From 9f2de57b533f017e390b0304582483f348f8b8a8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 21 Mar 2018 12:40:50 -0700 Subject: [PATCH 1/7] changing build notification --- .openpublishing.publish.config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 9e9233eb13..efe7a5e648 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -476,7 +476,7 @@ } ], "notification_subscribers": [ - "brianlic@microsoft.com" + "elizapo@microsoft.com" ], "branches_to_filter": [ "" From 0d60902a79725bf3c4db3f6a7cf9a0c015738fde Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 20:55:45 +0000 Subject: [PATCH 2/7] Merged PR 6535: AssignedAccess CSP - updated descriptions and links fixed typo --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 48635d81a9..f083dad4a1 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -39,7 +39,7 @@ For a step-by-step guide for setting up devices to run in kiosk mode, see [Set u > > You cannot set both KioskModeApp and ShellLauncher at the same time on the device. -In Windows 10, version 1607, you can use a provisioned app to configure the kiosk mode. For more information about how to remotely provision an app, see [Enterprise app management](enterprise-app-management.md). +Starting in Windows 10, version 1607, you can use a provisioned app to configure the kiosk mode. For more information about how to remotely provision an app, see [Enterprise app management](enterprise-app-management.md). Here's an example: From 7378e96c6918217fe7ebbf1a01cdca81e266e835 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 20:56:05 +0000 Subject: [PATCH 3/7] Merged PR 6539: Removed some LocalPoliciesSecurityOptions policies --- ...ew-in-windows-mdm-enrollment-management.md | 18 - .../policy-configuration-service-provider.md | 5 +- ...policy-csp-localpoliciessecurityoptions.md | 586 +----------------- 3 files changed, 2 insertions(+), 607 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 5965974382..66cacb8036 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1175,14 +1175,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
    • -
  • LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge
    • -
  • LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession
    • @@ -1193,10 +1186,8 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
  • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
    • @@ -1788,14 +1779,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible
    • -
  • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
    • -
  • LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge
    • -
  • LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession
    • @@ -1806,10 +1790,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
  • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
    • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 42c5737c3e..debb631fa9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/16/2018 --- # Policy CSP @@ -4133,9 +4133,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) - [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) - [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) - [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 27c960d639..327397bc54 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 03/16/2018 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -51,24 +51,6 @@ ms.date: 03/12/2018
    LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
    -
    - LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge -
    -
    - LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey -
    LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    @@ -93,9 +75,6 @@ ms.date: 03/12/2018
    LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    -
    - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
    LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    @@ -126,9 +105,6 @@ ms.date: 03/12/2018
    LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    -
    - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM -
    LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    @@ -138,9 +114,6 @@ ms.date: 03/12/2018
    LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    -
    - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients -
    LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    @@ -784,375 +757,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Digitally encrypt or sign secure channel data (always) - -This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: - -Domain member: Digitally encrypt secure channel data (when possible) -Domain member: Digitally sign secure channel data (when possible) - -Default: Enabled. - -Notes: - -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Digitally encrypt secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. - -Default: Enabled. - -Important - -There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. - -Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - -GP Info: -- GP English name: *Domain member: Digitally sign secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Disable machine account password changes - -Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. - -Default: Disabled. - -Notes - -This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. -This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. - - - -GP Info: -- GP English name: *Domain member: Disable machine account password changes* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - -GP Info: -- GP English name: *Domain member: Maximum machine account password age* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - -GP Info: -- GP English name: *Domain member: Require strong (Windows 2000 or later) session key* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - **LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked** @@ -1650,77 +1254,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - -GP Info: -- GP English name: *Microsoft network client: Digitally sign communications (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** @@ -2334,63 +1867,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Network security: Allow Local System to use computer identity for NTLM - -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. - - - - -
    - **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** @@ -2586,66 +2062,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - -GP Info: -- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
    - **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers** From e47e8e86e180b6709b3b240a0bfedbeed726b2e8 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 21 Mar 2018 14:08:29 -0700 Subject: [PATCH 4/7] moved the one unique item out of UR troubleshoot into new general TR topic --- .../images/upgrade-analytics-unsubscribe.png | Bin 0 -> 33468 bytes .../windows-analytics-FAQ-troubleshooting.md | 19 ++++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 windows/deployment/update/images/upgrade-analytics-unsubscribe.png diff --git a/windows/deployment/update/images/upgrade-analytics-unsubscribe.png b/windows/deployment/update/images/upgrade-analytics-unsubscribe.png new file mode 100644 index 0000000000000000000000000000000000000000..402db94d6fb3fca99d76f90cdf8709a409694cd6 GIT binary patch literal 33468 zcmeFZRa6{Z*DV}KaCdiicXxMpXsmJ9;O>Or5}9@Vw0x@+xSyVja(uDLr}RapiJ9v}YGr%y<7vXbhbK0!Kv`UHUr3kh!Nb=c$p zZy?;%WyC+#Oc5S~cfMGQDT#ghRG*0OY6b<~hjW(IbNlp(DDs~-MB@In<)=>}YI2fd zn%>6e-B8{JGONAk#a>$*Zx3%Qp6zu85#c3t65qwMxN{;hGc);IW?XVIz#qUbs^pBm zmYzI!%>||PD)VxPm-gCr_sL8S>nXyk^;=n)h82wu?_hK)`4r;EyH@Mmulsqmz0b99 zzt-z*!;X)wO>(Xd1iZTo{lbn%dqqCh6>8rO<6EUSAngC<@oWZM4C&0y6IDuouUoif z`MBM}klqT0$(&gOpL%nOv4ywMC!95U<`wvQS{v{*>{dr#G z54y#LE?58E>DI^73XbvnJw{;9KNtIWyGT@deJbx2dHh`_5QJ3!gb^5kuC!5aO9^N2 zw#}jF{{b914ufS)Phi+;u|%&aVRv_TiLEVVT)`nqTO{~9gXUxYu&G0UYahWR+2y&pfnC>d@!+JA zz5}l2=4uBA>6W>Tjp}KCm?OTED9Hk0B0*vtsb>#~KhC^m5o1Rv>EmYbcDA-_aTjD@ z1K1Am%2h#lNvauXN$n0x?_30}OeWp4E0c4$rJi0MeGb{Jm(g(v`?vAF)9pPy#2alg zD*19%&22tkCnKsAv}-yo9Y%Jq?@oK5Jz^B(v$C?-jDSu~EVPXM)W4jT8#tKB;5gv? zg+joc#7#(oPn|xbDlH1QJ5J~JOrWAFR%3JFIArSZ9Ds*l;Ew!iY6y!SY-DXsbN6`( zK3tqReQjm5zfu%NT!M1`iz71w{?rJO9o=piQGsvMFe?Q*{VPNs zlWxcA)T|T->(Ap;4ca{@D5*R@HUT!e{nz5kvQTOC@9L;f04;#)Sb`8t%cbzQ!?0FVG-llndUAH(sea2*I-9J%VE@R3m1VxvRGoZ54h9-tM!@LU zJ)ts*1-JPH`Iokui`>RT7R!QGpV+kYv@{l@W?_DAVzoaz`*s5q1?=pN*i0rG+Q!0O z+czmqcP%Xs>F@W8;R;Kd@O6Fe10Y`ELy1NF-~X1o-6O?+BkwXc(BbiafMg;0Xldc*LAlhsO+PrmGF|hD)hV*F z09akEhIv(=6LK^*h~#oJ@Ke{c7w?brAqaK(&5$NIjwc93DJ5M$Ac?}EPoXq=fu}S; zkd++NkF>zWl{fub(bR;fMj=nil!3*@0ALSuJe;T{J;?60po$&h?zOFV-|vVj%LvN< zHmYH5vA;+Dr_sZC5eN-Z_vU1&C8edbU#szVZMWa=m^{wZo59um0wRb0!RN#VkVIgx zlVxTWMoYQ~9-u)btugF`!*5()+*&7yjh2+rhZDL!Fy@d%$f=ce0&=!fC<=jNdDylsFlu z+j+zSR&2IRLLM?Aver>pOxgU(g85X4CGwQx5|a~n+N9}d4i8eDt$#h*TR}L+%N$Y8 z6>h@b;^3``m_0NMad5EDfaR*|c^%^c8Ju6+nvOALq9&waUX6br9e zKH4TYz4l}A$BP9!onIm?wi_f4&-90{He3j4RQ;eVi99-dIA}ZR((kUkHqg}H-``hy zaXoyz*0`4rEq1#?Y0Wbb?BD3hZRm@C^N<3!8y2dWs%LcdrAuUKbvs=;J4;c*#`ay| z;bVm}x$PF7nOI2@$Bmi*4t@Z2HJ8yYDTcAJG0;hqdo|A5ngD7eIc*peS=UF`JsBng zCTzwOB2*GvSXNqE1maA3072Bu&;|!Ndq;i!?83m;hu31%%T=W{v@eA^QbR*m40$8j zz23!vrmX#{gd2D5v9_ltzF&P&TXtyG=QvOkDAXgl9*G1!*M^D3Zb#;<_V;l(Il09< zW<(w!4GIU+YYl2v+K|Y=vG||R!)sb34i&ZhXCBLrr&_-i58lPyGgN+Cig$E!;OpA~ z(G^k(wB2TxWvAcdut&DndR;?=4r*gWxQv))6mk71*cm#m@rnvYeIOGFq~?5&P{kr+ zTpgsQnKnE+J4%rqq?s~ovvtv^)&}+ePCZ@IUqg*M>16)`?Ck0ytQ{CGK@=ojS`q;s zk9ojG>C|q8WZ<5IU5CSZ3&O@`m%oaYc7h@GJp!zFJ|PxHq;MXuf51k`ITBJlY{@M= zJlWLeNR|B0GH*rm_5L!tbq{~5+NVY%f3S1_{fA@!$z|;u%QUCF?>0~ zZx{dEbeEt0uvoy}#s2-4*4BX^sq1&SVR>_x;-8;8Fz%S+;?21p@WxFP$^o%S(~N^%^C@ z|AcSiHW3h{?ic=c2~&O0h8Dm(=qMqzW5`LH4KGMgf04z{t642n`r_zmgDOI5gWg}d z^}qlRwymN9zmK+m4#~ii*`%?&yd16(enZ;IX^pB`r-p~U`>7}_0N>>4iA$D;}}%xp#Qi1zZ!?1jJ%97(}y1TVm#SY z+jp{jLf#8jZ9?5f_HX=v^`Gl1&*4dZRvs~5`7OH{)l^Em(u>c`>G&7}S_7EaHjhqD zejmc_Tn{o*3+pkb$HoOMj5Lmxb!Te(GjtErS0Bi$TQXJZ&|{zKVC;Uzjtz%U>t$v4 z{o7wB-D8P2T^$h!%JAY%{K}ghi~eQ{5G2EdH!v``t}vmF8bNJrnjnmKAyg_0eAYkN zswon*OL{1<98M<=x7Hxoe+zwH82tOGu`xH7_^tmJEr#uc-@aANZ@KcZyvSdZ>y}mt zzpJU}!M~cLW?)b`jW)O&t!FFUA}l~p?@RU3lgc(rJr2tE*AqRq(>`|a%k=Rz2VlsU zn8PL|C1GP@v$3%~@7Jo)Vz#uj$QP^kzB;ff!azfx;J{*#VaI}BU@N(^)L@&%S+6=- zSDZcwQg#1hgJ^J3wWlc#5gUPxCf z+o?p;dPRX}IZHHJs|T%2cTDZM3$Ok0O&QO|{^zyruKQ!Zixr%~1WfF;psDGKFQIvOgzkwto zv$C`6k1j70{fv!sTRZ??oZHt+^8%hjQG`tkgedUBRT0`gTV0@YSYMZx-)u$7O?DMo z)$D9g4ak(Wsgx*XM<6<)yRWUS5p3jg*=d7w4amj!_W%|amR~5XGCDdq70pdeIlL}A zf3J6!;rR!Z`q!OwW3$6t>f+;(lp!5U|Niy9Be9E|dN`Q+ak{rRxCf!n>v^`^Y`64n zdTOerxj9@R!$6-riIrpXwxY{0JpeZ-VJzZhbx z2K)>O$@<%j(C_Vj2|Tu7@JnWd=$uTW!py{E*|_rjhDPxT`{~r=1D*+->;HUXhX=LD z!H6hmbfJfilvn%>dw6FmFV7mA8?rmLyhWHU#-t{jWa6ryV4 zf3LN!yi{uxT>z$dI8HcqNw(#+E78PaX;W{W# z!2N;_d^jW?qVWVhVm=|V^+*B{ZYj6@@=yB)-+Nm`2i&f2>Ervjy{rJojSi2G_czM< z7pTTGleZHc-oxkpS=U~1EfiZs^HN{YCk%WG?`bCLSOh=LFL!x7kE0XvDNnC3{s>~V2BIvr1_lJLFx}hKeN4eGhi{Kt)8pgW0$$8+z5Wj? z*4{!cJA>IyJu9oLF~>xWWEWKHkr>p9tYP0H1hAPzM}eq)w8+WRhXYj;FFBKwlO%pu z5IOOJMInEiYim)$ub#nPx}I;x6v#zO3)^?G+z2(b%o1=Nt5vCeoE{GbHUAk$IY-mO zdb%@&y!zS+)HWxa9A5+H1ETj)FV2le-#ruzA6WEV9026&%JS+eV6ZPJ0R$i0>2)bh zWNmFdSP~_J77Cc1okhF9y}dYE1@RL8LgYb@9a?R$L>Q|z?v5cq45lk_)NN{QwZ7nSa&lsfh>Ya8 z4Ee(xVwfb>)d_y?yU1UM$m_sq@p}Dob9gw^MDQ~z)5Szt8EpwZwP#rnqGm_Ho9~yx zQso~z&b+W8Xn%Iz2Pfma@v~X)M-Zcwz)rv<%eEj$8tf5wr^+^Okh)a`hN{e3^mfHL z7VD#tI41C|v$+&`l9vJw2htFu5F>;&#&)k!UD$mF+}LOdpW_g@`^Y0WtkC*`x3h^A zxn7~z@v87Q26A>W;@%IZekdp_FR~C!zQH%E^M3oiwna-^g@wc!0~6!(c|qLY)Hm^x zbxY_^L0G#`hR(p-CsVEgm;%$IH&337ob8+=oSuUO0c=kTN0Bo-;JC!``MISwUPtiS z@4sI2Bw_$_b8r~_`Q>^z6hTIuir7nsO|4N zuBht~uo+tX-i5{#!JqFi{PV+KMDed zJumU9pz(tLs#7ECZt@FOMS;nH4wAfwlTaBn=dUswMxv2_eVsh2ms_tmRTSu-eK0M^ zibSc|kNZ!g0nf$^Xmolr#DA_JDo&;N8GIDnzy?hULN5splg9-&;C}w53O5Hn8V7EO zgODu?vjHC+1~&|U0{;*v_^3I!!8`~J9?Ofb_&V((@hbw>XDYVM8IzZ!;AcwB9T#g! zafdSui*%hstp#;_8oJ7=ideTm5s|Mbpqr;xFp@${ALIpr@fbMiyuw(g_|KK3Dd*K^ zMHTbtgC%UbipqqwD((N01b#4IkZHz!|2)XM8?Yezj}a8;w&C8S!E1T_g`CFff~~zq z0f7<({t^G5^>j$d;NE_Y_#g9ABILj(K}h_M{qh5p==9e?WZ({bLZ>e_Lx)TC{`v1f z{br30lNU7occg4GB*Ax*^?!z{m{XA)gpPvy&seeQm%Ronrc%okj-D(P!9%P6>NF=$ zQjLZ|{AciRX*7k67lJNgT5&qNtbAr^ZZLo#I4Y!~b(;oN?Ll zYj8+_lC0})QaLwI!Vqze-?(37V48F?Xr9!*yO6zjgh7ZEq^+YP@^aSr@zVQY=jd3& zLOx9OpD7{_vVw;(_f64WFf6r|^Zwdb-J#N5X^7$nGG!d|9&O(_M>zWY&cRZAG`yMDv%a0F?uc0EyON~4F8>8kQMa&1oOI8`*G7h zj`4ASxg;eH>Pf*3{C9d~k>SFcjdD|QU&`4vIvyqd86i<%yR|YBWE+3!ho5FReRE(b zE{cY^d>|y(U&@K;<~d7P{VLhwIu{=hh|4aEW7A+UU_h2C@@+!vytyvg7N-cVS$Q(e z?(F;RgYI(fBeK$drJ5P=?K=7Qm$z9W@z$=fzm6+))|bI>TzqVs1Fu88t#nSkPt(fU ztv&9%(9qBgjg6`DR5#>Fw1R?!R1+0Rq1XJBl!H@KHC0uLCX#V!+C;eRHL3exGBQZZsB5a+SE zbt~{9??d@O);Z$x=;Jent)sHE+)sixq*IZPGYJ+a5&vW7GR=x<;g>3K!196RA}8Mo z2#@LWoz4|9Xt8JG;d#8enn_15q+(<|qY-(EZfu^kTF*TVvpt^|7f41we{nrdey9RN`C|Nm_~~>jPiX%{ zYd%p4kbWuR$-!Ukt%|WY-?_avbbf&Cpv${_Hj ze=L+n2;TP3Jcjb7i@gh@g8SGIOO1l-rhr9nakrbcoOrtP+_6F>$`5#lBWa#RVu9A% zn@LU(z6W<+cf-YBAETzX$GP98`FD1r-W0jCkdZZ(~e zTOwuGS9ebXB)Q-k%Cm5P*#xw~9tFBdGZoM@mXcj-U@a7;HR+g?-U|xY-{c9UaxRcXG1U zzkPU+{t*!Y9k=xU{;sU7%=^2ntW2X+IW;}q&H!&jS63HYquZuGN{|2P4Wj?D-nyF= zh(GsuyPWHi8i2piDqL-*N;Q`UyR*$E54so!qMUszxrJ`9)K?q2FS~i>dZJfim-zwu zy=-97wtR?$RlzLik=^ZxpcpYrcufL*Ew%Q@yjj0RPrh?L-E+lMp4n-(Cc|;47a`UC zzMV4YIQwEUrC;aqi09SoC6br>d*DaA@2=F=jK|2dSg<2s@ulM1jkI@@k?X;GHZlga zKf12I3m32N@ClM~bTr9S#%YocyTfQjXzPzeKJWLp)FtvYZ&c|Lch|C+ULLoaBF9}|nOEA&avq5C@I)HmbRcksY74fPdIJGt>r%($K3RXV zCA?Y1H=1lTL`6Tbe+~_0-7)!iUIJr2w#o~uGSzE-r%gdvkDbA29;eNwh6ZsBEG(=> z>*-;ASadU5%r@_9fVK6Z|H}g&^(7e@nN#;Yc2%^WrR6>tOm5Fg#bWR8?J*j*q3%qK zjXmGZsnlbuoh?-AyuH3A5DVdxko1D{x#h?9!(0Uw6%=ITTy6(^`;FOIke!ENX!Ov> z>-5JT&XaVR*lTeuIG+!BK;}^NN0GBZmT8?@q1eyX z+n9w_b8DtTjciW+X}%&H|7M#~9T%bgmGaoM>=zlK`+fxil^>A+9LKfBou4jE+J&>G z)eh>+VUg7(wT2&kcPnetIiW;4Bz&Pm^6?KsYjkcn&`b4X^A-sY66^Nu(l{;3jj$?N zg4PiFqA+Rad`*`TM4p%nV@OUH*_@}9S0$T?hfLz8=V>}zJ{RKd1f#;$S5DKyz4xzA zdUiZ4>n)Gc7UY`l!;=CMf>(e23CGV>Fl?P;Q2Rda0t2xZrbbizFf2qqfw;N76yLq6 z*=?J%==6Hc);?bEtRaKBv$_bR%U~sv4zImcYsEpj^#CXfxW@h;;3{{ePVMmO^71k` zNhEVSUv0L|^^xwpMn(1QPq3cK3APh?J}PuOoSMuNAu(g_0#jkJ@W3y=%N-sJ5BK}& zCXUN>+u(GJ73l5#cQ~FPvV{~C)?F#Vj@3o%oA2vim$w@rTePZ)$_ZyIP9_y>&j@C% zg4ba$Lwr#}5}k5WMA$QswPRWp2F1d|kp7rX4M@#5-)(JhuKA;ps^VFaxmC7M?(BPZ z?cGD7!!O($JlhCw)`sT8VmPObDA@@O8wdOiGVhP^73P(FEqtU`_bCR81yC|Jnj9;k zpmn-FtJ56vVO0ZRxYbw=R9X_<$CGJ;wOVzcrGcN<*04spHZgC4DNia(Ct4=thZ(71 z*X_^mMlk05ov#epIqdS(;20;dPNKPS-QP>|GYQo;D}SrCiwYzYEY$P9y$61N>k5xN zi5XwEC)#-mHMY&SZmhN%N&B;3HncQ;Br6@^a*3rDe*?dhU<-^1m2mC#6cRSz`Uk8X*e8|cVEg|L@8$` zitiI>Pe08j2J~Yfe$=pp@tY4LmSOq`=Oz9@7dPthYnP=27i18y8AZSF`9Hf?HP_dh zO|;rA)jVzmihyac&Ti??_h4sE3a*O_`P^90(9m%9TQ#ahN!P&v46EX!qkV2CdC;oK z6YCcG`hv?tAHclFbW`Y*D48=8_6P?rQ}5HHlXIH%bTUQp>&c4cHk`6d<)G>X|iJ>5+W zd;SGZ571rAF5cM5p*(G(DoC>qtWN#OJLXZ4?&9~w_TmFIjDp#i!@DrHVX z0zT-i2J)I;=wy2puvWxJI_!2@KG{z887ME?ZkC)IOL;^U%_2#T*6>k9Iv5^SZQTvs za0Or~W&R#H=9t&)6HU`>c772a#MTKZkaxcvK&ig!M$k$rru(XuW9e!C(R5+#AWOfG zEn~v1&~^Peeh{aSLBoy~*LGV$vLH$+`TKWd65%RMdasLhI_y}`0GNIx`@PZQ|8g*y z&DLYm8z98Vc?S-(ikx)GHY50m&o7UcCJh#FXQ#Wn6zSt?B=u)~p)lZbW+IV*wuZ*Q z+3AMYmZh*96Ft3t6L9uoqtn5`fq;OZo)6w^F_l55zhok^Y8QL3r1$OIY0Kx3NRj1E zO4_tbm2G9!X#U<2G{G3cQ>e+`Em?qrqQ1TqT~EY*9U@YUKywg%kCnk6*YvHAe3!li z$_itTqSuixC-U{!YG_0Xy^(g4Cwt^(_F#)$@|l~$XHK4SBzy1I`U*8V`)V501o^sP zyJ}VSK$TPk8|@r}!^oFQtfi`UWDe!NPe-&y^zMqzlc_uNZDC1;Gm%cga^xY z!?-vkL$8f~7YSR^_lndgd>>R3v+^E_aIu$T*NGqN^RTCE`bIY^?0l-Ti9U{Q8QpyC z=ND@EaznMz+nx;+vAkAq7>9;hAKaXH; z2SY#I$RCTi4Sq~viR4i|*NNU(L>!s$0UCju<-5y{-PEen4kX47p;|P}aV}aj+5t~110Aaf0tw@b0kAVU-4iDYKuTfr5)DC|iyn^|CV}{3xm9@5G+;SN;fEW7XFC#K%fsd)cnAI`@a# zGNBd9j|NG|#-3b?jt$UXn~*;;*N{3bH?pDYKdRUDDcr2+W|8Rylc^okuIhAp+F`DG1}m zJsTD69mKhI+BxF-xw4+x`_^w}Uee3VH>xOfe+5A@jKJNSIc!@88Jd zjx@|zF85;tqi%G4#~;pH z3`DZ4@Qj00wwM{^Uxp)0!j7iMO!%}!{?nzN(ND=*dzyzP+?ODEe3wchwJ#XD8 z>HKs#7Y1AjFAkG0#gThYWe{Gg`m2!z3(1YJ4_I10*?`>0{%wMQH9XYfbQrxgiu1v! z7iB)%W3DLfZ^5cvCfkm#R4=YUI#+c4f=0brpZ0qu|oF)ynYYW#UjCj9=whms#z^l#}= zp+{k(zZK|)3>{N_SBarys4V*Ug-Hf@ck6(4mCErg(Sz7{H~IcYyVKPs++8jlF(lH2 zQ~Tq@|1VqM=>m!{n@ki=(BW0OLVnr!N$X>R@u|7#W^()PmNvwuU?m_ zUA(s;2al@42LOGGKP{Uy=@toG^%g zq6i3Pd`aw2_gcQ|L~P80~png#8~%($oUX>3%?W?<@QtSXxtb5Os-#_Y(|ExYW4ENBe^#uc5KJ zZArlPSJ7g1EzN}!9AZYu;JS_$r=4sM#>sL?|#%w5KXMIQQ;$H(T4nhRqZue^&~W6;GGO(4#HnPgVuvbVRl z)-yx>HU5GfbO*u>wcpF@`diC!h|&WMF(-=;3C74v<1DyT`?!{;1Z?CI^}1*0yQWKi zJ)huW{Rx@pbyW>lH~ad@HA*{6RmfAhIk~(VI_jc=wMa4PFyY(e=~EXLxfbWS5fKp= z=ebNBG~Ddu^q^LQzvWXAn*=$iwb!*F3P?c(31MTVde$xT0xdH9Jv<)sE0^mUIueeh z%{367WBgq7pt#j4G{dP@rCDu$_RI)Jjz~2AIIC%SP}coIER{YZt7(XiKWKA(1xHU; z*%dI}Q{23a)C!{cE4IC(wpAx&%k z@|Dx;tZ>CKvV6(8t_>8t8jOHcNogwzk%UN+4t=Ur@%~cP*;u7*m^d0T#32M%Jv_k< zdOjK<1^(d?a!XxN4xb1RqZAS^h(klW+@ZZN`G<*a$ZfRX^V!+<={X5{b_PBghKXAB zj}cLCs3FTXLI^T6>{g-~AwdM@&pS$}j zIwGhkEmSc|k@39pL{aj7whe0D+O=M6Yl3SD_}~Hoo2ehCaT#%snBwLf3ojGL$n50W z*dpHS=!yb1uJrczvo7(tXxuy08Z$pc*yus(tH{tw98V)HjYuSr9O9gqncDX3b&E1_ zCf`%v_AC%Xso479g5NnLiL=0rb7B7X2?-%__BYqH&4sCz&rB5Xk`sG-2fO|_-{_=4wRYh;4=tfJT;u@}s_SlxxxO}YRh*m0S|3*FUH?KhFPv(*{zf8_%O4sR z!vQVlM`Y1fHNfQ#6}Ez*(3_xtXoDMqvperV#@nAyL>qo*IfAN?dM(FRxEWMAo%Ydi zG9C_}m5DmGF;HWE;vdcokA6my9;Dpyc5&HW?Rb{9a8GA>ZV2ak2*GY}MVNskM3K1= z@x&g9#jdbDnKd(%{OkG%N?yiRvPqoXpy3yOI#Dtp=P{h66HIBvyTxJjMU*_36xxe z8?`yBA#S2e9c4Cd4B1xy-AKwI3yY>@Y{s@Dt65X+baRaoY(imGa=XyFG1967hPHR`ioM1zM=tKp93wX*14Nl!3~rxY?l8 zD5l7;(H=PuGINaFse(DXW{ox|xBhn97QbU@hnIdM-fcbMZZQK#e zysf!Q`DdcYYOlz8U#v32FCQ6FV*+J{utb<@Kb806h-0i+oh|{>8aKvLe48PS8+~J~ zeVK?8&ZHnO1998E*y_MkJGe3OHc0T~(;1r1*vbHk8ubA-FS#LP-cQwo{49gD89d3u zwmaQHuqa$UK2A=u(a{)!_X}o$*oJWy+irA%!Xo!G(SNIZecqsc^|Zx=t92y<>p^SF z)CJr@G?Rx1mnozA!TdztlKeJI{GXz6q|k6K1~9SRE{9?RhYq+tkHkWuym8T^hJvrG z>T7&o0V$EAtor1NX0`xYnXpJwTnUjD+e-_wx=>ZLI`R{7*2p9xyUYwM=HS%ruY>$R z)JV8#5c>`vBcMzAg_*eLh+{B%nC%YCeW#c*AYM#XpU(&usMv={J2S$zIAh9{XRe96X2~4sjHs*P0Z~wDAwenv14k$AmY3w{(P~P? z+7u;&SbXM=!CJ}}J#ci#QI=>8wQDVjSt#lK>mK(dgg*W+xjgEH|)=HT~inO z`JY#3pRFe%|NlOKV8Ays|2rlag$euC>CKXIH-!&Ai=W}&)Oor~5PR63 z;A6p46{t%}spdP{otI|lO73RBlP+2aXGtM=OHt4cGMJExzAR&d$U4FV$@%P|+5ujQ zuk*iGjWzWX1o_F)6~0BXCrS0|=cpq`MqZdb1d(Q}e98B>T7tctaSbqovkx9qWxvhk zmhf;8N~o#q#Bsw+m469f`KdhtCutW&QBMZ%;;RM&VnPnSW=4&r0*5SAV(z|jiRny? zC?7=QZOsV+XMN{|nUsguJ?sY;?>hD@K)>M~p}#pbM20RVW@-W59>jrAMnXQjEua?& zaftfX*WMqTqO-tyOPM1vLF~NgoG~G1uI#E{Aix=yJZ#8LNZk>M0UJ*69DNGQW49FJ zOuM>B8qnt@QYQ7^T6r?8hb~wI7&MjS70QOLhDM=3GkVd#(@nBV$ma)QHN6l?Qn~-eIPv%r7poUs`gwySp#1t>uBWCpXxgM;~c40edrfprknIGO#uaEh%Y#AIsZ*FcHb$SN!`48XWae(Cry2ffrS!oep<$AMlRWek|AVD)%2Ydc~ zIIu7mD-cy$^r=zg7VK|0vKI)^n$Jci-?|CDEKYoF@yb`Fg&{utSfHK@*pfk*B2zBe zmR0TdyRk)2p~t#4Ouf$6iQvinU?@bhH8WH5P>Ki3`mS#t-bWgzFE+ak7#H)9?dKUzV%n@K?)v~Z7JAHghnl=S1HY-j}3JL(!c_}HJ z$Dxn@>qfV3ZZFSGd3PaT&7AMoz*Fr{jMxmcw7ae< zzpHap*q!d8YcM(TdBcP?bo!z?_SNd~K~1=o3I~JM9*Fmy+kh(rGEg0Ll0Qrkv36Zgr%mTi`A^|R8q3aPcmM7PGdqCyg$xzL1 zZCxQd?DN692nu7~f?`&l#FAQi8ak?)_^9Z?H(mYcAK#)UIoI30l3BQcru zelBflsp;FGA!X2cG15|1*A7-<{Vcl6o5wp%UjM~^ICF#!aPq0i=KN@}_66QX-%45D z7n?sKIdm>WLU!~Qa$*7tV+3>aEdH1|y1L+7$gBY;WTn|9?MU--)2*uAR~daP=9@Nk zAk5de1O-43MeKN(LXcI}Sx)zBC_$D!D!j}vB{;&fVmUvElLJ&qehfBCjEjR{5Ao6| zXgMpo8cHM|o7{}W>h-JrKd+BY!dP?h3ui`Z6lF7sWo=Uv(^iKob%ewb#SEz|F;yz?rF_;^O@gl0d)h{%~;Fkx92s)Ky2&(b~Fn z8f{C2_XAvPd>>*7m|cIJ#PAvCYlOy=>fe z>eT~=7;3w2jJ$4Tf3|>?XPb3q1J}DF8|&-OFE8ik=l7>kFJu%H0}~VWb0td8mb>7@ zjXw1mjH|!Ols1PFDE>Ktq8K!;ZxVxMs|>B=fd6##Z<{0Tz|OCCK_ch!vLuhQ%@lG( zE%WQz-(iruyFLd0VjF~sknDpA5Hp*JD9lD-4A&a9(VOAxI0V~F^>e`)YphM)F&&C!I_a+%6iZI)XJ~R)T88!>f~FY8X4pt-w`a6Vt<0@pLBdo4!M;{b%n zBVcK6f4?{_CN(9c;L~2RPOULk>`+t=vq?|f6N^UX-`pU5VQ@thtkcHF5jU~;LV-j7 z(CIUtrq_5#N=d|Rw$O1;a6xP^J8e0hHu*z~n_6pPc{)%9(p{tFCD zA({o`=g%$@?1`%`?S@TO4h}@9sGso6pS@om&Ix!Ne-WQ`Iw!(LM@Ku;D`$Z<*>O1Z zL7ylAaMCKlqPSS;7M6#uqdT4fYBov^p|O!H*&Ffs7!s_uJF8}jk>6My`_pj^$TSaN z5XhwF=_<=w+#Uw6vdUuz#^`O)zyC(n6E7=^4#qVaYSCe=E(Bn>-NvFC7U-+l@F7Nu zVSOFhS;%gI1$`3>`>Ztp5f#ezY|_}!35JYpsPnNi*h=-wMyntZ(v&A+dO+u&E8xc; zXIUvyOtaFCJb&1WzHeCmLK8Kfx{ z!=?>Za>!XHqrVGAqyJfv-7*D4m6qXCCLIjn#Z3i6y#tc)q5Y_}Os{?rTMqe;%jPXq zsjZAHV^Iol46cVO=f#Qws=*NTc%NfW2_jZ&mS>E|_LaNr*b#Y?;T_hdZb)+`oID01uDL`l74-wg({0-%UX#?%^>P5PXSjXlUr?=a(H&y|c5E8~E;% z!f4WygSI(et^ozvmu?c^b2Rgh)Desq0Qg`zZ{*7)t8U>BuT7tkJ~08Wg!p*>#|OBx|p(um9YSz><#&ZRz++E}6Q1#U7UkdZL|GB_sT!wpzIw{H~*z*a5Tfh)Egln8_u!b5cUWSY92H(`1oZv#T>uL(5 z3_*|k6=j90Lxvk3MoRD{9UO|6>+0LFl%*zj8sv2``bbtIahMzk*`~+xrlf3CpKn4D`wMqwNW6;+ zlaUxCWLYDh?hRn0%t((oSQ+832?-;7K8NUg(}GiZdMTPlH-!4?ZFBt`q=S(RR1o>q z&_NmWCHWpa+)`j34M*wE4VwJ+W+FF)3GqLOKx#TJj6)?b6(%{t)7<3qd>kkTj~)Eo zj9QUy#vq4$8Fv4OU}{)P!Qc)iG7gBsElwnh27@r@Kk#iT!wa0sQxqW=#=E|dz=S{;b`~damev;mDP4XDWT*4&<~u#mdvt~JLPQp%S@j< zltB4=I$t-qxSw8}4=@E|cnqvwcRJ3i!QX=ymw=<})cB;s@j=`CRSk9nq(I834-|>Y z^RMx>&X$YpKwneSGF3KHGs^z0Y4CCx9*5N?(>_Q{@akFAT0h~f^>sqKEx+5z2GH(-jkw}iPzb{yhuRGsTP}tGo`*5~mJ)J8hppeci zH43hXONfhq+rIV&FD{UFj};({Z6jkb>Ifr1=MX&d+#gF_J?Fx=hdSQ3=gk%tnzIT$F|Z$xeW| zM%&rySLn9BI*JXA%B|N^bl!-SZ+KfsN4ZmPi!xZ`^?TWG@|F=Ffg!Hc15Kesc*+P5 zmcKYeGzBp6Dgxdx*-9|KF%&Rc&CZnQZ-_LtdgWhSk~~Z*HdRg^2V4@@MnL1uP~XB) zA%~TJ%HT*Wf?xZjQDZXW z^2h}sJ`>lNz;koG9acn0|HNc24*haMe}d-=ckveV2>#=R)z#jE-is7qx)^R01iqwOL=v*DqHG08{{lT zxW1quqBy3#tAcG`d7LsZOTdNN@b6H1n6x)x1H%($0(>vhErW1b?`XLisl*?y%)(1* zEr%ggzlc0FjEs`B7rU&GD-4_FOn%5=G%mRm+u_W#2D9m!c~bXmW-3X+nRHgT46KAP5dTDmvK zHDN--q)p#(2nISn@cDE5YegNobVZ^AN6*zxX(a}^5FR!*HZE=$@*Mb#zAB`L=Hg!B z*hgg;8X6)Qnsom*z90E$deahc>zPKh;Opyass&ENvH7w|oi#uA7MpN6+4BD68n3(nvjFdM&zKI7KQ^sD~Lwzgg&I%lrR0AAzXNSrsg zE{z9`ym(b(YZ@!n40lu2%3eobe{eCO$jlonYmRUrollSq!*LQoSseIPC|_O3GJdPx z&Z9|)xPx-{%aQ=^Y0} zIEoI7mXcE9Dz0v)#y_TVh6unca43b#`z!x%GYiO?1#0~)($t1sGJZx@nVPRp2(_=%8 z-#<{n*(Y`rk}X!F{{_YZAPWBqEdTGf1-QZZ`1zwEB6_>K!N(yjE4y;&G>L8YVGOx0 z$oN&U#x`NJ%Rh7iXe%ixT{tP_?|{24W=^{Q_~xhj`fdxfvwg2OQnURIni`gUxxtT^7@LR)i-?E_C1q}5p^Q-y zk#anw=vs5Hs_fHHNkxWdAgq2j{s1T+j}iY7NM(vBvK`f}9{1~l+Kw)*9*#FNorHv& zg6j5+K+w-fkoVe%_~Z46(_$mE(u>fZ?{;UZ6p(hP=;%{~#KTCBFdsjDRL&Ce`1AAq zFmHFqv=EtiT1)gtf8-fPh zU!$wvVVHOKuwq#^9n6(&M{9BHz`PaY=IlH=bIV5rN3WP+Zf1sygR{1~>(~D1=%$nV zx1~kozSGMM0K9XxR)~m*w^vu;5fR&O`uJ6T5*qm*XRh4!YABIssm#GxNWsr=SM~`v zG#6-R=>K9WGoRwQToSFyyH^&w?j9K#>FFtWf*E`X(@N*&=C%oC5OPNPiW{9*Vd_2H z+&;<|+~9YGVB{tSn)rvwm87T7fu-_nuvg*?qB9S z_O0YRcD;CTzP)e=XmzUf+@BYg$@}r+$8aY9;c{zpWo6RfhGC2Mad!-EG|t-kdV}MV zt&>xdP-0>t$639@0!O?l_NtSY7r%LY>z}`1Pr5thum}hcMY%j&X$R-jii!%r`g}99 zu>rQaYB^cizGOyqbFOsHRG}*N`0QD7t&YB}u8aKzQW6rCU*R+0v@%QX8&T9VFkrjh zn*d(REA@uDI_crFGxx%*KJpZKUT~ZMcMibZJ8|*G?vV2BPtqF5Tp2ybDT|Hc2Yay< zeD%5c`T`uze}Cxd>)+-)-bFPPqC~8nZBJ~8pUhOe1<^%9eiwUS9apsi3!GESF@hr% z+2mNhtP72agP)%;M1PU0D8A7j@TF-}+j>)>h0dVw=x%Odv1%v;0PG(>o@I2F!#D^C z3ifZDc&&h2*|4IdsMxdQdh}ajF&$8~ECe9xsnE-wPk*KRijtZdMyV$!=D%oP4eXN2 z5ma`u^Al$F4y$Mt0OY14ofo7U27)sH^i@DB)$c=daQu=CgM!ra;UTcs$7LpCV}?NCu6b1Fb5kO&X_<7?BDdCJ&8iGQ#irb?s}dZ6quwP=p+-C zTc^&=Z5Z4*hQgcxQL_b_4`e*^IwL z+8ktWKRY{m+x7sSUC==~NFiH`p^r>ZIrf4H=uEw_c&lTq!Y=a-aLMsuKg~|T(U&Sr zrz$tsc<>YJ(2VO-U*qP;0Dz?goV}~~ndVkj0HoDf{nP&uNdk+<+uJ*rYnqFQ2ib~} zt`~R_FxT1TKWAle3hdb0Oqc0~L7#`QpAZ#Sdl3hwu{7mwo(D!dTiLS>;yoCqx`u|n@I7!O0(B)QUZYWG%Jrk( zB)ze>vg%tDe|)%XPa+cx-Hj6@s1SC<#G?Sj6B82(v4M5h83zBlqE1Q6iiJBp87G&QGyy%yUo7aJ|LD2!^PuTPfl;}e~W#KSr7 z>E)I0r+|val!5|jb=^R@fR~gkN=QhUrO`6^2yo>*@mXQ6EqoY4wp72}Y1X}>{Crq$ zgm1v4j~qmkD}ky5f6vXD^xRo1=yqX++I)tcv;)wW$DSKt4b>po7aN!$9;xI$>jD1KlWLuLE;7p)VjhATAN?vD_29iyVzv z?>eM;$avkOGn>lF(3)Sp%=qvjbYgsJDx#RwGs>?YX&IToi@C|mmB(kC%py@$ z%0`E5_V)IlSoI^VN5;o-f&`;!s8qXiL5u@v(JJU5OK`nNg@mA^qZd^HCUEer~7Fzi+r+gye_?ka)p!p*?^8yeNJbHDIj`k`~ttBSBB6 zS;ctD!hA6D`7_xTE)^GA>>SaA*tdjYqSNi$MrwBU!>0&+z_HtAuuq&+d6i#+HVk>n-Y2sR^4m9M~Ow=8-w) z4+vP+B#mBa-tB4ib+<5m=UA5yvo7s9P?&wp>yk-GwFc8iV2KLY{>kxBZNBzC^a+qv zpwtL`mXF0GLG<+g{eL`g{{LZzX>dyP%C&IT<8SX(Tm6vnyT0g2+qBT$PrV@ihi0XQ z*65Uh{6AmQ#o)nV5DAzXWDZ<&OKKMK76CHSiZT|g1;_8knQYzcNG312>1m!W7sQHj zpkHFyel_KYIUnDYL`pD(eP-f$9)>?^OTlCU$z%;fYR2EBun zJK8G@^uO=lcpDH9BPb|paPZ^DD>qrh+WM59olR$<=H~aZK5wk(qehhb2kq>gWW@ye zQ`vD$G~d2?Bk#z@bh*8pZDZ@ySNfWI`{73Xz8??8es*>`GJu%maMc+orOjUv8JoYn z{Q504Z|dKnoQDq9wRjbK6&MuyH}Vm~nB zWh!Nvo}Xz<&NL$+atntB2ju7N-QVNZ)(-FQ+ht~|65$d4CBebLA|*|IZ?dtiYpCrt z(M3~QgtU*T@?e~gkT zLIrkh?Omn4efPn;mXvsbg!%XAntySz zthE)lrp7-%zcwze+Cj^O6EDuSFE|*rz8*;jyPZjMKI+q|SyC0pWfe!!3_TZ42OA1@ z=0Ur^V0rGdkP}U-zn*;h3IN5LqS-*$Bs8LWU?X=y^EDevPp6 zvR5YcF_)GPv$Iz^Ij~k#MAF%1WaPH;@sS?eIocGbe6>=tv4MEje{UCOVlA($oe*R| zY8$F73XZQvVNIQx>iP1OCN|+^^ahqnVC^HOw-rY`}t+3rgQvmFL4tAge)0w*+L8Dc*Zmr!!e3Ga^Knc zH}e$hzwdn1Qj|}6^Pj)vZ7vJUDVT9t_;Ekof#?8vH*MhDfH5V0Dig0PLqECqTv1AT z<^3hgX9u@h1fKrI2lsRYCeibV@~=)lg?etX0rE-G|M{<`gi3FNF#bI5D~!S1c3!eu zwfS(aH%ZDdXQ2uPw0>?AyQwQb?!QL{z&P8K`GuW-o?XR@grgJoR!>S6sCq`h^h-Cq zPhZXK+32OUPsh8%A{EuHVc}s(TIgJE-S9HV3J}tHI*haBKeEo`!g29w@V&&dl;?Tf zRnaO7xhHEXe4WoYU0|@$p!bTuO1*0>pg`k+AMyN(?sEc5Is(18=27|OPCCc}=%ojB zl!egkA>p9?!~%6!CTSZZ9Akm-KFv)#xJ43)>CDxHSR;Y6-pcg})9wE$wOk-n@6#A>g;j&@m$_ zo`8cLBku%gvK*OaqWcdas#`4s%L;eOMAo(~Tu)Y>F=`P`eZC>93ZIe=b;k#*MOatO z%dec@JVjYt_Q$w0M+^+T_V#=ZM_G#7?s-;?rBJPQBX-jWew0NjKKON_y(;Q>`8#m` z0jbb^ELh!gd;f|>L2EqRD?2=jS|eTrR5APAk{}*aGN+lIX-U~UUQ>n;>Un=--GSCO zplLXVYB0fn``6)U`0Z+nXcv`5wi}6d30QmL%F0-{xog2%dS5ffkTL+;Xle=~D3p_+ zj{O6&e&UKh3%Noq8F)ithGmz(@2sjOGtA8LqP!)E*p?qY-6OgW9p%RjPB{-OT1hG{NeM>}tM#<*L^Xe z;j&|37aJ`m6=S`{4xE;kLdLx&mlLHvlvP4dAqE{CA8U*{hjk)yZ1!DoSl0JV4SNv} z>?{fIC>*%yt!Ffr_B~{KX75K&ccIl+Zidy5M4OUc3M>?{D$UK!rKP1VxSrUUSf7t- zYPecVUt=%gY5)f~J}NxU#_zV=3kx~^|bzmH{lX2uNr=-U7D zR;%A7g@`xS#87WKS<;R%VQ?3g-Q%ppJi_=)$tErHGOdE9KcDioLlY^X4AKnLwF((yBTw+%op7^ z#}7&yL{H+VG_IUZ=a}O>DHh$9NH7LJSijSC`TbizM`^*Q2Zbb({IBC;+e7!YPQ73ZEdRN9> z=mp65wKI+nyW-iRhvd%OLJkw@gQUtv5V+55Bno?)Pay=6w7ruZ&Oeh}JFh$N1vl1E zzaF%22j7j>VM-S@-eWy8(fN^}D8k{~3HlmGCGBXJaQWd1EPDj#B7S*$YGey^t$#xb zJPcXY9Vd5gk6SrOpmh95e+6b7k*u%ATaR8tS{>A&9vbueTWGhl3eB@Zv6JOZy0qvj{dA=A=-aDwW?U&($#1`9VpNDJa`R|V%JwD*l0VS zbzP4>O~h-GLf*))q~C0WWMc4l;)-YRjL9w6XWp|00Ez7$pex!JQr z7|&yTZYj=l@6mp>CVZN2Z&I{U@<~4_SPTs+T<%&g5@E)zQB2MDLY#Z^v(pi zuDl$*R#Krk1`$C?077G_wk*yu+o8>O*01l=bz29jQ;0>}%}TRg`N50(Itq9j^fjA? zoio%GQUF{^R%!@>&^%My_0{+b@@;ahjR1amzlMT(r`NVw*vs#F2zGY^6587zPe;Tt zPg{Y=_UY3nkd+sy!pp^lL&f+pN(+c5U4NcBEE&5qm9k>=^oVg+VRInLiGZ7ni_d8} z9_>rq3^-`xGi!k^KM5gGT=&oGqb^MB4OBQ7pxO{OsX+ThW9(~tj&aLMI=}zH+9~|9 z$@B1|WAfAWa|?<6HC;nROXiPW^i^^AEAe9h)hzOS_*PK*X-~*mkb^|^cc+6N)uc#- z~?aMkU&*{uc85q;Yx@-mqD=P;>Ho zjPaC!`gKoa;&zX+=;PY=b$aMEudLF3o9}K>tFUJXN=RK6cKK()-3CK+x!~HF7s6t8 z`}{61X4thLn-pTjXkkJfj)MGse8K!Tp-GZ!R_rWI{rIZDz2eDvN#1r zIFlb$R1lalcvx6ih7RU>Q$1sj$qwdPeAp9f+yqjgVxwd7T(JpUvWT`VyR_l-k(Ps5 zcsBzD#3~v*j0H)$8Yx~Du6?xfAHlW)He1}asFv6qan_5Jld){uafEL^c~1seY6tM> z-L9A)24mZ%7CkO8PX(CnOZym0X`-|>-Xo!=&}a@{GKyj8*U~p_yFO2b z+8Vo_8Y0cRNIX3~jrG(o&DZ}1JC-*Gws$yQ7n?B*Q=`4mIT}tJXVpNE=|$cB)NlD2 zfucz9dYel>>n__NL853oG^8o8V8lS)y=3FpsZE=H(QBd_Xwl03_6RoX=XW<1kB5)< zC`t~a)_gh5zC#_SMOl3paRe%Oq3yK?A%mCXOFq|@)e4c%u*Ze$*S~xJeK0M+3E3Os z&7{`z&GtWlPhOzgcz75IlHSXtO8#>61ti6!SG$U?sqQ6WGr=qZG}ylm!BTW}i+pKr z*Jut$V=y!&K%Ug_(K*)0M^eSX3W8~M+QjU~YLES`^|D7Hr=~D?=YsuHWymCUSR}9K zjpnyrk7GxvFA5pFm1^Z+%b#_TW#40HX(BwwR-ixcA9wfjXTh=8`!XhAMR0!+`el*idkb6G-mMd!gYnsLV-pwG|$;Wne-l!m-EZBGHJogVI^hdq{PHX3d(YD zm{QnP#m!gO(IKjj@KE{KV+ztKjhTC?L6Zk0`^}1QbK`1t*{P}F*g{_G#A(}yiley0 z?ql+D4vcYPM8P&2J6KrI%BS%Wr<)M|r0EKlw#UcD1|V`sM&yNw1jureBAMmoipP7d z1r^^Sl2I*$oh3wZQ2|2iQ2h|IZv=_}3K`=?=tEy`Zyp)iKI|`Kq4dw6<8K)HOy%U{ zKxdz;D8?26x>+Bi?ahB=z7zJoTzoF4cHnDup{%~6u?`ev<6boH@LsM!_H9w)X>(7k zW%ikxVPEznK|{&1KJ6ZBjAG^*>EFmHa}V1`*tX{e^#yNIcL;eh%Jm!8NW!C{Msmc1 zfDGQ)4r1Cl8)*=vi|}x8LI;j$Pp`(oTdM^E>Ri@)fo|>L<&`7oh7bYtktf3f0@Wc% z3&nb%hAh=P=$p~VXsoq|i3fv*F?Bry1H&jGanv#7Et$q~jdY2fsMCQLQeAEkmdRFg z&d6w>6jNA(W!5Q5@y-ho+ryBwbG27^c$!P%jq4vaHiEZi>z|TGWJU#TF775O9-2(2 z?pT{G%MCF-;5B%=hI3dAJcZe~BWZo_^OMYk!jbqv@Phk%%~XRax9cChYEDR2yN~v3 zN$ob*QQn5V3HUdbl}p}R^==AZv37)#g49>`wwd6gbkPQIlpoP!sx6Byl3HBU|pj8vx-3mwR)t!@rf+f&b%*Tf$D|r{7_#m4!tF`YO>ZYNCsmSKn2w z#UR1Z;U(zjf$knKI%x#w7?ZH2HoN^*iq`{Xm);5}wLQ|5$yX3XWv{DCJTFE6)V3C> zhkOfWgIdJ9I#*FqOZ|>+1p%J$ZzI&lxNP&pPF;vdbgPV?pUh&NuZr-%gyreF`+;mt zAoL46|9*zh3y!h5^gx*ElwvY%QK6ea=jZ3= z=}b0@?xlW(u+(*c1{t=)b;5LX++scpX|I&g&6pC&Kd>#_IN z>~kqxB!vA$X}hb)JX9qt39*YP3)?QQND=i@*H5&nCm*!WB-hKDe<*Lja?w0%s_ZD} zWM&gT2rPt44QGU7;Q#ZyqE(EatnuTK@1amP`EO;6eAq}FP#=jrgHjj7xtsB~i>It4 zDSTJ?h<3W2{lNlfhoe##$6;8fKK#1V`nxk$dXcBZCk5X{Rg_q?rK^& zGW-&%I|w`-XSq#|>Ib_Q8wm$kmhxvK8+jti1u=)8dc6j}MHp#Y8ln?V##qGQ`r*%u zq9E1@?|iWJDz|(2_DitJ(rHPWp(q=pI+rsmkI7}-f?R<7=W(bN+V(1nCaH2*(Y~Y?%8H88$aKdFwP~Z0 z6wV_cv}g=N9Vu6)1*G<_Cn5ccYN44%r^ljjfuLgFuFmmSw}Limnq?FWwDh6vsPypv6`y* zFmYcTQ}@K0Y$=PitTUIpaEfs3B4%)!<%J6zn*wHA3g0}eo|6dFRcX31*U^8~eWdzr zMl-oa5u>bV^oqQ%p?)O4BvsD-*elQ{lIUZ+K@qL|a0T3_xx2<7eXYnEiwPJe?LOXD zMQ;9Ya$3@UYYb*>P8;*FI}SFykT?CH1u<%8k3}%DGPywQm6!*A+D!d`YM<|zJH9@FUKzGK^=Eg=2i1g9U#zw>yFti|7leZxCcVtChgocJ< z$<8k<c}0g&*>opIKgS}^ql2unx8LF5TMlQy|AjVK z6Wm6KLHVuGYGj4&rpqLdnJCi?>+OjP;W?N)kr{{;SGRKczm2qbL_y5cqKTp0eBtE4 zOBt^qDG3`d;I^s218+yo1ojKkoDo^~#C!}?RAG?Jc7f5nF7oWNGEd?}gqXRdWuAo2 z=WFK#AO71!q`GS5wqKRlgj`=jo5jm42FeEt49|5?4+v~gWve^ud{Xq?JU}Y1q?9xLgJ4NjFNKsh!f;Z;nR5gaL0r22@zH7* z){_onf-31BBY?R|q7W90lVUZL*3q&a+sY0yY>bVcEkKMp*d}4jpctP+P_X`hP5PbO z>({~GCvADZghG;Ec~q&&$sw=lA)Nq0Kbjq?e+I`CVGYExYUEJuv=i`=K8d`4!ixwO zvPFDw$n{&iIm2UR$jHckiz8uH(?I0Tpx?gXUq2*F04cuh5{=Tp!ydsHLXg7`6!6gS zfzduPLAx}WB5KI+RL9ddjG;-%ozd_X{wHen9`o_r+pq=oUFjk>>b#HayRvm3v9tVO z>mu-3h+!5zv&VVAV)jZa7D^y_glVHP;ni=qw*#?+f?kGA1CB>GuLCEA&WQQLgF!W& z{+EPh*X|6MbOfkvg;cZW7N&6gYBC#%9iOysBSf=UgMxwr*sp@0Nl~lH%cFF%gc}q+ zBi7N?)zr{9ySV6-DXOxYVS|gt!h|Sv7jMDxg{xu(ck&;h+!2zJ#-U>iP;*E}`WO&Y z@;ffRN{jvg9BgUG=$*qH4E3FcRl;emApa3eZWx07Rut1ll~f192$6!)l}@}xX7M`m z8XEY|V$k%0yVBNS1jyi0RY>X~SJ8^bijz{pRpje@g>;^=$Z$9DH&-9SPpFj02;q__ z)*Af-0;&mh$Tp$_T;jL*;9{!qvpVF0rCdnf_p!YT@l}1kF^h5&p2@j@gp4eKti)*f zOn@v*rS!W6ZbfQ^4H(!w4|C8TThH$JK9dzdPX}NK1b%mV>gT9aTNP5 zwKz#B54I>qXbZN)WJV_f$9<#E6#qv(Lx*8n{;O=p=S4|4lbmFPC7eEmIRXS^ z&H|PP!ab)h<`w^vy_YdrHszSyXk`5IOSlsWN4RsQB~ki zH|WPN%E`+LjkrHvV#PvuNciuq8%E8IzRDG0168gMgnH0Q`szS>yc2X#!i0~1{6KaB zno#Kj*CH-KTo2OuIckdZ{uZxn= zwn4WA%V*xUZUw5xx4TppT8kkq-<*)}-$xXAX2OK`8#{Zj|46c{~ zBydDwJS8gAVC_6BaQX1T8y0AnWL(rx3`%+WUR>Kc62iAZ*Rs8$;qy?U_#MsOOQyBD z%H-a_*nQ1H=Vb89EnxT+5ITV`YVn|3;CX6h-}*NDxFP_9;-=DPO0Yt@;B zg~ip)4ag}#_m1z-fV{>35xC>Nq@GH0_*yxGUo661`}zo(mz_t$gBiFxyMJ;h6F z-76&r-va`?rbxZQDVb6x5*w0oZsT}w=r*meewSBhRDAroC}4eN+b6--TQ(GzUdbMe z3jlVvpK(2Fpd*Wkh6a}Rr!BJdC5{|$#(+8)Y?8n`1)NyySJ&4b9v2QzeY%664y451&)}8 zzT32*^&ND-YXpcj>3(3wHyHqS&kf)fZ1w;Kzoix*+|rtw8ep~vMGKt-9=P9{3ved3 z98jN!>%So5lcrdsgq;K=ws#UK&`!cHXC+?W*=;Z8?3Z&XZ+w1pP&>GOh;%3uXeHI4 zoPN|NYa6F~QWx^p;%)4cABSnRNp&`ATVGeH`UfuGW{4j==cu*Zo~D?bM8l@4mA@w9T+a_}fCOPO#AXy0w*@ z@)3vBsY{UQeru)y+2FVJr?Xk4w|*f7aSeLAeinL>qU)ZSdz@8<&9lqAt5P}zB8+a} zmtG{P74zI3Q|k3xC89ype&Ct14jh9)ZRt3j;b4;H(2xRdw*J#aUcKRuQE7MH_TE>^ zzX-{Ht7*BwWLRw-xapcdw;5}cUBVB_ZJmi=eBg>Jg9x~Ds$r8a)CL> zv*kiui`DYB4iolqQ$f@)$g8B{pEm}VhC-e?n(9B#5wq{2&1~#0(PI}csy>N);l0mD z;W=*K1*ZLi$_ex>sr>R(N{dtJ+X(GH=_hg*^Fs4DQ5Tnv4Ws&P-S?3HN<2^pb44kr z|9eMBB=(gmS@X0R3sa;e9~Z0ETM3JLTGIbBWWX$PeKjjcSnX!)JOeTP!L{*^E1CZP z{1pm#C==d*>RoWW0$pF^O+=+?>D0QXYgJeKzJ|Hg0)p3N}6#fZ0|TfSkn1*PKRPxA_^UWhe(<5dMs!<>BIM$kq8L*ox21=Wb`- z7y7!4oy2Mn&06?H*EqWf14g7L87e*4J>ma-S!{hQ>henoxrpXMyYdE@O1kpas7-M| z=9MO|M+j848kw;*;B!&qm$mWOlYxxfs;z@;v9?!4L?kvYgKghhVwa}SW%+m;xX`Jm zTTJ%7cRK4rLP9{)l|2y|0c$FAhTi-rNeQ4|zWZJ`)O+M|CHwCUSqRf70e;>iMguEHTM{9wSs`sTKB}L|Kf=d1M{z+T_-ix$+7n z2ut`LS;)Ofu&wKJo0PS`b09(HGci3kw=^>>{EW%t6y>$tNPUf)#Bl!CVNIreNwzu< zbT*2>=Tz?j-)udx+`~;rMJphZ(R1K=deUxjh?DbqbCopwL+|EvZWROjBi0sfY=W}9 zq=h#>eLIqvjLb|&b&^Dp;IL_%h93qusWi%YYlVI4D|{o?QFebs#ei7PY_59wTneH> zMqouL1P`v)mF^LUv~1zn|(c zq|%QT=LY#*QDeKP%{E+n5*8Ap4QTRkjisVbGg2I+H66?qVDc2CzFW)FeH3oG+C@?Op07OQP)cC6`YXiofI zxWJ5GUE_vpnVRprU(&S$x;4Sn2L+84@iNC7R~3>_@&+}(nv8D3^;zpbrYyox8SC`L z1kHNl`4`FopTn6x_J>2D(M0^eT~`j*6aTpf3>rUHPtsm+)-~=wgXemDc%BYIv`D8D zxtc!fmZ}xM#A*F=1w#dqqZ`>cP8TU54&=u7nUqCLS6ajGv>Y&zU&(z+o_i~uphK;? z%_mDPW)xiLe$P1!6}=$}_odFOO(+#TD;;K$!{D(g_IvM+T|_kd@~g$UxW0GIY&6(Fl$J4 zB_%u=G=NB-5$yuY*6`}cNNl_j_Mepjza#|2PZTTMR^;m~<$V6M@q%o5mS;#jmFL5< zn39wN42?}E<>aW^LpsAJr{|Y4u3nb;NbfBgUVBh}X|31CD2F7ZuFdH*ch(h$(&``1 z!3a|z?-%X9mu#5DQf1ls(;!bdnZeeiEk@s_=S-IoK}3jg!M`$GO9`cuPw{u2SLd}SlxkdH@|`ncWztRCK9b6(s^IH(u-l{#Xu?`# zjTfOjmo0PLV5*9d;>_K7AyxQ+)oz`!I(mRC=6lxH_)6@~nprZ%h?Ha1P!X`qsQ+h~ zDNrNMVJ~vBuP7>MlAWAgSsB^cnPy*vj~XPs!K{gX&#h5}iS|D}?UJdT;CIn2oonDr zGYsq)!sO!6>)BOl2a7vccg@{Nucas{ya^Ni%FdoliV zVw%6{{h8K{K_Dz9`1U2vf{+hfq|B11vxDtepd62Y$UHwsSxF&AHKRe?SY`89LfWeA$k;H53Dr3=7<4k9Up8+}1cp!-U?%_U}HRgFia5xGH2-ueeq95ozuuH5k-qdyle zDn9WkIW9k!SRFHbpaRiyNDdK@_eLr@FQUFWr4n)KDz2S!mLYy->#jm|e^Dl8@UI*1 zpOue#VCd&Br`;_yv>0=Fmhvob|3GW0vf3yo5G2^CMJjt)%I^?Cjm;99HZ|8(`K3&a zP5X1JdzUaJ+*B0-DWrOc&qON7^2&pfgJo`nsBf$>y7QNa55G5M-}N znO;DljGvTre&8w__{EI(<|Wv-K%5>^oltw#mkMZcMO$^zH!|qHXdqS&Wh5Bv_3sFv zLL8=GLMn~>PHRRMMyEsX(WDZbB;o(s=Q*G%$ZIA59{N8=1VQuj^P6vl+v$|CE)kf@ zi;F=an#7w=SRw^w+sA?<@cbNCl5UsT^?q^1sTkJ`E&Qtin|AvvtV?8#`RQpH&%$${J`RIfC)$m83Jn7We^p;LnS4#( zzXL>wlAS%tW_V%(HxA@G0M&Dd$@C><#<$v9W>(fIc3d!bv=@xJcsMsctMrU~t5_sX zWN^HW9ug#k<-wIVZ=XKGULSRViB@*W!gM(Kz#RfLX!G|0wHkm6UId(}zJ49ub|%Jo zhxhky zDuBajgL11A$nU_fWjY0-F2Gm_V?{SNwS#4S9?e0YWO#p} zp;`yfyE0e)Vgx{U87ZTd`4vyho$b9A^XpgCBWW7A6G_7PcsnmHWkvl&*xE|^zUJOv zHg^Vn6Ku?)KOeAbPhXrJNU3lpmMH=UaR9INfOr@{4tH(1Vp9N60ZGP2gW)A9yzGypQwkw zQ2_j-{w$54T2@d{5Cx8}9(W9RvD!uf`0BVZe^wtWc)(yux|JT!kgBr=+5S043sda~R;=Lz~YO%ilHwN*3d}qqQ|K z2eR^%8Og?@&7LLjFM9(HhO>Q)5F0$Be2Zkr{Q}gw7Cw9aTQ?~rLW`VBpDtTD!<+MZ zKd!$rTWRZ05RG``(a}*=6~_}Tyu6&43kFeSfpe)2UJU3n??Zs`!TX4ki)iD$g!j(Y zRy6d5Ns-$1u=ZQ*PBy)7NUD24BCjGMCML$h`T<@P7^N$qqy|0Su1p{nfoq^M;eo)T zw|=Nno1VJ5soZnT5y3i-BR83{S51BOi{K|zEju~z&#EfoY0BQ7Jw?*P5{(2_IOC}G aLs0+F?ukrV4AwL7BPXpSRRJ*${l5Ug4qMm& literal 0 HcmV?d00001 diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 6f9ab33923..5712daf23f 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -31,6 +31,8 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win [Upgrade Readiness doesn't show IE site discovery data from some devices](#upgrade-readiness-doesnt-show-ie-site-discovery-data-from-some-devices) +[Disable Upgrade Readiness](#disable-upgrade-readiness) + ### Devices not showing up @@ -153,6 +155,23 @@ Finally, Upgrade Readiness only collects IE site discovery data on devices that [comment]: # (Device names are not showing up properly? Starting with Windows 10 1803, the device name is no longer collected by default and requires a separate opt-in by setting HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowDeviceNameInTelemetry:DWORD == 1. This is done by default if you run the latest version of the deployment script, or can be set via policy. If the policy is not set, then the device name will show up as "Unknown (aka.ms/analyticsDeviceName)") +### Disable Upgrade Readiness + +If you want to stop using Upgrade Readiness and stop sending diagnostic data data to Microsoft, follow these steps: + +1. Unsubscribe from the Upgrade Readiness solution in the OMS portal. In the OMS portal, go to **Settings** > **Connected Sources** > **Windows Telemetry** and choose the **Unsubscribe** option. + + ![Upgrade Readiness unsubscribe](images/upgrade-analytics-unsubscribe.png) + +2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the diagnostic data level to **Security**: + + **Windows 7 and Windows 8.1**: Delete CommercialDataOptIn registry property from *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection* + **Windows 10**: Follow the instructions in the [Configure Windows diagnostic data in your organization](/configuration/configure-windows-diagnostic-data-in-your-organization.md) topic. + +3. If you enabled **Internet Explorer Site Discovery**, you can disable Internet Explorer data collection by setting the *IEDataOptIn* registry key to value "0". The IEDataOptIn key can be found under: *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*. +4. **Optional step:** You can also remove the “CommercialId” key from: "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection". + + ## Other common questions ### What are the requirements and costs for Windows Analytics solutions? From fe72d455b1d042a7629e81b331786c73b0fe7cc0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 21 Mar 2018 14:10:37 -0700 Subject: [PATCH 5/7] update mb daily usage --- ...equirements-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 3027bbe7f9..368f43a52c 100644 --- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/17/2017 +ms.date: 03/21/2018 --- # Minimum requirements for Windows Defender ATP @@ -68,7 +68,7 @@ The hardware requirements for Windows Defender ATP on endpoints is the same as t #### Internet connectivity Internet connectivity on endpoints is required either directly or through proxy. -The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to communicate with the Windows Defender ATP cloud service and report cyber data. +The Windows Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Windows Defender ATP cloud service and report cyber data. For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) . From 4e510d198258c4a74ca843c5469d9df424ee841a Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 21:11:50 +0000 Subject: [PATCH 6/7] Merged PR 6531: ApplicationManagement policies in Policy CSP - added 2 new policies --- ...ew-in-windows-mdm-enrollment-management.md | 4 + .../policy-configuration-service-provider.md | 6 + .../mdm/policy-csp-applicationmanagement.md | 146 ++++++++++++++++++ 3 files changed, 156 insertions(+) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 66cacb8036..5904341127 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1147,6 +1147,8 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter
  • ApplicationDefaults/EnableAppUriHandlers
    • +
  • ApplicationManagement/MSIAllowUserControlOverInstall
    • +
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
  • Browser/AllowConfigurationUpdateForBooksLibrary
  • Browser/AlwaysEnableBooksLibrary
  • Browser/EnableExtendedBooksTelemetry
    • @@ -1659,6 +1661,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

    Added the following new policies for Windows 10, version 1803:

    • ApplicationDefaults/EnableAppUriHandlers
      • +
    • ApplicationManagement/MSIAllowUserControlOverInstall
      • +
    • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • Connectivity/AllowPhonePCLinking
    • RestrictedGroups/ConfigureGroupMembership
    diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index debb631fa9..914f916fa6 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -225,6 +225,12 @@ The following diagram shows the Policy configuration service provider in tree fo
    ApplicationManagement/DisableStoreOriginatedApps
    +
    + ApplicationManagement/MSIAllowUserControlOverInstall +
    +
    + ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges +
    ApplicationManagement/RequirePrivateStoreOnly
    diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 47b9d1e09d..4abd17e1d1 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -11,6 +11,8 @@ ms.date: 03/12/2018 # Policy CSP - ApplicationManagement +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -43,6 +45,12 @@ ms.date: 03/12/2018
    ApplicationManagement/DisableStoreOriginatedApps
    +
    + ApplicationManagement/MSIAllowUserControlOverInstall +
    +
    + ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges +
    ApplicationManagement/RequirePrivateStoreOnly
    @@ -538,6 +546,144 @@ The following list shows the supported values:
    + +**ApplicationManagement/MSIAllowUserControlOverInstall** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1803. This policy setting permits users to change installation options that typically are available only to system administrators. + +If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete that otherwise would be halted due to a security violation. + +If you disable or do not configure this policy setting, the security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed. + +If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user. + +This policy setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed. + + + +ADMX Info: +- GP English name: *Allow user control over installs* +- GP name: *EnableUserControl* +- GP ADMX file name: *MSI.admx* + + + +This setting supports a range of values between 0 and 1. + + + + + + + + + + + +
    + + +**ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Added in Windows 10, version 1803. This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system. + +If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers. + +If you disable or do not configure this policy setting, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer. + +Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders. + +Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure. + + +ADMX Info: +- GP English name: *Always install with elevated privileges* +- GP name: *AlwaysInstallElevated* +- GP ADMX file name: *MSI.admx* + + + +This setting supports a range of values between 0 and 1. + + + + + + + + + + + +
    + **ApplicationManagement/RequirePrivateStoreOnly** From 77200ef8b93f78e0a7cf5c4f22057513e8e4cd63 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 21 Mar 2018 14:30:21 -0700 Subject: [PATCH 7/7] set redirect in TroubleshootUR topic; removed from TOC --- windows/deployment/TOC.md | 1 - .../upgrade/troubleshoot-upgrade-readiness.md | 40 +------------------ 2 files changed, 2 insertions(+), 39 deletions(-) diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 60b97c2e42..db15a838fa 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -241,7 +241,6 @@ ##### [Step 2: Resolve issues](upgrade/upgrade-readiness-resolve-issues.md) ##### [Step 3: Deploy Windows](upgrade/upgrade-readiness-deploy-windows.md) ##### [Additional insights](upgrade/upgrade-readiness-additional-insights.md) -#### [Troubleshoot Upgrade Readiness](upgrade/troubleshoot-upgrade-readiness.md) ### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) #### [Get started with Update Compliance](update/update-compliance-get-started.md) #### [Use Update Compliance](update/update-compliance-using.md) diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md b/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md index a837d861dc..e020be4aad 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md @@ -1,39 +1,3 @@ --- -title: Troubleshoot Upgrade Readiness (Windows 10) -description: Provides troubleshooting information for Upgrade Readiness. -ms.prod: w10 -author: greg-lindsay -ms.date: 04/19/2017 ---- - -# Troubleshoot Upgrade Readiness - -If you’re having issues seeing data in Upgrade Readiness after running the Upgrade Readiness Deployment script, make sure it completes successfully without any errors. Check the output of the script in the command window and/or log UA_dateTime_machineName.txt to ensure all steps were completed successfully. In addition, we recommend that you wait at least 48 hours before checking OMS for data after the script first completes without reporting any error. - -If you still don’t see data in Upgrade Readiness, follow these steps: - -1. Download and extract the [Upgrade Readiness Deployment Script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). Ensure the “Pilot/Diagnostics” folder is included . - -2. Edit the script as described in [Upgrade Readiness deployment script](upgrade-readiness-deployment-script.md). - -3. Check that isVerboseLogging is set to $true. - -4. Run the script again. Log files will be saved to the directory specified in the script. - -5. Open a support case with Microsoft Support through your regular channel and provide this information. - -## Disable Upgrade Readiness - -If you want to stop using Upgrade Readiness and stop sending diagnostic data data to Microsoft, follow these steps: - -1. Unsubscribe from the Upgrade Readiness solution in the OMS portal. In the OMS portal, go to **Settings** > **Connected Sources** > **Windows Telemetry** and choose the **Unsubscribe** option. - - ![Upgrade Readiness unsubscribe](../images/upgrade-analytics-unsubscribe.png) - -2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the diagnostic data level to **Security**: - - **Windows 7 and Windows 8.1**: Delete CommercialDataOptIn registry property from *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection* - **Windows 10**: Follow the instructions in the [Configure Windows diagnostic data in your organization](/configuration/configure-windows-diagnostic-data-in-your-organization.md) topic. - -3. If you enabled **Internet Explorer Site Discovery**, you can disable Internet Explorer data collection by setting the *IEDataOptIn* registry key to value "0". The IEDataOptIn key can be found under: *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*. -4. You can also remove the “CommercialId” key from: "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection". **This is an optional step**. +redirect_url: /windows/deployment/update/windows-analytics-FAQ-troubleshooting +--- \ No newline at end of file