diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md index 78978d8119..fbd10a4080 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md @@ -20,8 +20,8 @@ Included examples: - [Example 4: Connect directly if the host is in specified subnet](#example-4-connect-directly-if-the-host-is-in-specified-subnet) - [Example 5: Determine the connection type based on the host domain](#example-5-determine-the-connection-type-based-on-the-host-domain) - [Example 6: Determine the connection type based on the protocol](#example-6-determine-the-connection-type-based-on-the-protocol) -- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-IP-address) -- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-IP-address-matches-the-specified-IP-address) +- [Example 7: Determine the proxy server based on the host name matching the IP address](#example-7-determine-the-proxy-server-based-on-the-host-name-matching-the-ip-address) +- [Example 8: Connect using a proxy server if the host IP address matches the specified IP address](#example-8-connect-using-a-proxy-server-if-the-host-ip-address-matches-the-specified-ip-address) - [Example 9: Connect using a proxy server if there are periods in the host name](#example-9-connect-using-a-proxy-server-if-there-are-periods-in-the-host-name) - [Example 10: Connect using a proxy server based on specific days of the week](#example-10-connect-using-a-proxy-server-based-on-specific-days-of-the-week) diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md index d3ac315e96..43cc104e63 100644 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ b/devices/surface-hub/first-run-program-surface-hub.md @@ -425,7 +425,7 @@ This page will attempt to create a new admin account using the credentials that In order to get the latest features and fixes, you should update your Surface Hub as soon as you finish all of the preceding first-run steps. -1. Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#using-wsus). +1. Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#use-windows-server-update-services). 2. Open Settings, click **Update & security**, then **Windows Update**, and then click **Check for updates**. 3. If updates are available, they will be downloaded. Once downloading is complete, click the **Update now** button to install the updates. 4. Follow the onscreen prompts after the updates are installed. You may need to restart the device. diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index 4fd03e659e..798952d528 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -12,7 +12,7 @@ localizationpriority: medium --- # Hybrid deployment (Surface Hub) -A hybrid deployment requires special processing in order to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-prem](#hybrid-exchange-on-prem), and [Exchange hosted online](#hybrid-exchange-online). Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) +A hybrid deployment requires special processing in order to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-prem](#exchange-on-prem), and [Exchange hosted online](#exchange-online). Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) ## Exchange on-prem Use this procedure if you use Exchange on-prem. diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 67ea8b50ad..e41075f908 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -92,9 +92,9 @@ Once you've determined deployment rings for your Surface Hubs, configure update > If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates). -## Use Windows Server Update Services (WSUS) +## Use Windows Server Update Services -You can connect Surface Hub to your WSUS server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them. +You can connect Surface Hub to your indows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them. **To manually connect a Surface Hub to a WSUS server:** 1. Open **Settings** on your Surface Hub. diff --git a/devices/surface-hub/surface-hub-administrators-guide.md b/devices/surface-hub/surface-hub-administrators-guide.md index 275dd6a33b..4786082d45 100644 --- a/devices/surface-hub/surface-hub-administrators-guide.md +++ b/devices/surface-hub/surface-hub-administrators-guide.md @@ -16,7 +16,7 @@ localizationpriority: medium This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers. -Before you power on Microsoft Surface Hub for the first time, make sure you've [completed the checklist](prepare-your-environment-for-surface-hub.md#prepare-checklist) at the end of the [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) section, and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct. +Before you power on Microsoft Surface Hub for the first time, make sure you've [completed preparation items](prepare-your-environment-for-surface-hub.md), and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct. ## In this section diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 4c35222e31..c2263b5065 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -91,7 +91,7 @@ To download the required frameworks for the Surface app, follow these steps: ##Install Surface app on your computer with PowerShell The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. -1. Using the procedure described in the [How to download Surface app from a Windows Store for Business account](#how-to-download-surface-app-from-a-windows-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. +1. Using the procedure described in the [How to download Surface app from a Windows Store for Business account](#download-surface-app-from-a-windows-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 2. Begin an elevated PowerShell session. >**Note:**  If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app. 3. In the elevated PowerShell session, copy and paste the following command: @@ -119,7 +119,7 @@ Before the Surface app is functional on the computer where it has been provision ##Install Surface app with MDT The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image. -1. Using the procedure described [earlier in this article](#how-to-download-surface-app-from-a-windows-store-for-business-account), download the Surface app AppxBundle and license file. +1. Using the procedure described [earlier in this article](#download-surface-app-from-a-windows-store-for-business-account), download the Surface app AppxBundle and license file. 2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. 3. On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows: diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index dcfe03beba..766978b300 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -728,7 +728,7 @@ To implement this method, perform the following steps: Put the student information in the format the bulk-import feature requires. 2. Bulk-import the student information into Azure AD. - For more information about how to perform this step, see the [Bulk-import user and group accounts in Office 365](#bulk-import-user-and-group-accounts-in-office-365) section. + For more information about how to perform this step, see the [Bulk-import user and group accounts into Office 365](#bulk-import-user-and-group-accounts-into-office-365) section. #### Summary @@ -1851,4 +1851,4 @@ You have now identified the tasks you need to perform monthly, at the end of an * [Manage Windows 10 updates and upgrades in a school environment (video)](https://technet.microsoft.com/en-us/windows/mt723347) * [Reprovision devices at the end of the school year (video)](https://technet.microsoft.com/en-us/windows/mt723344) * [Use MDT to deploy Windows 10 in a school (video)](https://technet.microsoft.com/en-us/windows/mt723343) -* [Use Windows Store for Business in a school environment (video)](https://technet.microsoft.com/en-us/windows/mt723348) \ No newline at end of file +* [Use Windows Store for Business in a school environment (video)](https://technet.microsoft.com/en-us/windows/mt723348) diff --git a/education/windows/images/mc-dnld-others-teacher.png b/education/windows/images/mc-dnld-others-teacher.png index 24fa7ae20d..aa5df16595 100644 Binary files a/education/windows/images/mc-dnld-others-teacher.png and b/education/windows/images/mc-dnld-others-teacher.png differ diff --git a/education/windows/images/mc-install-for-me-teacher.png b/education/windows/images/mc-install-for-me-teacher.png index 7bc90ad129..e303e63660 100644 Binary files a/education/windows/images/mc-install-for-me-teacher.png and b/education/windows/images/mc-install-for-me-teacher.png differ diff --git a/education/windows/images/minecraft-assign-to-people-name.png b/education/windows/images/minecraft-assign-to-people-name.png index e39891698b..38994cc58f 100644 Binary files a/education/windows/images/minecraft-assign-to-people-name.png and b/education/windows/images/minecraft-assign-to-people-name.png differ diff --git a/education/windows/images/minecraft-get-the-app.png b/education/windows/images/minecraft-get-the-app.png index f30ab8ac68..47024aab6c 100644 Binary files a/education/windows/images/minecraft-get-the-app.png and b/education/windows/images/minecraft-get-the-app.png differ diff --git a/education/windows/images/minecraft-student-install-email.png b/education/windows/images/minecraft-student-install-email.png index aa562a0f01..225e8d899e 100644 Binary files a/education/windows/images/minecraft-student-install-email.png and b/education/windows/images/minecraft-student-install-email.png differ diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 7c05de544c..e4002090f5 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -25,11 +25,9 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. -> **Tip!** +> [!TIP] > To exit **Take a Test**, press Ctrl+Alt+Delete. - - ## How you use Take a Test ![Use test account or test url in Take a Test](images/take-a-test-flow.png) @@ -47,7 +45,10 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme 1. Sign into the device with an administrator account. 2. Go to **Settings** > **Accounts** > **Work or school access** > **Set up an account for taking tests**. 3. Select an existing account to use as the dedicated testing account. - >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. + + > [!NOTE] + > If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. + 4. Specify an assessment URL. 5. Click **Save**. diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 27e652ad9d..1a99cdae1a 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -52,7 +52,7 @@ After Minecraft: Education Edition is added to your Windows Store for Business i You can install the app on your PC. This gives you a chance to work with the app before using it with your students. 1. Sign in to Windows Store for Business. -2. Click **Manage**, and then click **Install for me**. +2. Click **Manage**, and then click **Install**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) @@ -65,18 +65,17 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to Windows Store for Business. 2. Click **Manage**. - ![Minecraft Education Edition product page](images/mc-assign-to-others-teacher.png) + ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) -3. Click **Assign to people**. - - ![Assign to people](images/minecraft-assign-to-people.png) +3. Click **Invite people**. 4. Type the name, or email address of the student you want to assign the app to, and then click **Assign**. + ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) + You can assign the app to students with work or school accounts.
If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Office 365 portal where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. - ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) **To finish Minecraft install (for students)** diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md index 446346aa98..5794aa6c8a 100644 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -11,8 +11,6 @@ ms.prod: w10 # How to Create a Connection Group with User-Published and Globally Published Packages - - You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) @@ -46,8 +44,7 @@ You can create user-entitled connection groups that contain both user-published   - -**How to use PowerShell cmdlets to create user-entitled connection groups** +**How to use PowerShell cmdlets to create user-entitled connection groups** 1. Add and publish packages by using the following commands: @@ -67,7 +64,7 @@ You can create user-entitled connection groups that contain both user-published **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** -**How to use the App-V Server to create user-entitled connection groups** +**How to use the App-V Server to create user-entitled connection groups** 1. Open the App-V 5.0 Management Console. diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md index e69999a07a..8f5736d581 100644 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md +++ b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md @@ -45,9 +45,7 @@ You can create user-entitled connection groups that contain both user-published -  - -**How to use PowerShell cmdlets to create user-entitled connection groups** +**How to use PowerShell cmdlets to create user-entitled connection groups** 1. Add and publish packages by using the following commands: @@ -67,7 +65,7 @@ You can create user-entitled connection groups that contain both user-published **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** -**How to use the App-V Server to create user-entitled connection groups** +**How to use the App-V Server to create user-entitled connection groups** 1. Open the App-V 5.1 Management Console. diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md index 37f02d475b..e80df8bb75 100644 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md +++ b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md @@ -15,7 +15,7 @@ ms.prod: w10 Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. -**What to do before you start** +**What to do before you start** 1. Review and install the software prerequisites: @@ -143,8 +143,6 @@ Use the following procedure to install the Microsoft Application Virtualization **Note**   The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter. -   - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md index 5210d0f706..a3e6644896 100644 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md +++ b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md @@ -15,7 +15,7 @@ ms.prod: w10 Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. -**What to do before you start** +**What to do before you start** 1. Review and install the software prerequisites: diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md index cc477758ac..780141e3d7 100644 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md +++ b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md @@ -27,7 +27,7 @@ This topic explains the following procedures: - [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) -**To add and publish the App-V packages in the connection group** +**To add and publish the App-V packages in the connection group** 1. To add and publish the App-V 5.0 packages to the computer running the App-V client, type the following command: @@ -35,7 +35,7 @@ This topic explains the following procedures: 2. Repeat **step 1** of this procedure for each package in the connection group. -**To add and enable the connection group on the App-V client** +**To add and enable the connection group on the App-V client** 1. Add the connection group by typing the following command: @@ -47,7 +47,7 @@ This topic explains the following procedures: When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. -**To enable or disable a connection group for a specific user** +**To enable or disable a connection group for a specific user** 1. Review the parameter description and requirements: @@ -88,9 +88,7 @@ This topic explains the following procedures:
-   - -**To allow only administrators to enable connection groups** +**To allow only administrators to enable connection groups** 1. Review the description and requirement for using this cmdlet: @@ -126,8 +124,6 @@ This topic explains the following procedures: -   - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). ## Related topics diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md index 695e3e6d58..8c0e37ebc8 100644 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md +++ b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md @@ -27,7 +27,7 @@ This topic explains the following procedures: - [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) -**To add and publish the App-V packages in the connection group** +*To add and publish the App-V packages in the connection group** 1. To add and publish the App-V 5.1 packages to the computer running the App-V client, type the following command: @@ -35,7 +35,7 @@ This topic explains the following procedures: 2. Repeat **step 1** of this procedure for each package in the connection group. -**To add and enable the connection group on the App-V client** +**To add and enable the connection group on the App-V client** 1. Add the connection group by typing the following command: @@ -47,7 +47,7 @@ This topic explains the following procedures: When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. -**To enable or disable a connection group for a specific user** +**To enable or disable a connection group for a specific user** 1. Review the parameter description and requirements: @@ -88,9 +88,7 @@ This topic explains the following procedures: -   - -**To allow only administrators to enable connection groups** +**To allow only administrators to enable connection groups** 1. Review the description and requirement for using this cmdlet: diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md index deb1811f39..0d98c22478 100644 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md +++ b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md @@ -31,7 +31,7 @@ This topic explains how to: - If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. -**Update an application in an existing virtual application package** +**Update an application in an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -46,8 +46,6 @@ This topic explains how to: **Important**   If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. -   - 6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. 7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. @@ -55,16 +53,12 @@ This topic explains how to: **Note**   The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. -   - 8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. 9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. - -   + You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.   10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. @@ -72,7 +66,7 @@ This topic explains how to: 11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. -**Modify the properties associated with an existing virtual application package** +**Modify the properties associated with an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -111,11 +105,9 @@ This topic explains how to: **Note**   To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. -   - 6. When you finish changing the package properties, click **File** > **Save** to save the package. -**Add a new application to an existing virtual application package** +**Add a new application to an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -130,8 +122,6 @@ This topic explains how to: **Important**   If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. -   - 6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. 7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. @@ -139,8 +129,6 @@ This topic explains how to: **Note**   The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. -   - 8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. 9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. @@ -154,8 +142,6 @@ This topic explains how to: **Note**   You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. -   - 12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. @@ -166,7 +152,6 @@ This topic explains how to: ## Related topics - [Operations for App-V 5.1](operations-for-app-v-51.md)   diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md index bb5bf4b894..a1e697e16a 100644 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md +++ b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md @@ -31,7 +31,7 @@ This topic explains how to: - If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. -**Update an application in an existing virtual application package** +**Update an application in an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -46,8 +46,6 @@ This topic explains how to: **Important**   If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. -   - 6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. 7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. @@ -55,8 +53,6 @@ This topic explains how to: **Note**   The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. -   - 8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. 9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. @@ -64,15 +60,13 @@ This topic explains how to: **Note**   You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. -   - 10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. 11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. -**Modify the properties associated with an existing virtual application package** +**Modify the properties associated with an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -101,11 +95,9 @@ This topic explains how to: **Note**   To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. -   - 6. When you finish changing the package properties, click **File** > **Save** to save the package. -**Add a new application to an existing virtual application package** +**Add a new application to an existing virtual application package** 1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. @@ -120,8 +112,6 @@ This topic explains how to: **Important**   If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. -   - 6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. 7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. @@ -129,8 +119,6 @@ This topic explains how to: **Note**   The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. -   - 8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. 9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. @@ -144,8 +132,6 @@ This topic explains how to: **Note**   You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. -   - 12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. @@ -156,7 +142,6 @@ This topic explains how to: ## Related topics - [Operations for App-V 5.0](operations-for-app-v-50.md)   diff --git a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md index 7d9df908fd..13ae4fd9fb 100644 --- a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md +++ b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md @@ -30,7 +30,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi   -**To open the Administration and Monitoring Website** +**To open the Administration and Monitoring Website** 1. Open a web browser and navigate to the Administration and Monitoring Website. The default URL for the Administration and Monitoring Website is: @@ -47,7 +47,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi   -**To generate an Enterprise Compliance Report** +**To generate an Enterprise Compliance Report** 1. From the Administration and Monitoring Website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are: @@ -61,7 +61,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi 4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. -**To generate a Computer Compliance Report** +**To generate a Computer Compliance Report** 1. From the Administration and Monitoring Website, select the **Report** node from the left navigation pane, and then select **Computer Compliance Report**. Use the Computer Compliance Report to search for **User name** or **Computer name**. @@ -74,9 +74,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi **Note**   An MBAM client computer is considered compliant if the computer matches or exceeds the requirements of the MBAM Group Policy settings. -   - -**To generate a Recovery Key Audit Report** +**To generate a Recovery Key Audit Report** 1. From the Administration and Monitoring Website, select the **Report** node in the left navigation pane, and then select **Recovery Audit Report**. Select the filters for your Recovery Key Audit Report. The available filters for recovery key audits are as follows: diff --git a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md index 609ec18b52..e1b330088f 100644 --- a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md +++ b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md @@ -11,19 +11,11 @@ ms.prod: w10 # How to Recover a Moved Drive - - This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to recover an operating system drive that was moved after being encrypted by Microsoft BitLocker Administration and Monitoring (MBAM). When a drive is moved, it no longer accepts the PIN that was used in the previous computer because the Trusted Platform Module (TPM) chip has changed. To recover the moved drive, you must obtain the recovery key ID to retrieve the recovery password. To recover a moved drive, you must use the **Drive Recovery** area of the Administration and Monitoring Website. To access the **Drive Recovery** area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. For more information about these roles, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). -**Note**   -You may have given these roles different names when you created them. For more information, see [Access accounts for the Administration and Monitoring Website (Help Desk)](#bkmk-helpdesk-roles). - -  - **To recover a moved drive** - 1. On the computer that contains the moved drive, start the computer in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT). 2. After the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a fixed data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. diff --git a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md index e651abbd0b..6515783c38 100644 --- a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md +++ b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md @@ -103,7 +103,7 @@ Create the following accounts for the Reports feature.   -## Administration and Monitoring Website (Help Desk) accounts +## Administration and Monitoring Website (Help Desk) accounts Create the following accounts for the Administration and Monitoring Website. diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md index 3fcb31c12e..7779461ff4 100644 --- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md +++ b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md @@ -72,8 +72,7 @@ Before you install the MBAM Client software on end users' computers, ensure that   **Important**   -If BitLocker was used without MBAM, you must decrypt the drive and then clear TPM using tpm.msc. MBAM cannot take ownership of TPM if the client PC is already encrypted and the TPM owner password created. - +If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information.   ## Got a suggestion for MBAM? diff --git a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md index c4a9a942e4..548d28f073 100644 --- a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md +++ b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md @@ -51,7 +51,7 @@ Follow these steps to configure your MED-V image for running first time setup: After you have completed customization of your MED-V image, you are ready to seal the image by using Sysprep. -**Sealing the MED-V Image by Using Sysprep** +**Sealing the MED-V Image by Using Sysprep** 1. The System Preparation tool (Sysprep) is a technology that you can use to perform image-based installations throughout the network with minimal intervention by an administrator or IT-Professional. diff --git a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md index 544141d6d3..51bf199255 100644 --- a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md +++ b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md @@ -29,7 +29,7 @@ You can add and remove URL redirection information by performing one of the foll - [Edit the URL Redirection Text File and Rebuild the MED-V Workspace](#bkmk-edittext) -**To update URL Redirection information by using Group Policy** +**To update URL Redirection information by using Group Policy** 1. Edit the registry key multi-string value that is named `RedirectUrls`. This value is typically located at: @@ -44,7 +44,7 @@ This method of editing URL redirection information is a MED-V best practice.   -**To rebuild the MED-V workspace by using an updated URL text file** +**To rebuild the MED-V workspace by using an updated URL text file** - Another method of adding and removing URLs from the redirection list is to update the URL redirection text file and then use it to build a new MED-V workspace. You can then redeploy the MED-V workspace as before, by using your standard process of deployment, such as an ESD system. diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md index 171a89953e..202fcf0954 100644 --- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md +++ b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md @@ -47,21 +47,15 @@ You must install the MED-V workspace packager and build your MED-V workspaces be 3. **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). **Warning**   - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - -   + Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.   4. **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). **Important**   The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. -   - **Tip**   - Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. - -   + Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.   3. Configure the packages to run in silent mode (no user interaction is required). @@ -70,15 +64,11 @@ You must install the MED-V workspace packager and build your MED-V workspaces be **Note**   Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [To install the MED-V components by using a batch file](#bkmk-batch). MED-V automatically starts when the computer is restarted. -   - 4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic. **Important**   Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart. -   - 5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space. 6. Assign the packages to the target set of computers/users. @@ -91,7 +81,7 @@ You must install the MED-V workspace packager and build your MED-V workspaces be First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md). -**To install the MED-V components by using a batch file** +**To install the MED-V components by using a batch file** 1. Run the installation at a command prompt with administrative credentials. diff --git a/mdop/medv-v2/how-to-test-application-publishing.md b/mdop/medv-v2/how-to-test-application-publishing.md index ad7c458632..7791f99e06 100644 --- a/mdop/medv-v2/how-to-test-application-publishing.md +++ b/mdop/medv-v2/how-to-test-application-publishing.md @@ -15,7 +15,7 @@ ms.prod: w7 After your test of first time setup finishes, you can verify that the application publishing functionality is working as expected by performing the following tasks. -**To test application publishing** +**To test application publishing** 1. Verify that the applications that you specified for publishing are visible. @@ -34,8 +34,6 @@ After your test of first time setup finishes, you can verify that the applicatio **Important**   Because Windows Virtual PC does not support creating a share from a folder that is already shared, redirection does not occur for any documents that open from a shared folder, such as a My Documents folder that is located on the network. For more information, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). -   - After you have verified that published applications are installed and functioning correctly, you can test whether applications can be added or removed from the MED-V workspace. **To test that an application can be added or removed** @@ -51,15 +49,12 @@ After you have verified that published applications are installed and functionin **Note**   If you encounter any problems when verifying your application publication settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). -  - After you have completed testing application publishing, you can test other MED-V workspace configurations to verify that they function as intended. After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. ## Related topics - [How to Test URL Redirection](how-to-test-url-redirection.md) [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) diff --git a/mdop/medv-v2/how-to-test-url-redirection.md b/mdop/medv-v2/how-to-test-url-redirection.md index 292c86b05c..21781c9cab 100644 --- a/mdop/medv-v2/how-to-test-url-redirection.md +++ b/mdop/medv-v2/how-to-test-url-redirection.md @@ -18,9 +18,7 @@ After your test of first time setup finishes, you can verify that the URL redire **Important**   The MED-V Host Agent must be running for URL redirection to function correctly. -  - -**To test URL Redirection** +**To test URL Redirection** 1. Open an Internet Explorer browser in the host computer and enter a URL that you specified for redirection. @@ -45,20 +43,15 @@ The MED-V Host Agent must be running for URL redirection to function correctly. **Note**   It can take several seconds for the URL redirection changes to take place. -   - **Note**   If you encounter any problems when verifying your URL redirection settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). -  - After you have completed testing URL redirection in your MED-V workspace, you can test other configurations to verify that they function as intended. After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. ## Related topics - [How to Test Application Publishing](how-to-test-application-publishing.md) [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md index 036cada1cc..5806ca016a 100644 --- a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md +++ b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md @@ -103,9 +103,7 @@ It might be necessary to change the PowerShell execution policy to allow these s 2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** -  - -**Create the First UE-V Policy Configuration Item** +**Create the First UE-V Policy Configuration Item** 1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: @@ -173,8 +171,6 @@ It might be necessary to change the PowerShell execution policy to allow these s 3. Reimport the CAB file. The version in ConfigMgr will be updated. ## Generate a UE-V Template Baseline - - UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: @@ -195,7 +191,7 @@ The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. -### Create the First UE-V Template Baseline +### Create the First UE-V Template Baseline 1. Create a “master” set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they are pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md index a97b55540e..886b343e52 100644 --- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md +++ b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md @@ -45,7 +45,7 @@ This workflow diagram provides a high-level understanding of a UE-V deployment a ![deploymentworkflow](images/deploymentworkflow.png) -**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things: +**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things: - [Decide whether to synchronize settings for custom applications](#deciding) diff --git a/windows/deploy/introduction-vamt.md b/windows/deploy/introduction-vamt.md index 3d51c0dd02..133b8e6966 100644 --- a/windows/deploy/introduction-vamt.md +++ b/windows/deploy/introduction-vamt.md @@ -22,18 +22,18 @@ VAMT can be installed on, and can manage, physical or virtual instances. VAMT ca - [Enterprise Environment](#bkmk-enterpriseenvironment) - [VAMT User Interface](#bkmk-userinterface) -## Managing Multiple Activation Key (MAK) and Retail Activation +## Managing Multiple Activation Key (MAK) and Retail Activation You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: - **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. - **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. -## Managing Key Management Service (KMS) Activation +## Managing Key Management Service (KMS) Activation In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. -## Enterprise Environment +## Enterprise Environment VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. @@ -42,7 +42,7 @@ VAMT is commonly implemented in enterprise environments. The following illustrat In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. -## VAMT User Interface +## VAMT User Interface The following screenshot shows the VAMT graphical user interface. diff --git a/windows/deploy/usmt-exclude-files-and-settings.md b/windows/deploy/usmt-exclude-files-and-settings.md index e856679334..975f11e54a 100644 --- a/windows/deploy/usmt-exclude-files-and-settings.md +++ b/windows/deploy/usmt-exclude-files-and-settings.md @@ -32,7 +32,7 @@ If you specify an <exclude> rule, always specify a corresponding <inclu - [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) -- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-c-data-except-files-in-c-data-tmp) +- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) - [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) @@ -246,7 +246,7 @@ The following .xml file unconditionally excludes the system folders of `C:\Windo ``` -## Create a Config.xml File +## Create a Config XML File You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. - **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. diff --git a/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md index 69108c1fcc..d03cb6cbe3 100644 --- a/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md +++ b/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md @@ -37,7 +37,7 @@ In this topic: - [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-what-gpos-are-applied-to-a-device) +- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) ## To add domain devices to the GPO membership group diff --git a/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md index 11b782d3f8..553f49874f 100644 --- a/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md +++ b/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md @@ -25,11 +25,11 @@ To complete these procedures, you must be a member of the Domain Administrators In this topic: -- [Add the test devices to the GPO membership groups](#to-add-domain-devices-to-the-gpo-membership-group) +- [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-group) - [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-what-gpos-are-applied-to-a-device) +- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) ## To add test devices to the GPO membership groups diff --git a/windows/keep-secure/advanced-security-audit-policy-settings.md b/windows/keep-secure/advanced-security-audit-policy-settings.md index 14ecaca52f..c0dd8cf99f 100644 --- a/windows/keep-secure/advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/advanced-security-audit-policy-settings.md @@ -86,7 +86,7 @@ Logon/Logoff security policy settings and audit events allow you to track attemp Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses. -Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#bkmk-globalobjectaccess). +Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#global-object-access). This category includes the following subcategories: diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index 0beb5a8932..3f72f93ba5 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -117,7 +117,7 @@ When you need to recover the TPM owner information from AD DS and use it to man **To obtain TPM owner backup information from AD DS and create a password file** 1. Sign in to a domain controller by using domain administrator credentials. -2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#ms-tpm-ownerinformation), to a location on your computer. +2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#bkmk-get-tpmownerinfo), to a location on your computer. 3. Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step. 4. At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**. diff --git a/windows/keep-secure/bitlocker-frequently-asked-questions.md b/windows/keep-secure/bitlocker-frequently-asked-questions.md index c329ed5d14..6e3ae93c32 100644 --- a/windows/keep-secure/bitlocker-frequently-asked-questions.md +++ b/windows/keep-secure/bitlocker-frequently-asked-questions.md @@ -319,7 +319,7 @@ When an administrator selects the **Require BitLocker backup to AD DS** check b For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#bkmk-adretro) to capture the information after connectivity is restored. +When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. ## Security diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 031da1a038..dc86da4042 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -80,7 +80,7 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip) section. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick **Store App** from the **Rule template** drop-down list. @@ -164,7 +164,7 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip) section. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick **Desktop App** from the **Rule template** drop-down list. @@ -304,7 +304,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip) section. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. diff --git a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md index 2a41a2d649..d322b1015a 100644 --- a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md @@ -74,7 +74,7 @@ When finished, the files will be saved to your desktop. You can double-click the To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be added to the code integrity policy, and the catalog file can be distributed to the individual client computers. -For information about signing catalog files by using a certificate and SignTool.exe, a free tool available in the Windows SDK, see the next section, [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe). +For information about signing catalog files by using a certificate and SignTool.exe, a free tool available in the Windows SDK, see the next section, [Catalog signing with SignTool.exe](#catalog-signing-with-signtoolexe). For information about adding the signing certificate to a code integrity policy, see [Add a catalog signing certificate to a code integrity policy](deploy-code-integrity-policies-steps.md#add-a-catalog-signing-certificate-to-a-code-integrity-policy). diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index fe1db32b1d..9f7be87cbb 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -20,7 +20,7 @@ Hardware-based security features, also called virtualization-based security or V 2. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). -3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). +3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard). 4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard), later in this topic. @@ -46,7 +46,7 @@ After you enable the feature or features, you can enable VBS for Device Guard, a ## Enable Virtualization Based Security (VBS) and Device Guard -Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). +Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard). There are multiple ways to configure VBS features for Device Guard: diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index 8670def085..cc8625adb9 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -40,7 +40,7 @@ Membership in the local Administrators group, or equivalent, is the minimum requ 2. On the **Action** menu, click **Initialize TPM** to start the TPM Initialization Wizard. 3. If the TPM has never been initialized or is turned off, the TPM Initialization Wizard displays the **Turn on the TPM security hardware** dialog box. This dialog box provides guidance for initializing or turning on the TPM. Follow the instructions in the wizard. - >**Note:** If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the [To set ownership of the TPM](#bkmk-setownership) procedure. + >**Note:** If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the **To set ownership of the TPM** procedure.   >**Note:**  If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM.   @@ -57,7 +57,7 @@ To finish initializing the TPM for use, you must set an owner for the TPM. The p **To set ownership of the TPM** -1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure [To start the TPM Initialization Wizard](#bkmk-starttpminitwizard). +1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure **To start the TPM Initialization Wizard**. 2. In the **Create the TPM owner password** dialog box, click **Automatically create the password (recommended)**. 3. In the **Save your TPM owner password** dialog box, click **Save the password**. 4. In the **Save As** dialog box, select a location to save the password, and then click **Save**. The password file is saved as *computer\_name.tpm*. diff --git a/windows/keep-secure/isolating-apps-on-your-network.md b/windows/keep-secure/isolating-apps-on-your-network.md index c8adf77620..9743da28c0 100644 --- a/windows/keep-secure/isolating-apps-on-your-network.md +++ b/windows/keep-secure/isolating-apps-on-your-network.md @@ -44,7 +44,7 @@ To isolate Windows Store apps on your network, you need to use Group Policy to d - [Prerequisites](#prerequisites) -- [Step 1: Define your network](#step-1-Define-your-network) +- [Step 1: Define your network](#step-1-define-your-network) - [Step 2: Create custom firewall rules](#step-2-create-custom-firewall-rules) diff --git a/windows/keep-secure/local-accounts.md b/windows/keep-secure/local-accounts.md index 3e94ade971..7f8aa3e095 100644 --- a/windows/keep-secure/local-accounts.md +++ b/windows/keep-secure/local-accounts.md @@ -81,7 +81,7 @@ The default Administrator account is initially installed differently for Windows In summary, for Windows Server operating systems, the Administrator account is used to set up the local server only for tasks that require administrative rights. The default Administrator account is set up by using the default settings that are provided on installation. Initially, the Administrator account is not associated with a password. After installation, when you first set up Windows Server, your first task is to set up the Administrator account properties securely. This includes creating a strong password and securing the **Remote control** and **Remote Desktop Services Profile** settings. You can also disable the Administrator account when it is not required. -In comparison, for the Windows client operating systems, the Administrator account has access to the local system only. The default Administrator account is initially disabled by default, and this account is not associated with a password. It is a best practice to leave the Administrator account disabled. The default Administrator account is considered only as a setup and disaster recovery account, and it can be used to join the computer to a domain. When administrator access is required, do not sign in as an administrator. You can sign in to your computer with your local (non-administrator) credentials and use **Run as administrator**. For more information, see [Security considerations](#sec-administrator-security). +In comparison, for the Windows client operating systems, the Administrator account has access to the local system only. The default Administrator account is initially disabled by default, and this account is not associated with a password. It is a best practice to leave the Administrator account disabled. The default Administrator account is considered only as a setup and disaster recovery account, and it can be used to join the computer to a domain. When administrator access is required, do not sign in as an administrator. You can sign in to your computer with your local (non-administrator) credentials and use **Run as administrator**. For more information, see [Security considerations](#security-considerations). **Account group membership** diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index 5973f94f6f..0780adf0bf 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -30,7 +30,7 @@ The TPM Services Group Policy settings are located at: | [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| X| | [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| | X| X| X||| | [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X| X||| -| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X| X||| +| [Standard User Individual Lockout Threshold](#individual)| X| X| X| X||| | [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X| X|||| ### Turn on TPM backup to Active Directory Domain Services diff --git a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md index 3aabc0a07e..2aa91da1a1 100644 --- a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md @@ -193,5 +193,5 @@ The registry keys are found in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Wind | ValidateAdminCodeSignatures | [User Account Control: Only elevate executables that are signed and validated](#user-account-control-only-elevate-executables-that-are-signed-and-validated) | 0 (Default) = Disabled
1 = Enabled | | EnableSecureUIAPaths | [User Account Control: Only elevate UIAccess applications that are installed in secure locations](#user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations) | 0 = Disabled
1 (Default) = Enabled | | EnableLUA | [User Account Control: Run all administrators in Admin Approval Mode](#user-account-control-run-all-administrators-in-admin-approval-mode) | 0 = Disabled
1 (Default) = Enabled | -| PromptOnSecureDesktop | [User Account Control: Switch to the secure desktop when prompting for elevation](#user-account-control:-switch-to-the-secure-desktop-when-prompting-for-elevation) | 0 = Disabled
1 (Default) = Enabled | +| PromptOnSecureDesktop | [User Account Control: Switch to the secure desktop when prompting for elevation](#user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation) | 0 = Disabled
1 (Default) = Enabled | | EnableVirtualization | [User Account Control: Virtualize file and registry write failures to per-user locations](#user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations) | 0 = Disabled
1 (Default) = Enabled | diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 5ad7eddc7a..f2db32eb9d 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -21,7 +21,7 @@ This guide provides a detailed description of the most important security improv #### Introduction Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: -- [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. +- [**Identity and access control**](#identity-and-access-control) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. @@ -436,7 +436,7 @@ The functionality a TPM provides includes: Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. -Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. +Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measured-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. @@ -576,7 +576,7 @@ The core functionality and protection of Device Guard starts at the hardware lev Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can't happen in the first place. -Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. +Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#device-guard-with-credential-guard) section. #### Device Guard with AppLocker diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 9b54a7e5a7..e82ec6f3d5 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -36,7 +36,7 @@ This guide is intended for IT pros, system administrators, and IT managers, and | Section | Description | | - | - | -| [Set profile global defaults](#set-profile-global-defaults) | Enable and control firewall behavior| +| [Set profile global defaults](#bkmk-profileglobaldefaults) | Enable and control firewall behavior| | [Deploy basic firewall rules](#deploy-basic-firewall-rules)| How to create, modify, and delete firewall rules| | [Manage Remotely](#manage-remotely) | Remote management by using `-CimSession`| | [Deploy basic IPsec rule settings](#deploy-basic-ipsec-rule-settings) | IPsec rules and associated parameters| diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md index a16db53590..0d3374fbca 100644 --- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md @@ -42,7 +42,7 @@ With Windows 10, you can continue to use traditional OS deployment, but you can -- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services like Microsoft Intune. +- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services like [Microsoft Intune](https://docs.microsoft.com/intune/understand-explore/introduction-to-microsoft-intune). - Create self-contained provisioning packages built with the [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113(v=vs.85).aspx). diff --git a/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md index e18bff1e74..ec06465c51 100644 --- a/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md +++ b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md @@ -18,7 +18,6 @@ After you deploy User Experience Virtualization (UE-V) and its required features ## UE-V Configuration Pack supported features - The UE-V Configuration Pack includes tools to: - Create or update UE-V settings location template distribution baselines @@ -103,10 +102,9 @@ It might be necessary to change the PowerShell execution policy to allow these s 1. Select **Administration > Client Settings > Properties** 2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** -   -**Create the first UE-V policy configuration item** +**Create the first UE-V policy configuration item** 1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: @@ -173,8 +171,7 @@ It might be necessary to change the PowerShell execution policy to allow these s 3. Reimport the CAB file. The version in ConfigMgr will be updated. -## Generate a UE-V Template Baseline - +## Generate a UE-V Template Baseline UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. diff --git a/windows/manage/uev-prepare-for-deployment.md b/windows/manage/uev-prepare-for-deployment.md index 0fa6f10ff2..b66d90a0ce 100644 --- a/windows/manage/uev-prepare-for-deployment.md +++ b/windows/manage/uev-prepare-for-deployment.md @@ -25,8 +25,6 @@ Whether you want to synchronize settings for only default Windows applications o - [Define a settings storage location](uev-deploy-required-features.md#ssl) -- [Decide how to manage UE-V configurations](#config) - - [Enable the UE-V service](uev-deploy-required-features.md#enable-the-ue-v-service) on user computers If you want to use UE-V to synchronize user-defined settings for custom applications (third-party or line-of-business), you’ll need to install and configure these optional additional UE-V features: