between deployment rings. ## Automated deployment ring remediation functions diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md index 18ff0f2a4a..93aeb12df6 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md @@ -19,7 +19,7 @@ ms.collection: Autopatch groups help Microsoft Cloud-Managed services meet organizations where they are in their update management journey. -Autopatch groups is a logical container or unit that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates policy for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates). +Autopatch groups is a logical container or unit that groups several [Microsoft Entra groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates policy for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates). ## Autopatch groups prerequisites @@ -36,7 +36,7 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr - Windows Autopatch – DSS Policy [First] - Windows Autopatch – DSS Policy [Fast] - Windows Autopatch – DSS Policy [Broad] -- Ensure the following Azure AD assigned groups are in your tenant before using Autopatch groups. **Don’t** modify the Azure AD group membership types (Assigned or Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups and causes the Autopatch groups feature and other service-related operations to not work properly. +- Ensure the following Microsoft Entra ID assigned groups are in your tenant before using Autopatch groups. **Don’t** modify the Microsoft Entra group membership types (Assigned or Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups and causes the Autopatch groups feature and other service-related operations to not work properly. - Modern Workplace Devices-Windows Autopatch-Test - Modern Workplace Devices-Windows Autopatch-First - Modern Workplace Devices-Windows Autopatch-Fast @@ -46,14 +46,14 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr - Windows Autopatch – Ring2 - Windows Autopatch – Ring3 - Windows Autopatch – Last -- Additionally, **don't** modify the Azure AD group ownership of any of the groups above otherwise, Autopatch groups device registration process won't be able to add devices into these groups. If the ownership is modified, you must add the **Modern Workplace Management** Service Principal as the owner of these groups. - - For more information, see [assign an owner or member of a group in Azure AD](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group) for steps on how to add owners to Azure Azure AD groups. +- Additionally, **don't** modify the Microsoft Entra group ownership of any of the groups above otherwise, Autopatch groups device registration process won't be able to add devices into these groups. If the ownership is modified, you must add the **Modern Workplace Management** Service Principal as the owner of these groups. + - For more information, see [assign an owner or member of a group in Microsoft Entra ID](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group) for steps on how to add owners to Azure Microsoft Entra groups. - Make sure you have [app-only auth turned on in your Windows Autopatch tenant](../operate/windows-autopatch-maintain-environment.md#windows-autopatch-tenant-actions). Otherwise, the Autopatch groups functionality won’t work properly. Autopatch uses app-only auth to: - Read device attributes to successfully register devices. - Manage all configurations related to the operation of the service. -- Make sure that all device-based Azure AD groups you intend to use with Autopatch groups are created prior to using the feature. - - Review your existing Azure AD group dynamic queries and direct device memberships to avoid having device membership overlaps in between device-based Azure AD groups that are going to be used with Autopatch groups. This can help prevent device conflicts within an Autopatch group or across several Autopatch groups. **Autopatch groups doesn't support user-based Azure AD groups**. -- Ensure devices used with your existing Azure AD groups meet [device registration prerequisite checks](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) when being registered with the service. Autopatch groups register devices on your behalf, and devices can be moved to **Registered** or **Not registered** tabs in the Devices blade accordingly. +- Make sure that all device-based Microsoft Entra groups you intend to use with Autopatch groups are created prior to using the feature. + - Review your existing Microsoft Entra group dynamic queries and direct device memberships to avoid having device membership overlaps in between device-based Microsoft Entra groups that are going to be used with Autopatch groups. This can help prevent device conflicts within an Autopatch group or across several Autopatch groups. **Autopatch groups doesn't support user-based Microsoft Entra groups**. +- Ensure devices used with your existing Microsoft Entra groups meet [device registration prerequisite checks](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) when being registered with the service. Autopatch groups register devices on your behalf, and devices can be moved to **Registered** or **Not registered** tabs in the Devices blade accordingly. > [!TIP] > [Update rings](/mem/intune/protect/windows-10-update-rings) and [feature updates](/mem/intune/protect/windows-10-feature-updates) for Windows 10 and later policies that are created and managed by Windows Autopatch can be restored using the [Policy health](../operate/windows-autopatch-policy-health-and-remediation.md) feature. For more information on remediation actions, see [restore Windows update policies](../operate/windows-autopatch-policy-health-and-remediation.md#restore-windows-update-policies). @@ -73,12 +73,12 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr 1. In **Basics** page, enter a **name** and a **description** then select **Next: Deployment rings**. 1. Enter up to 64 characters for the Autopatch group name and 150 characters maximum for the description. The Autopatch group name is appended to both the update rings and the DSS policy names that get created once the Custom Autopatch group is created. 1. In **Deployment rings** page, select **Add deployment ring** to add the number of deployment rings to the Custom Autopatch group. -1. Each new deployment ring added must have either an Azure AD device group assigned to it, or an Azure AD group that is dynamically distributed across your deployments rings using defined percentages. - 1. In the **Dynamic groups** area, select **Add groups** to select one or more existing device-based Azure AD groups to be used for Dynamic group distribution. +1. Each new deployment ring added must have either a Microsoft Entra device group assigned to it, or a Microsoft Entra group that is dynamically distributed across your deployments rings using defined percentages. + 1. In the **Dynamic groups** area, select **Add groups** to select one or more existing device-based Microsoft Entra groups to be used for Dynamic group distribution. 1. In the **Dynamic group distribution** column, select the desired deployment ring checkbox. Then, either: - 1. Enter the percentage of devices that should be added from the Azure AD groups selected in step 9. The percentage calculation for devices must equal to 100%, or + 1. Enter the percentage of devices that should be added from the Microsoft Entra groups selected in step 9. The percentage calculation for devices must equal to 100%, or 1. Select **Apply default dynamic group distribution** to use the default values. -1. In the **Assigned group** column, select **Add group to ring** to add an existing Azure AD group to any of the defined deployment rings. The **Test** and **Last** deployment rings only support Assigned group distribution. These deployment rings don't support Dynamic distribution. +1. In the **Assigned group** column, select **Add group to ring** to add an existing Microsoft Entra group to any of the defined deployment rings. The **Test** and **Last** deployment rings only support Assigned group distribution. These deployment rings don't support Dynamic distribution. 1. Select **Next: Windows Update settings**. 1. Select the **horizontal ellipses (…)** > **Manage deployment cadence** to [customize your gradual rollout of Windows quality and feature updates](../operate/windows-autopatch-windows-update.md). Select **Save**. 1. Select the **horizontal ellipses (…)** > **Manage notifications** to customize the end-user experience when receiving Windows updates. Select **Save**. @@ -86,10 +86,10 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr 1. Once the review is done, select **Create** to save your custom Autopatch group. > [!CAUTION] -> A device-based Azure AD group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Azure AD group that’s been already used, you'll receive an error that prevents you from finish creating or editing the Autopatch group (Default or Custom). +> A device-based Microsoft Entra group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Microsoft Entra group that’s been already used, you'll receive an error that prevents you from finish creating or editing the Autopatch group (Default or Custom). > [!IMPORTANT] -> Windows Autopatch creates the device-based Azure AD assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience. +> Windows Autopatch creates the device-based Microsoft Entra ID assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience. ## Edit the Default or a Custom Autopatch group @@ -107,7 +107,7 @@ Before you start managing Autopatch groups, ensure you’ve met the following pr 1. Once the review is done, select **Save** to finish editing the Autopatch group. > [!IMPORTANT] -> Windows Autopatch creates the device-based Azure AD assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience. +> Windows Autopatch creates the device-based Microsoft Entra ID assigned groups based on the choices made in the deployment ring composition page. Additionally, the service assigns the update ring policies for each deployment ring created in the Autopatch group based on the choices made in the Windows Update settings page as part of the Autopatch group guided end-user experience. ## Rename a Custom Autopatch group @@ -119,7 +119,7 @@ You **can’t** rename the Default Autopatch group. However, you can rename a Cu 1. In the **New Autopatch group name**, enter the new Autopatch group name of your choice, then click **Rename group**. > [!IMPORTANT] -> Autopatch supports up to 64 characters for the custom Autopatch group name. Additionally, when you rename a custom Autopatch group all [update rings for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-update-rings) and [feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates) associated with the custom Autopatch group are renamed to include the new Autopatch group name you define in its name string. Also, when renaming a custom Autopatch group all Azure AD groups representing the custom Autopatch group's deployment rings are renamed to include the new Autopatch group name you define in its name string. +> Autopatch supports up to 64 characters for the custom Autopatch group name. Additionally, when you rename a custom Autopatch group all [update rings for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-update-rings) and [feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates) associated with the custom Autopatch group are renamed to include the new Autopatch group name you define in its name string. Also, when renaming a custom Autopatch group all Microsoft Entra groups representing the custom Autopatch group's deployment rings are renamed to include the new Autopatch group name you define in its name string. ## Delete a Custom Autopatch group @@ -135,12 +135,12 @@ You **can’t** delete the Default Autopatch group. However, you can delete a Cu ## Manage device conflict scenarios when using Autopatch groups -Overlap in device membership is a common scenario when working with device-based Azure AD groups since sometimes dynamic queries can be large in scope or the same assigned device membership can be used across different Azure AD groups. +Overlap in device membership is a common scenario when working with device-based Microsoft Entra groups since sometimes dynamic queries can be large in scope or the same assigned device membership can be used across different Microsoft Entra groups. -Since Autopatch groups allow you to use your existing Azure AD groups to create your own deployment ring composition, the service takes on the responsibility of monitoring and automatically solving some of the device conflict scenarios that may occur. +Since Autopatch groups allow you to use your existing Microsoft Entra groups to create your own deployment ring composition, the service takes on the responsibility of monitoring and automatically solving some of the device conflict scenarios that may occur. > [!CAUTION] -> A device-based Azure AD group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Azure AD group that’s been already used, you'll receive an error that prevents you from creating or editing the Autopatch group (Default or Custom). +> A device-based Microsoft Entra group can only be used with one deployment ring in an Autopatch group at a time. This applies to deployment rings within the same Autopatch group and across different deployment rings across different Autopatch groups. If you try to create or edit an Autopatch group to use a device-based Microsoft Entra group that’s been already used, you'll receive an error that prevents you from creating or editing the Autopatch group (Default or Custom). ### Device conflict in deployment rings within an Autopatch group @@ -172,11 +172,11 @@ Device conflict across different deployment rings in different Autopatch groups #### Device conflict prior to device registration -When you create or edit the Custom or Default Autopatch group, Windows Autopatch checks if the devices that are part of the Azure AD groups, used in Autopatch groups’ deployment rings, are registered with the service. +When you create or edit the Custom or Default Autopatch group, Windows Autopatch checks if the devices that are part of the Microsoft Entra groups, used in Autopatch groups’ deployment rings, are registered with the service. | Conflict scenario | Conflict resolution | | ----- | ----- | -| Devices are in the Custom-to-Custom Autopatch group device conflict scenario | You must resolve this conflict.

          Devices will fail to register with the service and will be sent to the **Not registered** tab. You’re required to make sure the Azure AD groups that are used with the Custom Autopatch groups don’t have device membership overlaps.

          | +| Devices are in the Custom-to-Custom Autopatch group device conflict scenario | You must resolve this conflict.

          Devices will fail to register with the service and will be sent to the **Not registered** tab. You’re required to make sure the Microsoft Entra groups that are used with the Custom Autopatch groups don’t have device membership overlaps.

          | #### Device conflict post device registration diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md index a706404138..b482faa489 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md @@ -21,7 +21,7 @@ As organizations move to a managed-service model where Microsoft manages update ## What are Windows Autopatch groups? -Autopatch groups is a logical container or unit that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates). +Autopatch groups is a logical container or unit that groups several [Microsoft Entra groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) and [feature updates for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates). ## Key benefits @@ -29,9 +29,9 @@ Autopatch groups help Microsoft Cloud-Managed services meet organizations where | Benefit | Description | | ----- | ----- | -| Replicating your organizational structure | You can set up Autopatch groups to replicate your organizational structures represented by your existing device-based Azure AD group targeting logic. | +| Replicating your organizational structure | You can set up Autopatch groups to replicate your organizational structures represented by your existing device-based Microsoft Entra group targeting logic. | | Having a flexible number of deployments | Autopatch groups give you the flexibility of having the right number of deployment rings that work within your organization. You can set up to 15 deployment rings per Autopatch group. | -| Deciding which device(s) belong to deployment rings | Along with using your existing device-based Azure AD groups and choosing the number of deployment rings, you can also decide which devices belong to deployment rings during the device registration process when setting up Autopatch groups. | +| Deciding which device(s) belong to deployment rings | Along with using your existing device-based Microsoft Entra groups and choosing the number of deployment rings, you can also decide which devices belong to deployment rings during the device registration process when setting up Autopatch groups. | | Choosing the deployment cadence | You choose the right software update deployment cadence for your business. | ## High-level architecture diagram overview @@ -43,8 +43,8 @@ Autopatch groups is a function app that is part of the device registration micro | Step | Description | | ----- | ----- | | Step 1: Create an Autopatch group | Create an Autopatch group. | -| Step 2: Windows Autopatch uses Microsoft Graph to create Azure AD and policy assignments | Windows Autopatch service uses Microsoft Graph to coordinate the creation of:
          • Azure AD groups
          • Software update policy assignments with other Microsoft services, such as Azure AD, Intune, and Windows Update for Business (WUfB) based on IT admin choices when you create or edit an Autopatch group.
          | -| Step 3: Intune assigns software update policies | Once Azure AD groups are created in the Azure AD service, Intune is used to assign the software update policies to these groups and provide the number of devices that need the software update policies to the Windows Update for Business (WUfB) service. | +| Step 2: Windows Autopatch uses Microsoft Graph to create Microsoft Entra ID and policy assignments | Windows Autopatch service uses Microsoft Graph to coordinate the creation of:
          • Microsoft Entra groups
          • Software update policy assignments with other Microsoft services, such as Microsoft Entra ID, Intune, and Windows Update for Business (WUfB) based on IT admin choices when you create or edit an Autopatch group.
          | +| Step 3: Intune assigns software update policies | Once Microsoft Entra groups are created in the Microsoft Entra service, Intune is used to assign the software update policies to these groups and provide the number of devices that need the software update policies to the Windows Update for Business (WUfB) service. | | Step 4: Windows Update for Business responsibilities | Windows Update for Business (WUfB) is the service responsible for:
          • Delivering those update policies
          • Retrieving update deployment statuses back from devices
          • Sending back the status information to Microsoft Intune, and then to the Windows Autopatch service
          | ## Key concepts @@ -70,7 +70,7 @@ The Default Autopatch group **can’t** be deleted or renamed. However, you can #### Default deployment ring composition -By default, the following [software update-based deployment rings](#software-based-deployment-rings), represented by Azure AD assigned groups, are used: +By default, the following [software update-based deployment rings](#software-based-deployment-rings), represented by Microsoft Entra ID assigned groups, are used: - Windows Autopatch – Test - Windows Autopatch – Ring1 @@ -84,7 +84,7 @@ By default, the following [software update-based deployment rings](#software-bas > For more information about the differences between **Assigned** and **Dynamic** deployment ring distribution types, see [about deployment rings](#about-deployment-rings). Only deployment rings that are placed in between the **Test** and the **Last** deployment rings can be used with the **Dynamic** deployment ring distributions. > [!CAUTION] -> These and other Azure AD assigned groups created by Autopatch groups **can't** be missing in your tenant, otherwise, Autopatch groups might not function properly. +> These and other Microsoft Entra ID assigned groups created by Autopatch groups **can't** be missing in your tenant, otherwise, Autopatch groups might not function properly. The **Last** deployment ring, the fifth deployment ring in the Default Autopatch group, is intended to provide coverage for scenarios where a group of specialized devices and/or VIP/Executive users. They must receive software update deployments after the organization’s general population to mitigate disruptions to your organization’s critical businesses. @@ -96,7 +96,7 @@ The Default Autopatch group provides a default update deployment cadence for its Autopatch groups set up the [Update rings policy for Windows 10 and later](/mem/intune/protect/windows-10-update-rings) for each of its deployment rings in the Default Autopatch group. See the following default policy values: -| Policy name | Azure AD group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline | +| Policy name | Microsoft Entra group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline | | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | | Windows Autopatch Update Policy - default - Test | Windows Autopatch - Test | 0 | 0 | 30 | 0 | 5 | 0 | Yes | | Windows Autopatch Update Policy - default - Ring1 | Windows Autopatch - Ring1 | 1 | 0 | 30 | 2 | 5 |2 | Yes | @@ -108,7 +108,7 @@ Autopatch groups set up the [Update rings policy for Windows 10 and later](/mem/ Autopatch groups set up the [feature updates for Windows 10 and later policies](/mem/intune/protect/windows-10-feature-updates) for each of its deployment rings in the Default Autopatch group, see the following default policy values: -| Policy name | Azure AD group assignment |Feature update version | Rollout options | First deployment ring availability | Final deployment ring availability | Day between deployment rings | Support end date | +| Policy name | Microsoft Entra group assignment |Feature update version | Rollout options | First deployment ring availability | Final deployment ring availability | Day between deployment rings | Support end date | | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | | Windows Autopatch - DSS Policy [Test] | Windows Autopatch - Test | Windows 10 21H2 | Make update available as soon as possible | N/A | N/A | N/A | June 11, 2024; 1:00AM | | Windows Autopatch - DSS Policy [Ring1] | Windows Autopatch - Ring1 | Windows 10 21H2 | Make update available as soon as possible | N/A | N/A | N/A | June 11, 2024; 1:00AM | @@ -129,12 +129,12 @@ By default, a Custom Autopatch group has the Test and Last deployment rings auto Deployment rings make it possible for an Autopatch group to have software update deployments sequentially delivered in a gradual rollout within the Autopatch group. -Windows Autopatch aligns with Azure AD and Intune terminology for device group management. There are two types of deployment ring group distribution in Autopatch groups: +Windows Autopatch aligns with Microsoft Entra ID and Intune terminology for device group management. There are two types of deployment ring group distribution in Autopatch groups: | Deployment ring distribution | Description | | ----- | ----- | -| Dynamic | You can use one or more device-based Azure AD groups, either dynamic query-based or assigned to use in your deployment ring composition.

          Azure AD groups that are used with the Dynamic distribution type can be used to distribute devices across several deployment rings based on percentage values that can be customized.

          | -| Assigned | You can use one single device-based Azure AD group, either dynamic query-based, or assigned to use in your deployment ring composition. | +| Dynamic | You can use one or more device-based Microsoft Entra groups, either dynamic query-based or assigned to use in your deployment ring composition.

          Microsoft Entra groups that are used with the Dynamic distribution type can be used to distribute devices across several deployment rings based on percentage values that can be customized.

          | +| Assigned | You can use one single device-based Microsoft Entra group, either dynamic query-based, or assigned to use in your deployment ring composition. | | Combination of Dynamic and Assigned | To provide a greater level of flexibility when working on deployment ring compositions, you can combine both device distribution types in Autopatch groups.

          The combination of Dynamic and Assigned device distribution is **not** supported for the Test and Last deployment ring in Autopatch groups.

          | #### About the Test and Last deployment rings @@ -147,7 +147,7 @@ If you only keep Test and Last deployment rings in your Default Autopatch group, > Both the **Test** and **Last** deployment rings **can't** be removed or renamed from the Default or Custom Autopatch groups. Autopatch groups don't support the use of one single deployment ring as part of its deployment ring composition because you need at least two deployment rings for their gradual rollout. If you must implement a specific scenario with a single deployment ring, and gradual rollout isn’t required, consider managing these devices outside Windows Autopatch. > [!TIP] -> Both the **Test** and **Last** deployment rings only support one single Azure AD group assignment at a time. If you need to assign more than one Azure AD group, you can nest the other Azure AD groups under the ones you plan to use with the **Test** and **Last** deployment rings. Only one level of Azure AD group nesting is supported. +> Both the **Test** and **Last** deployment rings only support one single Microsoft Entra group assignment at a time. If you need to assign more than one Microsoft Entra group, you can nest the other Microsoft Entra groups under the ones you plan to use with the **Test** and **Last** deployment rings. Only one level of Microsoft Entra group nesting is supported. #### Service-based versus software update-based deployment rings @@ -160,7 +160,7 @@ Autopatch groups creates two different layers. Each layer contains its own deplo The service-based deployment ring set is exclusively used to keep Windows Autopatch updated with both service and device-level configuration policies, apps and APIs needed for core functions of the service. -The following are the Azure AD assigned groups that represent the service-based deployment rings. These groups can't be deleted or renamed: +The following are the Microsoft Entra ID assigned groups that represent the service-based deployment rings. These groups can't be deleted or renamed: - Modern Workplace Devices-Windows Autopatch-Test - Modern Workplace Devices-Windows Autopatch-First @@ -168,13 +168,13 @@ The following are the Azure AD assigned groups that represent the service-based - Modern Workplace Devices-Windows Autopatch-Broad > [!CAUTION] -> **Don’t** modify the Azure AD group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly.

          Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Azure AD group created by Autopatch groups.

          +> **Don’t** modify the Microsoft Entra group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly.

          Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Microsoft Entra group created by Autopatch groups.

          ##### Software-based deployment rings The software-based deployment ring set is exclusively used with software update management policies, such as the Windows update ring and feature update policies, in the Default Windows Autopatch group. -The following are the Azure AD assigned groups that represent the software updates-based deployment rings. These groups can't be deleted or renamed: +The following are the Microsoft Entra ID assigned groups that represent the software updates-based deployment rings. These groups can't be deleted or renamed: - Windows Autopatch - Test - Windows Autopatch – Ring1 @@ -183,14 +183,14 @@ The following are the Azure AD assigned groups that represent the software updat - Windows Autopatch – Last > [!IMPORTANT] -> Additional Azure AD assigned groups are created and added to list when you add more deployment rings to the Default Autopatch group. +> Additional Microsoft Entra ID assigned groups are created and added to list when you add more deployment rings to the Default Autopatch group. > [!CAUTION] -> **Don’t** modify the Azure AD group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly.

          Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Azure AD group created by Autopatch groups.

          +> **Don’t** modify the Microsoft Entra group membership types (Assigned and Dynamic). Otherwise, the Windows Autopatch service won’t be able to read the device group membership from these groups, and causes the Autopatch groups feature and other service-related operations to not work properly.

          Additionally, it's **not** supported to have Configuration Manager collections directly synced to any Microsoft Entra group created by Autopatch groups.

          ### About device registration -Autopatch groups register devices with the Windows Autopatch service when you either [create](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) or [edit a Custom Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group), and/or when you [edit the Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to use your existing Azure AD groups instead of the Windows Autopatch Device Registration group provided by the service. +Autopatch groups register devices with the Windows Autopatch service when you either [create](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) or [edit a Custom Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group), and/or when you [edit the Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to use your existing Microsoft Entra groups instead of the Windows Autopatch Device Registration group provided by the service. ## Common ways to use Autopatch groups diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index a2734bb584..4cb39e3d34 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -31,44 +31,48 @@ Windows Autopatch can take over software update management control of devices th ### Windows Autopatch groups device registration -When you either create/edit a [Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups) or edit the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) to add or remove deployment rings, the device-based Azure AD groups you use when setting up your deployment rings are scanned to see if devices need to be registered with the Windows Autopatch service. +When you either create/edit a [Custom Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups) or edit the [Default Autopatch group](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group) to add or remove deployment rings, the device-based Microsoft Entra groups you use when setting up your deployment rings are scanned to see if devices need to be registered with the Windows Autopatch service. -If devices aren’t registered, Autopatch groups starts the device registration process by using your existing device-based Azure AD groups instead of the Windows Autopatch Device Registration group. +If devices aren’t registered, Autopatch groups starts the device registration process by using your existing device-based Microsoft Entra groups instead of the Windows Autopatch Device Registration group. For more information, see [create Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) and [edit Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to register devices using the Autopatch groups device registration method. -#### Supported scenarios when nesting other Azure AD groups + -Windows Autopatch also supports the following Azure AD nested group scenarios: +#### Supported scenarios when nesting other Microsoft Entra groups -Azure AD groups synced up from: +Windows Autopatch also supports the following Microsoft Entra nested group scenarios: + +Microsoft Entra groups synced up from: - On-premises Active Directory groups (Windows Server AD) - [Configuration Manager collections](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_aadcollsync) > [!WARNING] -> It isn't recommended to sync Configuration Manager collections straight to the **Windows Autopatch Device Registration** Azure AD group. Use a different Azure AD group when syncing Configuration Manager collections to Azure AD groups then you can nest this or these groups into the **Windows Autopatch Device Registration** Azure AD group. +> It isn't recommended to sync Configuration Manager collections straight to the **Windows Autopatch Device Registration** Microsoft Entra group. Use a different Microsoft Entra group when syncing Configuration Manager collections to Microsoft Entra groups then you can nest this or these groups into the **Windows Autopatch Device Registration** Microsoft Entra group. > [!IMPORTANT] -> The **Windows Autopatch Device Registration** Azure AD group only supports **one level** of Azure AD nested groups. +> The **Windows Autopatch Device Registration** Microsoft Entra group only supports **one level** of Microsoft Entra nested groups. -### Clean up dual state of Hybrid Azure AD joined and Azure registered devices in your Azure AD tenant + -An [Azure AD dual state](/azure/active-directory/devices/hybrid-azuread-join-plan#handling-devices-with-azure-ad-registered-state) occurs when a device is initially connected to Azure AD as an [Azure AD Registered](/azure/active-directory/devices/concept-azure-ad-register) device. However, when you enable Hybrid Azure AD join, the same device is connected twice to Azure AD but as a [Hybrid Azure AD device](/azure/active-directory/devices/concept-azure-ad-join-hybrid). +### Clean up dual state of Microsoft Entra hybrid joined and Azure registered devices in your Microsoft Entra tenant -In the dual state, you end up having two Azure AD device records with different join types for the same device. In this case, the Hybrid Azure AD device record takes precedence over the Azure AD registered device record for any type of authentication in Azure AD, which makes the Azure AD registered device record stale. +An [Microsoft Entra dual state](/azure/active-directory/devices/hybrid-azuread-join-plan#handling-devices-with-azure-ad-registered-state) occurs when a device is initially connected to Microsoft Entra ID as an [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) device. However, when you enable Microsoft Entra hybrid join, the same device is connected twice to Microsoft Entra ID but as a [Hybrid Microsoft Entra device](/azure/active-directory/devices/concept-azure-ad-join-hybrid). -It's recommended to detect and clean up stale devices in Azure AD before registering devices with Windows Autopatch, see [How To: Manage state devices in Azure AD](/azure/active-directory/devices/manage-stale-devices). +In the dual state, you end up having two Microsoft Entra device records with different join types for the same device. In this case, the Hybrid Microsoft Entra device record takes precedence over the Microsoft Entra registered device record for any type of authentication in Microsoft Entra ID, which makes the Microsoft Entra registered device record stale. + +It's recommended to detect and clean up stale devices in Microsoft Entra ID before registering devices with Windows Autopatch, see [How To: Manage state devices in Microsoft Entra ID](/azure/active-directory/devices/manage-stale-devices). > [!WARNING] -> If you don't clean up stale devices in Azure AD before registering devices with Windows Autopatch, you might end up seeing devices failing to meet the **Intune or Cloud-Attached (Device must be either Intune-managed or Co-managed)** pre-requisite check in the **Not ready** tab because it's expected that these stale Azure AD devices aren't enrolled into the Intune service anymore. +> If you don't clean up stale devices in Microsoft Entra ID before registering devices with Windows Autopatch, you might end up seeing devices failing to meet the **Intune or Cloud-Attached (Device must be either Intune-managed or Co-managed)** pre-requisite check in the **Not ready** tab because it's expected that these stale Microsoft Entra devices aren't enrolled into the Intune service anymore. ## Prerequisites for device registration To be eligible for Windows Autopatch management, devices must meet a minimum set of required software-based prerequisites: - Windows 10 (1809+)/11 Enterprise or Professional editions (only x64 architecture). -- Either [Hybrid Azure AD-Joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or [Azure AD-joined only](/azure/active-directory/devices/concept-azure-ad-join-hybrid) (personal devices aren't supported). +- Either [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or [Microsoft Entra joined only](/azure/active-directory/devices/concept-azure-ad-join-hybrid) (personal devices aren't supported). - Managed by Microsoft Intune. - [Already enrolled into Microsoft Intune](/mem/intune/user-help/enroll-windows-10-device) and/or [Configuration Manager co-management](/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites#configuration-manager-co-management-requirements). - Must switch the following Microsoft Configuration Manager [co-management workloads](/mem/configmgr/comanage/how-to-switch-workloads) to Microsoft Intune (either set to Pilot Intune or Intune): @@ -114,20 +118,20 @@ The following are the possible device readiness statuses in Windows Autopatch: A role defines the set of permissions granted to users assigned to that role. You can use one of the following built-in roles in Windows Autopatch to register devices: -- Azure AD Global Administrator +- Microsoft Entra Global Administrator - Intune Service Administrator -For more information, see [Azure AD built-in roles](/azure/active-directory/roles/permissions-reference) and [Role-based access control (RBAC) with Microsoft Intune](/mem/intune/fundamentals/role-based-access-control). +For more information, see [Microsoft Entra built-in roles](/azure/active-directory/roles/permissions-reference) and [Role-based access control (RBAC) with Microsoft Intune](/mem/intune/fundamentals/role-based-access-control). -If you want to assign less-privileged user accounts to perform specific tasks in the Windows Autopatch portal, such as register devices with the service, you can add these user accounts into one of the two Azure AD groups created during the [tenant enrollment](../prepare/windows-autopatch-enroll-tenant.md) process: +If you want to assign less-privileged user accounts to perform specific tasks in the Windows Autopatch portal, such as register devices with the service, you can add these user accounts into one of the two Microsoft Entra groups created during the [tenant enrollment](../prepare/windows-autopatch-enroll-tenant.md) process: -| Azure AD Group name | Discover devices | Modify columns | Refresh device list | Export to .CSV | Device actions | +| Microsoft Entra group name | Discover devices | Modify columns | Refresh device list | Export to .CSV | Device actions | | ----- | ----- | ----- | ----- | ----- | ----- | | Modern Workplace Roles - Service Administrator | Yes | Yes | Yes | Yes | Yes | | Modern Workplace Roles - Service Reader | No | Yes | Yes | Yes | No | > [!TIP] -> If you're adding less-privileged user accounts into the **Modern Workplace Roles - Service Administrator** Azure AD group, it's recommended to add the same users as owners of the **Windows Autopatch Device Registration** Azure AD group. Owners of the **Windows Autopatch Device Registration** Azure AD group can add new devices as members of the group for registration purposes.

          For more information, see [assign an owner of member of a group in Azure AD](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group).

          +> If you're adding less-privileged user accounts into the **Modern Workplace Roles - Service Administrator** Microsoft Entra group, it's recommended to add the same users as owners of the **Windows Autopatch Device Registration** Microsoft Entra group. Owners of the **Windows Autopatch Device Registration** Microsoft Entra group can add new devices as members of the group for registration purposes.

          For more information, see [assign an owner of member of a group in Microsoft Entra ID](/azure/active-directory/privileged-identity-management/groups-assign-member-owner#assign-an-owner-or-member-of-a-group).

          ## Details about the device registration process @@ -206,7 +210,7 @@ There's a few more device management lifecycle scenarios to consider when planni If a device was previously registered into the Windows Autopatch service, but it needs to be reimaged, you must run one of the device provisioning processes available in Microsoft Intune to reimage the device. -The device will be rejoined to Azure AD (either Hybrid or Azure AD-only). Then, re-enrolled into Intune as well. No further action is required from you or the Windows Autopatch service, because the Azure AD device ID record of that device remains the same. +The device will be rejoined to Microsoft Entra ID (either Hybrid or Microsoft Entra-only). Then, re-enrolled into Intune as well. No further action is required from you or the Windows Autopatch service, because the Microsoft Entra device ID record of that device remains the same. ### Device repair and hardware replacement @@ -216,7 +220,7 @@ If you need to repair a device that was previously registered into the Windows A - MAC address (non-removable NICs) - OS hard drive's serial, model, manufacturer information -When one of these hardware changes occurs, Azure AD creates a new device ID record for that device, even if it's technically the same device. +When one of these hardware changes occurs, Microsoft Entra ID creates a new device ID record for that device, even if it's technically the same device. > [!IMPORTANT] -> If a new Azure AD device ID is generated for a device that was previously registered into the Windows Autopatch service, even if it's technically same device, the new Azure AD device ID must be added either through device direct membership or through nested Azure AD dynamic/assigned group into the **Windows Autopatch Device Registration** Azure AD group. This process guarantees that the newly generated Azure AD device ID is registered with Windows Autopatch and that the device continues to have its software updates managed by the service. +> If a new Microsoft Entra device ID is generated for a device that was previously registered into the Windows Autopatch service, even if it's technically same device, the new Microsoft Entra device ID must be added either through device direct membership or through nested Microsoft Entra dynamic/assigned group into the **Windows Autopatch Device Registration** Microsoft Entra group. This process guarantees that the newly generated Microsoft Entra device ID is registered with Windows Autopatch and that the device continues to have its software updates managed by the service. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md index 0f80250e80..563e6370c5 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md @@ -54,7 +54,7 @@ Alert resolutions are provided through the Windows Update service and provide th | `CancelledByUser` | User canceled the update | The Windows Update service has reported the update was canceled by the user.

          It's recommended to work with the end user to allow updates to execute as scheduled.

          | | `DamagedMedia` | The update file or hard drive is damaged | The Windows Update service has indicated the update payload might be damaged or corrupt.

          It's recommended to run `Chkdsk /F` on the device with administrator privileges, then retry the update. For more information, see [chkdsk](/windows-server/administration/windows-commands/chkdsk?tabs=event-viewer).

          | | `DeploymentConflict` | Device is in more than one deployment of the same update type. Only the first deployment assigned is effective. | The Windows Update service has reported a policy conflict.

          For more information, see the [Windows Autopatch Policy Health dashboard](../operate/windows-autopatch-policy-health-and-remediation.md).

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | -| `DeviceRegistrationInvalidAzureADDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Azure AD Device ID. | The Windows Update service has reported a device registration issue.

          For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | +| `DeviceRegistrationInvalidAzureADDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Microsoft Entra Device ID. | The Windows Update service has reported a device registration issue.

          For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | | `DeviceRegistrationInvalidGlobalDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Global Device ID. |The Windows Update service has reported that the MSA Service may be disabled preventing Global Device ID assignment.

          Check that the MSA Service is running or able to run on device.

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | | `DeviceRegistrationIssue` | The device isn't able to register or authenticate properly with Windows Update. | The Windows Update service has reported a device registration issue.

          For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | | `DeviceRegistrationNoTrustType` | The device isn't able to register or authenticate properly with Windows Update because it can't establish Trust. | The Windows Update service has reported a device registration issue.

          For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).

          If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).

          | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md index c41dd12e0c..843b7e8d3c 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-exclude-device.md @@ -16,12 +16,12 @@ ms.collection: # Exclude a device -To avoid end-user disruption, excluding a device in Windows Autopatch only deletes the Windows Autopatch device record itself. Excluding a device can't delete the Microsoft Intune and/or the Azure Active Directory device records. Microsoft assumes you'll keep managing those devices yourself in some capacity. +To avoid end-user disruption, excluding a device in Windows Autopatch only deletes the Windows Autopatch device record itself. Excluding a device can't delete the Microsoft Intune and/or the Microsoft Entra device records. Microsoft assumes you'll keep managing those devices yourself in some capacity. -When you exclude a device from the Windows Autopatch service, the device is flagged as **excluded** so Windows Autopatch doesn't try to restore the device into the service again, since the exclusion command doesn't trigger device membership removal from the **Windows Autopatch Device Registration** group, or any other Azure AD group, used with Autopatch groups. +When you exclude a device from the Windows Autopatch service, the device is flagged as **excluded** so Windows Autopatch doesn't try to restore the device into the service again, since the exclusion command doesn't trigger device membership removal from the **Windows Autopatch Device Registration** group, or any other Microsoft Entra group, used with Autopatch groups. > [!IMPORTANT] -> The Azure AD team doesn't recommend appending query statements to remove specific device from a dynamic query due to dynamic query performance issues. +> The Microsoft Entra team doesn't recommend appending query statements to remove specific device from a dynamic query due to dynamic query performance issues. **To exclude a device:** @@ -32,7 +32,7 @@ When you exclude a device from the Windows Autopatch service, the device is flag 1. Once a device or multiple devices are selected, select **Device actions**. Then, select **Exclude device**. > [!WARNING] -> Excluding devices from the Windows Autopatch Device Registration group, or any other Azure AD group, used with Autopatch groups doesn't exclude devices from the Windows Autopatch service. +> Excluding devices from the Windows Autopatch Device Registration group, or any other Microsoft Entra group, used with Autopatch groups doesn't exclude devices from the Windows Autopatch service. ## Only view excluded devices diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md index 12e39f7f30..66164cc373 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-update-management.md @@ -34,7 +34,7 @@ Keeping your devices up to date is a balance of speed and stability. Windows Aut Autopatch groups help Microsoft Cloud-Managed services meet all organizations where they are at in their update management journey. -Autopatch groups is a logical container that groups several [Azure AD groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as Windows Update rings and feature update policies, together. +Autopatch groups is a logical container that groups several [Microsoft Entra groups](/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal), and software update policies, such as Windows Update rings and feature update policies, together. For more information on key benefits and how to use Autopatch groups, see [Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md index f2522d91fa..8ffc66a28a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-overview.md @@ -64,7 +64,7 @@ Windows Autopatch’s default Windows feature update release is a service-driven > [!TIP] > Windows Autopatch allows you to [create custom Windows feature update releases](../operate/windows-autopatch-groups-manage-windows-feature-update-release.md#create-a-custom-release). -When devices are registered by manually adding them to the Windows Autopatch Device Registration Azure AD assigned group, devices are assigned to deployment rings as part of the default Autopatch group. Each deployment ring has its own Windows feature update policy assigned to them. This is intended to minimize unexpected Windows OS upgrades once new devices register with the service. +When devices are registered by manually adding them to the Windows Autopatch Device Registration Microsoft Entra ID assigned group, devices are assigned to deployment rings as part of the default Autopatch group. Each deployment ring has its own Windows feature update policy assigned to them. This is intended to minimize unexpected Windows OS upgrades once new devices register with the service. The policies: @@ -98,7 +98,7 @@ There are two scenarios that the Global release is used: | Scenario | Description | | ----- | ----- | -| Scenario #1 | You assign Azure AD groups to be used with the deployment ring (Last) or you add additional deployment rings when you customize the [Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group).

          A global Windows feature update policy is automatically assigned behind the scenes to the newly added deployment rings or when you assigned Azure AD groups to the deployment ring (Last) in the Default Autopatch group.

          | +| Scenario #1 | You assign Microsoft Entra groups to be used with the deployment ring (Last) or you add additional deployment rings when you customize the [Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group).

          A global Windows feature update policy is automatically assigned behind the scenes to the newly added deployment rings or when you assigned Microsoft Entra groups to the deployment ring (Last) in the Default Autopatch group.

          | | Scenario #2 | You create new [Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group).

          The global Windows feature policy is automatically assigned behind the scenes to all deployment rings as part of the Custom Autopatch groups you create.

          | > [!NOTE] @@ -142,7 +142,7 @@ Feature update policies work with Windows Update rings policies. Windows Update The following table details the default Windows Update rings policy values that affect either the default or custom Windows feature updates releases: -| Policy name | Azure AD group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline | +| Policy name | Microsoft Entra group assignment | Quality updates deferral in days | Feature updates deferral in days | Feature updates uninstall window in days | Deadline for quality updates in days | Deadline for feature updates in days | Grace period | Auto restart before deadline | | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | ----- | | Windows Autopatch Update Policy - default - Test | Windows Autopatch - Test | 0 | 0 | 30 | 0 | 5 | 0 | Yes | | Windows Autopatch Update Policy - default - Ring1 | Windows Autopatch - Ring1 | 1 | 0 | 30 | 2 | 5 |2 | Yes | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md index da80289277..8fe50bb86f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-feature-update-status-report.md @@ -48,7 +48,7 @@ The following information is available as optional columns in the Feature update | Column name | Description | | ----- | ----- | -| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device | +| Microsoft Entra device ID | The current Microsoft Entra ID recorded device ID for the device | | Serial number | The current Intune recorded serial number for the device | | Intune last check in time | The last time the device checked in to Intune | | Service State | The Service State provided from Windows Update | @@ -73,7 +73,7 @@ The following options are available: | Option | Description | | ----- | ----- | -| Search | Use to search by device name, Azure AD device ID or serial number | +| Search | Use to search by device name, Microsoft Entra device ID or serial number | | Sort | Select the **column headings** to sort the report data in ascending and descending order. | | Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | | Filter | Select either the **Add filters** or at the top of the report to filter the results. | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md index 703ee03554..af916925f0 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-status-report.md @@ -51,7 +51,7 @@ The following information is available as optional columns in the Quality update | Column name | Description | | ----- | ----- | -| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device | +| Microsoft Entra device ID | The current Microsoft Entra ID recorded device ID for the device | | Serial number | The current Intune recorded serial number for the device | | Intune last check in time | The last time the device checked in to Intune | | Service State | The Service State provided from Windows Update | @@ -75,7 +75,7 @@ The following options are available: | Option | Description | | ----- | ----- | -| Search | Use to search by device name, Azure AD device ID or serial number | +| Search | Use to search by device name, Microsoft Entra device ID or serial number | | Sort | Select the **column headings** to sort the report data in ascending and descending order. | | Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | | Filter | Select either the **Add filters** or at the top of the report to filter the results. | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md index cab93e35da..3b72dc6d90 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md @@ -23,13 +23,13 @@ After you've completed enrollment in Windows Autopatch, some management settings 1. If any of the items apply to your environment, make the adjustments as described. > [!NOTE] -> As your operations continue in the following months, if you make changes after enrollment to policies in Microsoft Intune, Azure Active Directory, or Microsoft 365 that affect Windows Autopatch, it's possible that Windows Autopatch could stop operating properly. To avoid problems with the service, check the specific settings described in [Fix issues found by the readiness assessment tool](../prepare/windows-autopatch-fix-issues.md) before you change the policies listed there. +> As your operations continue in the following months, if you make changes after enrollment to policies in Microsoft Intune, Microsoft Entra ID, or Microsoft 365 that affect Windows Autopatch, it's possible that Windows Autopatch could stop operating properly. To avoid problems with the service, check the specific settings described in [Fix issues found by the readiness assessment tool](../prepare/windows-autopatch-fix-issues.md) before you change the policies listed there. ## Microsoft Intune settings | Setting | Description | | ----- | ----- | -| Deployment rings for Windows 10 or later | For any deployment rings for Windows 10 or later policies you've created, exclude the **Modern Workplace Devices - All** Azure AD group from each policy. For more information, see [Create and assign deployment rings](/mem/intune/protect/windows-10-update-rings#create-and-assign-update-rings).

          Windows Autopatch creates some update ring policies. These policies have "**Modern Workplace**" in the name. For example:

          • Modern Workplace Update Policy [Broad]-[Windows Autopatch]
          • Modern Workplace Update Policy [Fast]-[Windows Autopatch]
          • Modern Workplace Update Policy [First]-[Windows Autopatch]
          • Modern Workplace Update Policy [Test]-[Windows Autopatch]

          When you update your own policies, ensure that you don't exclude the **Modern Workplace Devices - All** Azure AD group from the policies that Windows Autopatch created.

          **To resolve the Not ready result:**

          After enrolling into Autopatch, make sure that any update ring policies you have **exclude** the **Modern Workplace Devices - All** Azure Active Directory (AD) group. For more information, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure).

          **To resolve the Advisory result:**

          1. Make sure that any update ring policies you have **exclude** the **Modern Workplace Devices - All** Azure Active Directory (AD) group.
          2. If you have assigned Azure AD user groups to these policies, make sure that any update ring policies you have also **exclude** the **Modern Workplace - All** Azure AD group that you add your Windows Autopatch users to (or an equivalent group).

          For more information, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure).

          | +| Deployment rings for Windows 10 or later | For any deployment rings for Windows 10 or later policies you've created, exclude the **Modern Workplace Devices - All** Microsoft Entra group from each policy. For more information, see [Create and assign deployment rings](/mem/intune/protect/windows-10-update-rings#create-and-assign-update-rings).

          Windows Autopatch creates some update ring policies. These policies have "**Modern Workplace**" in the name. For example:

          • Modern Workplace Update Policy [Broad]-[Windows Autopatch]
          • Modern Workplace Update Policy [Fast]-[Windows Autopatch]
          • Modern Workplace Update Policy [First]-[Windows Autopatch]
          • Modern Workplace Update Policy [Test]-[Windows Autopatch]

          When you update your own policies, ensure that you don't exclude the **Modern Workplace Devices - All** Microsoft Entra group from the policies that Windows Autopatch created.

          **To resolve the Not ready result:**

          After enrolling into Autopatch, make sure that any update ring policies you have **exclude** the **Modern Workplace Devices - All** Microsoft Entra group. For more information, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure).

          **To resolve the Advisory result:**

          1. Make sure that any update ring policies you have **exclude** the **Modern Workplace Devices - All** Microsoft Entra group.
          2. If you have assigned Microsoft Entra user groups to these policies, make sure that any update ring policies you have also **exclude** the **Modern Workplace - All** Microsoft Entra group that you add your Windows Autopatch users to (or an equivalent group).

          For more information, see [Manage Windows 10 software updates in Intune](/mem/intune/protect/windows-update-for-business-configure).

          | ## Windows Autopatch configurations @@ -56,7 +56,7 @@ The type of banner that appears depends on the severity of the action. Currently | Action type | Severity | Description | | ----- | ----- | ----- | -| Maintain tenant access | Critical | Required licenses have expired. The licenses include: