diff --git a/windows/application-management/images/Createpackage.PNG b/windows/application-management/images/Createpackage.PNG deleted file mode 100644 index 4ae246a743..0000000000 Binary files a/windows/application-management/images/Createpackage.PNG and /dev/null differ diff --git a/windows/application-management/images/Installation.PNG b/windows/application-management/images/Installation.PNG deleted file mode 100644 index 9c3197ada5..0000000000 Binary files a/windows/application-management/images/Installation.PNG and /dev/null differ diff --git a/windows/application-management/images/Managefirstlaunchtasks.PNG b/windows/application-management/images/Managefirstlaunchtasks.PNG deleted file mode 100644 index edcf1a23e8..0000000000 Binary files a/windows/application-management/images/Managefirstlaunchtasks.PNG and /dev/null differ diff --git a/windows/application-management/images/PackageSupport.PNG b/windows/application-management/images/PackageSupport.PNG deleted file mode 100644 index 1bbca6865a..0000000000 Binary files a/windows/application-management/images/PackageSupport.PNG and /dev/null differ diff --git a/windows/application-management/images/Packageinfo.PNG b/windows/application-management/images/Packageinfo.PNG deleted file mode 100644 index be3b9b98dd..0000000000 Binary files a/windows/application-management/images/Packageinfo.PNG and /dev/null differ diff --git a/windows/application-management/images/Selectinstaller.PNG b/windows/application-management/images/Selectinstaller.PNG deleted file mode 100644 index 7ffd984bed..0000000000 Binary files a/windows/application-management/images/Selectinstaller.PNG and /dev/null differ diff --git a/windows/application-management/images/donemonitoring..PNG b/windows/application-management/images/donemonitoring..PNG deleted file mode 100644 index d39102b961..0000000000 Binary files a/windows/application-management/images/donemonitoring..PNG and /dev/null differ diff --git a/windows/application-management/images/preparecomputer.PNG b/windows/application-management/images/preparecomputer.PNG deleted file mode 100644 index 43b2e3e965..0000000000 Binary files a/windows/application-management/images/preparecomputer.PNG and /dev/null differ diff --git a/windows/application-management/images/preparingpackagestep.PNG b/windows/application-management/images/preparingpackagestep.PNG deleted file mode 100644 index 5b06e11d0d..0000000000 Binary files a/windows/application-management/images/preparingpackagestep.PNG and /dev/null differ diff --git a/windows/application-management/images/selectEnvironmentThiscomputer.PNG b/windows/application-management/images/selectEnvironmentThiscomputer.PNG deleted file mode 100644 index bf6f3b4bf0..0000000000 Binary files a/windows/application-management/images/selectEnvironmentThiscomputer.PNG and /dev/null differ diff --git a/windows/application-management/images/selectEnvironmentVM.PNG b/windows/application-management/images/selectEnvironmentVM.PNG deleted file mode 100644 index dd6e1f9168..0000000000 Binary files a/windows/application-management/images/selectEnvironmentVM.PNG and /dev/null differ diff --git a/windows/application-management/images/welcomescreen.PNG b/windows/application-management/images/welcomescreen.PNG deleted file mode 100644 index cd551740a8..0000000000 Binary files a/windows/application-management/images/welcomescreen.PNG and /dev/null differ diff --git a/windows/application-management/media/app-upgrade-cm-console.png b/windows/application-management/media/app-upgrade-cm-console.png deleted file mode 100644 index 2ce9cd411e..0000000000 Binary files a/windows/application-management/media/app-upgrade-cm-console.png and /dev/null differ diff --git a/windows/application-management/media/app-upgrade-no-supersedence.png b/windows/application-management/media/app-upgrade-no-supersedence.png deleted file mode 100644 index 9a9bb9bb53..0000000000 Binary files a/windows/application-management/media/app-upgrade-no-supersedence.png and /dev/null differ diff --git a/windows/application-management/media/app-upgrade-old-version.png b/windows/application-management/media/app-upgrade-old-version.png deleted file mode 100644 index e430be170e..0000000000 Binary files a/windows/application-management/media/app-upgrade-old-version.png and /dev/null differ diff --git a/windows/application-management/media/app-upgrade-supersede-deploy-type.png b/windows/application-management/media/app-upgrade-supersede-deploy-type.png deleted file mode 100644 index 24a45c5939..0000000000 Binary files a/windows/application-management/media/app-upgrade-supersede-deploy-type.png and /dev/null differ diff --git a/windows/application-management/media/icon_hyperlink.png b/windows/application-management/media/icon_hyperlink.png deleted file mode 100644 index 847e8f62ad..0000000000 Binary files a/windows/application-management/media/icon_hyperlink.png and /dev/null differ diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 4be6d524af..395cecb920 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -20,7 +20,7 @@ items: - name: Remove background task resource restrictions href: enterprise-background-activity-controls.md - name: Enable or block Windows Mixed Reality apps in the enterprise - href: manage-windows-mixed-reality.md + href: /windows/mixed-reality/enthusiast-guide/manage-windows-mixed-reality - name: Application Virtualization (App-V) items: - name: App-V for Windows overview diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index a27bb4a05a..ec40469278 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -125,7 +125,7 @@ Requirements: > [!NOTE] > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**. - > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or Azure Virtual Desktop because the Intune subscription is user centric. + > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or [Azure Virtual Desktop multi-session host pools](/mem/intune/fundamentals/azure-virtual-desktop-multi-session) because the Intune subscription is user centric. User credentials are supported for [Azure Virtual Desktop personal host pools](/mem/intune/fundamentals/azure-virtual-desktop). When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called "Schedule created by enrollment client for automatically enrolling in MDM from Azure Active Directory." diff --git a/windows/client-management/images/NPS_sidepacket_capture_data.png b/windows/client-management/images/NPS_sidepacket_capture_data.png deleted file mode 100644 index 9d43a3ebed..0000000000 Binary files a/windows/client-management/images/NPS_sidepacket_capture_data.png and /dev/null differ diff --git a/windows/client-management/images/auditfailure.png b/windows/client-management/images/auditfailure.png deleted file mode 100644 index f235ad8148..0000000000 Binary files a/windows/client-management/images/auditfailure.png and /dev/null differ diff --git a/windows/client-management/images/auditsuccess.png b/windows/client-management/images/auditsuccess.png deleted file mode 100644 index 66ce98acb1..0000000000 Binary files a/windows/client-management/images/auditsuccess.png and /dev/null differ diff --git a/windows/client-management/images/authenticator_flow_chart.png b/windows/client-management/images/authenticator_flow_chart.png deleted file mode 100644 index 729895e60e..0000000000 Binary files a/windows/client-management/images/authenticator_flow_chart.png and /dev/null differ diff --git a/windows/client-management/images/boot-sequence-thumb.png b/windows/client-management/images/boot-sequence-thumb.png deleted file mode 100644 index 164f9f9848..0000000000 Binary files a/windows/client-management/images/boot-sequence-thumb.png and /dev/null differ diff --git a/windows/client-management/images/boot-sequence.png b/windows/client-management/images/boot-sequence.png deleted file mode 100644 index 31e6dc34c9..0000000000 Binary files a/windows/client-management/images/boot-sequence.png and /dev/null differ diff --git a/windows/client-management/images/bugcheck-analysis.png b/windows/client-management/images/bugcheck-analysis.png deleted file mode 100644 index e4b4f033f8..0000000000 Binary files a/windows/client-management/images/bugcheck-analysis.png and /dev/null differ diff --git a/windows/client-management/images/capi.png b/windows/client-management/images/capi.png deleted file mode 100644 index 76bbcd0650..0000000000 Binary files a/windows/client-management/images/capi.png and /dev/null differ diff --git a/windows/client-management/images/check-disk.png b/windows/client-management/images/check-disk.png deleted file mode 100644 index 2c5859470e..0000000000 Binary files a/windows/client-management/images/check-disk.png and /dev/null differ diff --git a/windows/client-management/images/clientsidepacket_cap_data.png b/windows/client-management/images/clientsidepacket_cap_data.png deleted file mode 100644 index b162d2e285..0000000000 Binary files a/windows/client-management/images/clientsidepacket_cap_data.png and /dev/null differ diff --git a/windows/client-management/images/comparisontable.png b/windows/client-management/images/comparisontable.png deleted file mode 100644 index 0f6781d93e..0000000000 Binary files a/windows/client-management/images/comparisontable.png and /dev/null differ diff --git a/windows/client-management/images/controlset.png b/windows/client-management/images/controlset.png deleted file mode 100644 index fe9d3c8820..0000000000 Binary files a/windows/client-management/images/controlset.png and /dev/null differ diff --git a/windows/client-management/images/eappropertymenu.png b/windows/client-management/images/eappropertymenu.png deleted file mode 100644 index 127d7a7e49..0000000000 Binary files a/windows/client-management/images/eappropertymenu.png and /dev/null differ diff --git a/windows/client-management/images/etl.png b/windows/client-management/images/etl.png deleted file mode 100644 index 14a62c6450..0000000000 Binary files a/windows/client-management/images/etl.png and /dev/null differ diff --git a/windows/client-management/images/eventviewer.png b/windows/client-management/images/eventviewer.png deleted file mode 100644 index e0aa5d1721..0000000000 Binary files a/windows/client-management/images/eventviewer.png and /dev/null differ diff --git a/windows/client-management/images/loadhive.png b/windows/client-management/images/loadhive.png deleted file mode 100644 index 62c6643140..0000000000 Binary files a/windows/client-management/images/loadhive.png and /dev/null differ diff --git a/windows/client-management/images/miniport.png b/windows/client-management/images/miniport.png deleted file mode 100644 index ba1b2fed2d..0000000000 Binary files a/windows/client-management/images/miniport.png and /dev/null differ diff --git a/windows/client-management/images/msm.png b/windows/client-management/images/msm.png deleted file mode 100644 index 397df3e350..0000000000 Binary files a/windows/client-management/images/msm.png and /dev/null differ diff --git a/windows/client-management/images/msmdetails.png b/windows/client-management/images/msmdetails.png deleted file mode 100644 index cbcf20e114..0000000000 Binary files a/windows/client-management/images/msmdetails.png and /dev/null differ diff --git a/windows/client-management/images/nm-adapters.png b/windows/client-management/images/nm-adapters.png deleted file mode 100644 index f4e25fdbc8..0000000000 Binary files a/windows/client-management/images/nm-adapters.png and /dev/null differ diff --git a/windows/client-management/images/nm-start.png b/windows/client-management/images/nm-start.png deleted file mode 100644 index ec92f013a2..0000000000 Binary files a/windows/client-management/images/nm-start.png and /dev/null differ diff --git a/windows/client-management/images/out-of-memory.png b/windows/client-management/images/out-of-memory.png deleted file mode 100644 index c377389128..0000000000 Binary files a/windows/client-management/images/out-of-memory.png and /dev/null differ diff --git a/windows/client-management/images/pendingupdate.png b/windows/client-management/images/pendingupdate.png deleted file mode 100644 index 19d8c9dec4..0000000000 Binary files a/windows/client-management/images/pendingupdate.png and /dev/null differ diff --git a/windows/client-management/images/revertpending.png b/windows/client-management/images/revertpending.png deleted file mode 100644 index 7b60c6446d..0000000000 Binary files a/windows/client-management/images/revertpending.png and /dev/null differ diff --git a/windows/client-management/images/rpc-error.png b/windows/client-management/images/rpc-error.png deleted file mode 100644 index 0e0828522b..0000000000 Binary files a/windows/client-management/images/rpc-error.png and /dev/null differ diff --git a/windows/client-management/images/rpc-flow.png b/windows/client-management/images/rpc-flow.png deleted file mode 100644 index a3d9c13030..0000000000 Binary files a/windows/client-management/images/rpc-flow.png and /dev/null differ diff --git a/windows/client-management/images/screenshot1.png b/windows/client-management/images/screenshot1.png deleted file mode 100644 index 5138b41016..0000000000 Binary files a/windows/client-management/images/screenshot1.png and /dev/null differ diff --git a/windows/client-management/images/sfc-scannow.png b/windows/client-management/images/sfc-scannow.png deleted file mode 100644 index 1c079288a8..0000000000 Binary files a/windows/client-management/images/sfc-scannow.png and /dev/null differ diff --git a/windows/client-management/images/task-manager-commit.png b/windows/client-management/images/task-manager-commit.png deleted file mode 100644 index 86d289eebe..0000000000 Binary files a/windows/client-management/images/task-manager-commit.png and /dev/null differ diff --git a/windows/client-management/images/task-manager.png b/windows/client-management/images/task-manager.png deleted file mode 100644 index c52163f46e..0000000000 Binary files a/windows/client-management/images/task-manager.png and /dev/null differ diff --git a/windows/client-management/images/tat.png b/windows/client-management/images/tat.png deleted file mode 100644 index 90eb328c38..0000000000 Binary files a/windows/client-management/images/tat.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-10.png b/windows/client-management/images/tcp-ts-10.png deleted file mode 100644 index 7bf332b57a..0000000000 Binary files a/windows/client-management/images/tcp-ts-10.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-11.png b/windows/client-management/images/tcp-ts-11.png deleted file mode 100644 index 75b0361f89..0000000000 Binary files a/windows/client-management/images/tcp-ts-11.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-12.png b/windows/client-management/images/tcp-ts-12.png deleted file mode 100644 index 592ccf0e76..0000000000 Binary files a/windows/client-management/images/tcp-ts-12.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-13.png b/windows/client-management/images/tcp-ts-13.png deleted file mode 100644 index da6157c72a..0000000000 Binary files a/windows/client-management/images/tcp-ts-13.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-14.png b/windows/client-management/images/tcp-ts-14.png deleted file mode 100644 index b1db37cd1a..0000000000 Binary files a/windows/client-management/images/tcp-ts-14.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-15.png b/windows/client-management/images/tcp-ts-15.png deleted file mode 100644 index e3e161317f..0000000000 Binary files a/windows/client-management/images/tcp-ts-15.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-16.png b/windows/client-management/images/tcp-ts-16.png deleted file mode 100644 index 52a5e24e2b..0000000000 Binary files a/windows/client-management/images/tcp-ts-16.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-17.png b/windows/client-management/images/tcp-ts-17.png deleted file mode 100644 index e690bbdf1c..0000000000 Binary files a/windows/client-management/images/tcp-ts-17.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-18.png b/windows/client-management/images/tcp-ts-18.png deleted file mode 100644 index 95cf36dbe7..0000000000 Binary files a/windows/client-management/images/tcp-ts-18.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-19.png b/windows/client-management/images/tcp-ts-19.png deleted file mode 100644 index 4f2d239e57..0000000000 Binary files a/windows/client-management/images/tcp-ts-19.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-20.png b/windows/client-management/images/tcp-ts-20.png deleted file mode 100644 index 9b3c573f7e..0000000000 Binary files a/windows/client-management/images/tcp-ts-20.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-21.png b/windows/client-management/images/tcp-ts-21.png deleted file mode 100644 index 1e29a2061e..0000000000 Binary files a/windows/client-management/images/tcp-ts-21.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-22.png b/windows/client-management/images/tcp-ts-22.png deleted file mode 100644 index c49dcd72ee..0000000000 Binary files a/windows/client-management/images/tcp-ts-22.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-23.png b/windows/client-management/images/tcp-ts-23.png deleted file mode 100644 index 16ef4604c1..0000000000 Binary files a/windows/client-management/images/tcp-ts-23.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-24.png b/windows/client-management/images/tcp-ts-24.png deleted file mode 100644 index 14ae950076..0000000000 Binary files a/windows/client-management/images/tcp-ts-24.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-25.png b/windows/client-management/images/tcp-ts-25.png deleted file mode 100644 index 21e8b97a08..0000000000 Binary files a/windows/client-management/images/tcp-ts-25.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-4.png b/windows/client-management/images/tcp-ts-4.png deleted file mode 100644 index 73bc5f90be..0000000000 Binary files a/windows/client-management/images/tcp-ts-4.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-5.png b/windows/client-management/images/tcp-ts-5.png deleted file mode 100644 index ee64c96da0..0000000000 Binary files a/windows/client-management/images/tcp-ts-5.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-6.png b/windows/client-management/images/tcp-ts-6.png deleted file mode 100644 index 8db75fdb08..0000000000 Binary files a/windows/client-management/images/tcp-ts-6.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-7.png b/windows/client-management/images/tcp-ts-7.png deleted file mode 100644 index 4b61bf7e36..0000000000 Binary files a/windows/client-management/images/tcp-ts-7.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-8.png b/windows/client-management/images/tcp-ts-8.png deleted file mode 100644 index f0ef8300ba..0000000000 Binary files a/windows/client-management/images/tcp-ts-8.png and /dev/null differ diff --git a/windows/client-management/images/tcp-ts-9.png b/windows/client-management/images/tcp-ts-9.png deleted file mode 100644 index dba375fd65..0000000000 Binary files a/windows/client-management/images/tcp-ts-9.png and /dev/null differ diff --git a/windows/client-management/images/unloadhive.png b/windows/client-management/images/unloadhive.png deleted file mode 100644 index e8eb2f859e..0000000000 Binary files a/windows/client-management/images/unloadhive.png and /dev/null differ diff --git a/windows/client-management/images/unloadhive1.png b/windows/client-management/images/unloadhive1.png deleted file mode 100644 index 3b269f294c..0000000000 Binary files a/windows/client-management/images/unloadhive1.png and /dev/null differ diff --git a/windows/client-management/images/wcm.png b/windows/client-management/images/wcm.png deleted file mode 100644 index 6c26a3aeb7..0000000000 Binary files a/windows/client-management/images/wcm.png and /dev/null differ diff --git a/windows/client-management/images/wifi-stack.png b/windows/client-management/images/wifi-stack.png deleted file mode 100644 index cf94f491c4..0000000000 Binary files a/windows/client-management/images/wifi-stack.png and /dev/null differ diff --git a/windows/client-management/images/windbg.png b/windows/client-management/images/windbg.png deleted file mode 100644 index 2f489e81a7..0000000000 Binary files a/windows/client-management/images/windbg.png and /dev/null differ diff --git a/windows/client-management/images/wlan.png b/windows/client-management/images/wlan.png deleted file mode 100644 index fea20f7272..0000000000 Binary files a/windows/client-management/images/wlan.png and /dev/null differ diff --git a/windows/client-management/includes/allow-cortana-shortdesc.md b/windows/client-management/includes/allow-cortana-shortdesc.md deleted file mode 100644 index 234b73f7d2..0000000000 --- a/windows/client-management/includes/allow-cortana-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Since Microsoft Edge is integration with Cortana, Microsoft Edge allows users to use Cortana voice assistant by default. With this policy, you can configure Microsoft Edge to prevent users from using Cortana but can still search to find items on their device. diff --git a/windows/client-management/includes/configure-favorites-shortdesc.md b/windows/client-management/includes/configure-favorites-shortdesc.md deleted file mode 100644 index 34e0cded8f..0000000000 --- a/windows/client-management/includes/configure-favorites-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Discontinued in Windows 10, version 1809. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** policy instead. diff --git a/windows/client-management/includes/do-not-sync-shortdesc.md b/windows/client-management/includes/do-not-sync-shortdesc.md deleted file mode 100644 index 2fe09c0260..0000000000 --- a/windows/client-management/includes/do-not-sync-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge turns on the _Sync your settings_ toggle in **Settings > Device sync settings** letting users choose what to sync on their devices. Enabling this policy turns off and disables the _Sync your settings_ toggle preventing the syncing of user’s settings between their devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable this policy and select the _Allow users to turn syncing on_ option. diff --git a/windows/client-management/includes/microsoft-browser-extension-policy-shortdesc.md b/windows/client-management/includes/microsoft-browser-extension-policy-shortdesc.md deleted file mode 100644 index 2b26624e8c..0000000000 --- a/windows/client-management/includes/microsoft-browser-extension-policy-shortdesc.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 04/23/2020 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -[Microsoft browser extension policy](/legal/microsoft-edge/microsoft-browser-extension-policy): -This article describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer, or the content these browsers display. Techniques that aren't explicitly listed in this article are considered to be **unsupported**. \ No newline at end of file diff --git a/windows/client-management/includes/search-provider-discovery-shortdesc.md b/windows/client-management/includes/search-provider-discovery-shortdesc.md deleted file mode 100644 index 8524933996..0000000000 --- a/windows/client-management/includes/search-provider-discovery-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge follows the OpenSearch 1.1 specification to discover and use web search providers. When a user browses to a search service, the OpenSearch description is picked up and saved for later use. Users can then choose to add the search service to use in the Microsoft Edge address bar. diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 236d6dd432..5714236fec 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,5 +1,5 @@ --- -title: Advice while using Windows Defender Credential Guard (Windows) +title: Considerations when using Windows Defender Credential Guard description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows. ms.date: 08/31/2017 ms.topic: article @@ -15,6 +15,7 @@ Passwords are still weak. We recommend that in addition to deploying Windows Def Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, aren't supported. ## Wi-fi and VPN Considerations + When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You'll be forced to enter your credentials to use these protocols and can't save the credentials for future use. If you're using WiFi and VPN endpoints that are based on MS-CHAPv2, they're subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. ## Kerberos Considerations @@ -22,19 +23,25 @@ When you enable Windows Defender Credential Guard, you can no longer use NTLM cl When you enable Windows Defender Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. Use constrained or resource-based Kerberos delegation instead. ## 3rd Party Security Support Providers Considerations + Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Windows Defender Credential Guard because it doesn't allow third-party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs aren't supported. We recommend that custom implementations of SSPs/APs are tested with Windows Defender Credential Guard. SSPs and APs that depend on any undocumented or unsupported behaviors fail. For example, using the KerbQuerySupplementalCredentialsMessage API isn't supported. Replacing the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](/windows/win32/secauthn/restrictions-around-registering-and-installing-a-security-package) on MSDN. ## Upgrade Considerations + As the depth and breadth of protections provided by Windows Defender Credential Guard are increased, subsequent releases of Windows 10 with Windows Defender Credential Guard running may impact scenarios that were working in the past. For example, Windows Defender Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities. Test scenarios required for operations in an organization before upgrading a device using Windows Defender Credential Guard. ### Saved Windows Credentials Protected -Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Windows Defender Credential Guard. Credential Manager allows you to store three types of credentials: Windows credentials, certificate-based credentials, and generic credentials. Generic credentials such as user names and passwords that you use to log on to websites aren't protected since the applications require your cleartext password. If the application doesn't need a copy of the password, they can save domain credentials as Windows credentials that are protected. Windows credentials are used to connect to other computers on a network. The following considerations apply to the Windows Defender Credential Guard protections for Credential Manager: +Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Windows Defender Credential Guard. Credential Manager allows you to store three types of credentials: Windows credentials, certificate-based credentials, and generic credentials. Generic credentials such as user names and passwords that you use to log on to websites aren't protected since the applications require your cleartext password. If the application doesn't need a copy of the password, they can save domain credentials as Windows credentials that are protected. Windows credentials are used to connect to other computers on a network. + +The following considerations apply to the Windows Defender Credential Guard protections for Credential Manager: + * Windows credentials saved by Remote Desktop Client can't be sent to a remote host. Attempts to use saved Windows credentials fail, displaying the error message "Logon attempt failed." * Applications that extract Windows credentials fail. * When credentials are backed up from a PC that has Windows Defender Credential Guard enabled, the Windows credentials can't be restored. If you need to back up your credentials, you must do this before you enable Windows Defender Credential Guard. Otherwise, you can't restore those credentials. ## Clearing TPM Considerations + Virtualization-based Security (VBS) uses the TPM to protect its key. So when the TPM is cleared then the TPM protected key used to encrypt VBS secrets is lost. >[!WARNING] @@ -47,9 +54,11 @@ As a result Credential Guard can no longer decrypt protected data. VBS creates a > Credential Guard obtains the key during initialization. So the data loss will only impact persistent data and occur after the next system startup. ### Windows credentials saved to Credential Manager + Since Credential Manager can't decrypt saved Windows Credentials, they're deleted. Applications should prompt for credentials that were previously saved. If saved again, then Windows credentials are protected Credential Guard. ### Domain-joined device’s automatically provisioned public key + Beginning with Windows 10 and Windows Server 2016, domain-devices automatically provision a bound public key, for more information about automatic public key provisioning, see [Domain-joined Device Public Key Authentication](/windows-server/security/kerberos/domain-joined-device-public-key-authentication). Since Credential Guard can't decrypt the protected private key, Windows uses the domain-joined computer's password for authentication to the domain. Unless additional policies are deployed, there should not be a loss of functionality. If a device is configured to only use public key, then it can't authenticate with password until that policy is disabled. For more information on Configuring devices to only use public key, see [Domain-joined Device Public Key Authentication](/windows-server/security/kerberos/domain-joined-device-public-key-authentication). @@ -57,6 +66,7 @@ Since Credential Guard can't decrypt the protected private key, Windows uses the Also if any access control checks including authentication policies require devices to have either the KEY TRUST IDENTITY (S-1-18-4) or FRESH PUBLIC KEY IDENTITY (S-1-18-3) well-known SIDs, then those access checks fail. For more information about authentication policies, see [Authentication Policies and Authentication Policy Silos](/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos). For more information about well-known SIDs, see [[MS-DTYP] Section 2.4.2.4 Well-known SID Structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). ### Breaking DPAPI on domain-joined devices + On domain-joined devices, DPAPI can recover user keys using a domain controller from the user's domain. If a domain-joined device has no connectivity to a domain controller, then recovery isn't possible. >[!IMPORTANT] @@ -77,6 +87,7 @@ Domain user sign-in on a domain-joined device after clearing a TPM for as long a Once the device has connectivity to the domain controllers, DPAPI recovers the user's key and data protected prior to clearing the TPM can be decrypted. #### Impact of DPAPI failures on Windows Information Protection + When data protected with user DPAPI is unusable, then the user loses access to all work data protected by Windows Information Protection. The impact includes: Outlook 2016 is unable to start and work protected documents can't be opened. If DPAPI is working, then newly created work data is protected and can be accessed. **Workaround:** Users can resolve the problem by connecting their device to the domain and rebooting or using their Encrypting File System Data Recovery Agent certificate. For more information about Encrypting File System Data Recovery Agent certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate). @@ -84,6 +95,4 @@ When data protected with user DPAPI is unusable, then the user loses access to a ## See also -**Related videos** - -[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) +- [What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index c65b98067d..7d673787ba 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -80,7 +80,7 @@ sections: - question: How does Windows Hello for Business work with Azure AD registered devices? answer: | - A user will be prompted to set up a Windows Hello for Business key on an Azure AD registered devices if the feature is enabled by policy. If the user has an existing Windows Hello container, the Windows Hello for Business key will be enrolled in that container and will be protected using their exiting gestures. + A user will be prompted to set up a Windows Hello for Business key on an Azure AD registered devices if the feature is enabled by policy. If the user has an existing Windows Hello container, the Windows Hello for Business key will be enrolled in that container and will be protected using their existing gestures. If a user has signed into their Azure AD registered device with Windows Hello, their Windows Hello for Business key will be used to authenticate the user's work identity when they try to use Azure AD resources. The Windows Hello for Business key meets Azure AD multi-factor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources. diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index bd501ceb09..234c8a6eba 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -2,13 +2,13 @@ title: Kernel DMA Protection (Windows) description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. ms.prod: windows-client -author: dansimp -ms.author: dansimp +author: vinaypamnani-msft +ms.author: vinpa manager: aaroncz ms.collection: - highpri ms.topic: conceptual -ms.date: 03/26/2019 +ms.date: 01/05/2023 ms.technology: itpro-security --- @@ -66,6 +66,9 @@ Systems released prior to Windows 10 version 1803 do not support Kernel DMA Prot >[!NOTE] >Kernel DMA Protection is not compatible with other BitLocker DMA attacks countermeasures. It is recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection. Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals. +>[!NOTE] +>DMA remapping support for graphics devices was added in Windows 11 with the WDDM 3.0 driver model; Windows 10 does not support this feature. + ## How to check if Kernel DMA Protection is enabled Systems running Windows 10 version 1803 that do support Kernel DMA Protection do have this security feature enabled automatically by the OS with no user or IT admin configuration required. diff --git a/windows/whats-new/images/ICD.png b/windows/whats-new/images/ICD.png deleted file mode 100644 index 9cfcb845df..0000000000 Binary files a/windows/whats-new/images/ICD.png and /dev/null differ diff --git a/windows/whats-new/images/block-suspicious-behaviors.png b/windows/whats-new/images/block-suspicious-behaviors.png deleted file mode 100644 index 31a2cf5727..0000000000 Binary files a/windows/whats-new/images/block-suspicious-behaviors.png and /dev/null differ diff --git a/windows/whats-new/images/compare-changes.png b/windows/whats-new/images/compare-changes.png deleted file mode 100644 index 0d86db70f5..0000000000 Binary files a/windows/whats-new/images/compare-changes.png and /dev/null differ diff --git a/windows/whats-new/images/contribute-link.png b/windows/whats-new/images/contribute-link.png deleted file mode 100644 index 4cf685e54e..0000000000 Binary files a/windows/whats-new/images/contribute-link.png and /dev/null differ diff --git a/windows/whats-new/images/funfacts.png b/windows/whats-new/images/funfacts.png deleted file mode 100644 index 71355ec370..0000000000 Binary files a/windows/whats-new/images/funfacts.png and /dev/null differ diff --git a/windows/whats-new/images/ldstore.PNG b/windows/whats-new/images/ldstore.PNG deleted file mode 100644 index 63f0eedee7..0000000000 Binary files a/windows/whats-new/images/ldstore.PNG and /dev/null differ diff --git a/windows/whats-new/images/lockscreen.png b/windows/whats-new/images/lockscreen.png deleted file mode 100644 index 68c64e15ec..0000000000 Binary files a/windows/whats-new/images/lockscreen.png and /dev/null differ diff --git a/windows/whats-new/images/lockscreenpolicy.png b/windows/whats-new/images/lockscreenpolicy.png deleted file mode 100644 index 30b6a7ae9d..0000000000 Binary files a/windows/whats-new/images/lockscreenpolicy.png and /dev/null differ diff --git a/windows/whats-new/images/pencil-icon.png b/windows/whats-new/images/pencil-icon.png deleted file mode 100644 index 82fe7852dd..0000000000 Binary files a/windows/whats-new/images/pencil-icon.png and /dev/null differ diff --git a/windows/whats-new/images/preview-changes.png b/windows/whats-new/images/preview-changes.png deleted file mode 100644 index cb4ecab594..0000000000 Binary files a/windows/whats-new/images/preview-changes.png and /dev/null differ diff --git a/windows/whats-new/images/propose-file-change.png b/windows/whats-new/images/propose-file-change.png deleted file mode 100644 index aedbc07b16..0000000000 Binary files a/windows/whats-new/images/propose-file-change.png and /dev/null differ diff --git a/windows/whats-new/images/spotlight.png b/windows/whats-new/images/spotlight.png deleted file mode 100644 index 515269740b..0000000000 Binary files a/windows/whats-new/images/spotlight.png and /dev/null differ diff --git a/windows/whats-new/images/video-1709.jpg b/windows/whats-new/images/video-1709.jpg deleted file mode 100644 index b54fe67cf6..0000000000 Binary files a/windows/whats-new/images/video-1709.jpg and /dev/null differ diff --git a/windows/whats-new/images/video-1709s.jpg b/windows/whats-new/images/video-1709s.jpg deleted file mode 100644 index 7abc313dd8..0000000000 Binary files a/windows/whats-new/images/video-1709s.jpg and /dev/null differ diff --git a/windows/whats-new/images/windows-11-whats-new/windows-11-taskbar.png b/windows/whats-new/images/windows-11-whats-new/windows-11-taskbar.png deleted file mode 100644 index 1f997e62f9..0000000000 Binary files a/windows/whats-new/images/windows-11-whats-new/windows-11-taskbar.png and /dev/null differ diff --git a/windows/whats-new/images/windows-defender-atp.png b/windows/whats-new/images/windows-defender-atp.png deleted file mode 100644 index 938ac2c72d..0000000000 Binary files a/windows/whats-new/images/windows-defender-atp.png and /dev/null differ diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index a73d3885e3..4a63cc1f7c 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -106,5 +106,5 @@ The VM host CPU must also meet Windows 11 [processor requirements](/windows-hard ## See also [Windows minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview)
-[What's new in Windows 11 overview](windows-11-whats-new.md) +[What's new in Windows 11 overview](/windows/whats-new/windows-11-overview)