From 7e1fcb0c4e2cf2696d39696b56409117bcaaf2d5 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Mon, 29 Jan 2018 20:41:42 +0000 Subject: [PATCH 001/119] Replacing with updated image --- .../images/onenote_checkmark.png.png | Bin 0 -> 88325 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 education/trial-in-a-box/images/onenote_checkmark.png.png diff --git a/education/trial-in-a-box/images/onenote_checkmark.png.png b/education/trial-in-a-box/images/onenote_checkmark.png.png new file mode 100644 index 0000000000000000000000000000000000000000..1d276b4c1d01e19ffc8e8031137b6d7729f12ba9 GIT binary patch literal 88325 zcmcG01zS~Hv^F3m(jZ;ZNJ@7oNH-`5NOyO)(jncoX{5VDO1h;>x}_WL+~7$Wp-YUWN>#xO<4lXNgJ6fn}_ zVrp*bhi$Iu>RWZs&nrh4{N6!?1bVx0a29MD?>WP&Huoc&24-|yL$@y@nQ7k@U`7f} z^t=lF2yu_uRkxKpt`m>Egs3q2A%7r8H1X5-;8RstHBDM2_q;MeL=+p0Jk1&O4FqnZ$ZCU-du8@6!_Z|*K~sx0>x`%;NvBK~~9U5TSb)-W_BGf{X>>KBX_ zjN*xs9tf+}V@~|Q43C4lEXdt!7EpxT*vhU4DR7QRzdglU(0ha!JpLXR_6Zc17R9_y z`mV=-q{{OSE$aSPk`Y!fqkbxFQ>{(it!kb&ZpF8}5HrmT?LLB2La|Dt;Y1oq24X#e ztX~;)(TX%t3InMWA#e~TvX29)1c-VhZ2>=U{oA8Z%d`+-iqf$t)egl(uqF6zLa4)k zlVRboalZJ#Ba-M$k4*8K5(1B^UIZr3_h z9#0ILjWe!q=H1-_2dD3FTGG;@hx0=fJa$a0zhWlCNBj94lh1+Af#9YFu zJ=M9N@)N|9!Va;q;Pro>j)~98;a2oqyc(n@Ia;jvCT#Pf4Lbwv<<}-#fdJ|=MOXP; zyIOLga?<*Y0Q$8n*<{+~8+uZRpO z?khAnAJ~`*&#gA1kr0>Pn{JAzdp z%a;L<8Geiu8{uyo1+gKN2C1~P1%?x7j2nJq=uDn@cTvClg`C>ace|yGNy>+F9zW>W z2}}CDtd@mz2z3XKHDnt*^}}&HzZhUv=I!gBUnT1A;gDrhUoLhs)A~rX8nfWKCP-?r zg6`$h(~d$x!RyEstNUoTwR5`ntN(K~oS7!6qUhfX#=akf8j{ottRHB|14N zk|y2--rg)wR8$e^T1dHG*T2*>1wnhCGjwKpCKs_o`Ky)AJ*~#6Q zI!S6i53`1~Omr;8$~!ls0Iki+qb{Q)u6tNR$v=}z6jP~{5>mTbk^M9AL>aSdD-M$y zmf12J?T(5jDdcZetpZCfhr7?qE!AIAVWLHI@+{`o$PmhGw>*86ZkvWfyqIOmAnx6M zuFfs2m?el~E4SKQFH%;OZ>Fe?N#fVK2{`6niS!Aw`X|i_^y(jyz ze~fJ4M1qpOOb;ERpIBimh8q`fG7s+~VosVdD%<--u+rV7!E3{8W3 zl{^nFqi9j(x~$k#n9eoG>%FCnyqY(msl)4MQt|RAD(vsf23E3FaN(5%u|0V%Cfli^ zatPxiFjV;YLijdsY&G3zV`Rv46{BM1EvraeMae{YjSCpaJuMuZGgrCAh`9y9cJ9W_L>q~^D!Bjf>3_%i>Aydy=hZ>8 zmwSQo(_2mM6%{gV%WU7SwLDJQKNT*HfFY`hnIGBCS|VYJCKm(B0W>W9E;MHIlhGpk z1{VWZxD~Y`1iX#UJpwgOC(_s_qi~oE=StjsA%A1ooZ_CYP?@#vVEo_Jw3s$)|5>x=|XAK_!Ixzl?1h2m`m}y`4@J0_c_4R}|;JVa5h* z+>`D8RuL2yT_+$PNxPT6-a<}jE>6Z<>999O<0p>0;3^!T<`RTWsUCO(c};ea?w`mp z-&P;I@`saVBjB5)yV?A-V&$B~?KE38<>YK)f%QGi-V;d|B}T3S$~qe3ACsj1LTpL= z8*HmrgQB96BLs;ZsIpjFlZf;23M`guXVQlnI2)0@m(+%QY-NTnjnmzGpQF|{!{5Th zja1av-0jicEwX>=;VW|-+)B`Xs4@Ta??oqkk|gE)&+3PmkNYdfc~%B~;WlYur6HS$ z(a*@)#;9Ic__`14)NtQfKCvuEX3h{=)Hk(KUjA%$yInadGS4{g5QzbWN;Jh;wl=3KoPv2`)%&U9jo4`y%#kXj^&YM_y+x$!7oVO*-ZcjZIal@0jme zlqE{>5hFBIWE90ki0E>x_!|>am*;l*L<$CdKxDJY8roYqfr@V&6=ae{bKRrY9&Uyc z3gVi1+cgrkv;BKEa%*RU5h*z9ODA&K*^|NLgjQa~2{Vc(xeYXEv}y_%`n$9&6;9&) z#yH{fKZb~I0#IU8A@LO3>G#(P?TrB(73FoHfH=p+F^^XblZk1s_ zK{v1EfA1O5PA)O&oj6X2H;PgT?W3kXEYc28wpSW7!Br!jm?uiQdVAe0m>%)WhM z!UCn=Sq9+-z9t;m*2l^3PCu2Q>2RbtnPANneiekqF_8mJAV@%E-ol;>=QJbVA9)RmHiuEj(_hGYF08Z>e`Hq+f1K^D~<`j;_1M8 zBGi;LDJ{0GE0F2b(buAQsJ}J&5!^LH3Z{5Glk5A%E8gA>xO9(s`Y-ipakn70C6%vpdB5Kw{Ac-n2ifB!CG|#9i#QnE*Z<75JQDR28R_v!2^>3Td zxpq$9`&$>ePO|D&o`<;#X1^u6grMpXdr~*q>^? zPp5yCQsA0<6pN4tpz3KIq59Mm3wbBZ??StG^84@E&_#o3NTTNeH76L?7j>rKASRQ` zJC9HBm5syo9V$cnxRIy!Pa|Br{CW3|)P|aH5-cj-eEbJEn+}KpR!#5V^|onV4|li- z-g94_&MwwZ&L`(}Pz9#`G1p%HpsN*h#vnF&|3uxF@u@TO();0P#k$ryn*37`ytJtO zD=VM6$UY2%p43<{88^@vhgW zFanVVKTtj8*Pe4tCE;y#-th`3lyBjJY?Qv>m~>&#sd7>ETy5#J-i7lU+)r{^?;8Fk z>>YlboiM`To38B=O$zH!>LOMG13WHl3pvT1q@$K6&u$cLgV5LG&6m-&w&%GIrXK=I zQm|-!%fJ0S^+Duk=WJc=&cwJU*d0_++L9RaPJf-)F9N4f6e|HgKr`OV+?86GX0~d6 zOF+|GJuD|ikv2&vv^cgo_PXX2G=AHH0>DN?#ZU(@%OcXW^kODyV0Ad=>q`U08)W7; zDL7b|Bvr(#PnUA2X2|s!QfNac;}u`NLHQxSw@bcG%jQ6vGhq|fCvHB^FWO2Mo|E$1 z=A|^Y6b+Y$7Kd9m%4sw^_zvx#P3fKd~^%Hvz(xDU8dR}-yG(SMF!_(|J3rYeQ@ z^R*u==&|+Ga%Z;x;Vgb4X@|o{`)PRSRY=?oBlI)3QQ~f~=H?g6AT5H~yrAewJ7-hG zYqb<77p%yip1bpD5O2wJwF;TW;SaTgo=U#P5_t_=BMTjehGR(HW+hR18io~a)TkpU zBrlN(f{d5(qpsdCPThA(!T#aabqX=A#H zmFJ#J=(N7tB2gqw{xFIWZ?HfZtc26Z#|gxZzRW2=3;THg61REJT*eTUEY_vs$aq9I zmB4I_;w>D69zD|sF^&q+Sbk_fUg00d)5ZG-W&G1jrYdi9LD=tVwox6+HKaPkPF0~l zWG(aV)KDZnF$BomA2!x|80NcR)P1#5dB|5J&bNKGwYkIQlcFFMTqD)NE-|5&yL>Mc zMYmt^$m%EssnyCBdI=KiQu?Xvb+)tNH4RomfSZ9mcVbkN(`%B||PtI~GsiM+UrR*W69 zAtt>8$KIiV0CMCeUPe(H>tBQE2sUOdM6*R0P;G!W_HWG0hv~`)4fbpBc>- zD#8p<_R&+BpF?!P7`HPjbNPt+J%d?*ku zhGr9q#n;hN)%~LKd+2eSxq7>_d^38Z`3Z7@Ey(lC*esW8;q<#D=Ju9II;4LPSs*4( zs3UfBOdg}z4j+@NrNtZwUnKQIdR|APW$&Q&3&j%~1vR!}r-(<%sl0$)f(=b%er!EG z@L-pYbk`;C&Z`MC*T6Bn&5gu!o!<*%lM=&uhxVJA3kYI*&9jYHj8K4&HMqT`xz^L; z_`5KMGrFPr9jCwufvI! zJ1D$75vfaRNaP$}jHR8A`w-9M&*dCQh_8mpHUZnwt9&S;1mQDvEF{k>7qHUjTD|{4I@B`I$2CZc zMCd64Yax@H`vy$34OY81A+))sALs7AAXz)VaN?rHr177qp=t~~TQgW3n_%Y*{A({3 zkpI==>XH(f4V1&LEi#pN38TvlC~t+N!lb0-{q#c9>PhY4rP|BS-tby}scmkqg&RVq1_MX{DUbi^}9EwPNjtd_(j8LlA+H zOp6uLDfX!iAN^^|I?969(5!Rf z0SsNp@&`v*wnFvitzLnK^~lDMsI$o$fzV720%w)vfC=Hd*(=n$U*b!!DXOd$5PN3~ z=EaTHHY0reRsICKrkx*r|L}ZO=y1kz3OM^Y)myPWp9%wc@MdxgoWzyahHXC?n*H)| z>B>G+;^0q#{pq{s6S+%|QRq___J`E|s{Fus>x7sgjX>}2`_|!C;#_xCk+Ie06v#eI zQ>g+#?lE1S%vgILRJ1|5VC1A0^A)3}S2DElMZz=|`H3>w2ek9wg3L7@{^-R7&+C>@ z)bsTI;o&zclf``Nh;uUR2dmp`Nra&814$4L=(TaF2!9hs$-!Dep|M?H7J@m>eNNw=8DIzLyhI!~S&u>}>f>dX< zhBAHdv!Rwou|yE$IFZkCkAp1Du7z%f_CinnxEEqcA82!8?n6SF%TtWvh~~e2}@=j3%|5nV;M88PJg zHyRTC4ilv=x7@apoat>spRPD9`t&AKdZ)eWe?(Q*Wpl( z<2#`LwzV_X^-r^UPd8Jjth8mgk1wOl!Ozmr z)58&toa7mDB+oIPNwbpCORSRIo*euW6xGq$c4oM1!xYnef_~5SzzsG?$sA8i!lCO z{L15(_>LjVAb)~VLmIA{>Bp|}fH9h&*mr4DTxI@ue)O+4ClQO=NdjQDR6hW;3w302 zx_=GmT5KC1m~X1vN$gvWG`p$(6et&U`Fj>}*l$mj&gUuL(~zM^-iLnjU_*}CEGvB+aB_MWbZo|(4ZD-ZK4e= zXw^BoBT~rs1B2n_mA0Hv!#6NLWE-aqX{v9GCtncF=PAq#BX1}$ zQqSjNzddK$bL@3{z#h@MQ;OryRS09dnuZe>6CEP_7PbuFUeh7woz$gea&z6h0$)SC zXbdsc7}Jf~`=Xye1q#ZhOrAjbr&>@9P?B|gqX;DkGH3Q`kZNX?JN~L?eG$K#5XUj<6yhMz<81|12JWEAHCWjQ-Cdp7QzA{P2mQUGYoDP1jvAZbd^1x4*+QjO?j(24xj|aQ zSDoN`F+lV8CH*H+M$=nN31x~TuHV!S6n_1z0^+{BS>6=I%yKixC`>H*I_qRta9Ag z`a&LR1l-jY zam=!xuSCuq@TMTX(kzT_kByd z)(+*kOI~GmSie=>vm3M0$JSt=S1H9|a}$%DVE_(7$$$J>l_wZs_3Y+iea^d@+j^_> z;owbp7bhZBL&{?ovCC-dqo?!l6Ab$ParxPokiQp3{kbcQ1u-vVpQ&g>oTD|IM)E+H6QDb=4>R9dFFh6TG0Q86t$5 z?beY7SM82~iy0o(gfTOOk8fe;>?XLcs^!($?+x!;>NDP|BEf{RtJ96-U-~Diy3089Zng=>;3oGY z-gURZgHU?b=#A*yPt^tHl+xJ#qA=32=@Pc7v;h=r*Z0b}Ti+O7OmW(`EZ;mn8RFGO zFPebAHEF}c`D1mQy9tU@#^`T22i-Xs$$THxs^VB3R*k@KMya~x#gg&t2JmWdGDHq}M?3 ze3)Z;c9z5CPy_lo75$v@Mw)#Gmk@KJYNj|jTFrVZ!XSMmZEdfm16+96tT80N@&j_q z7g!Qlnu+t(#;*iikMkf9IAvVP_*c@gY^Z^*EAGKY?9%S;xBdI!5c-}C`%h(Gz7K6d zva?}yW-&baj$CpN_^X+wR#%}{l#X`Rxf6|hMdWt9>?)nF5}%m3{rZTGK+<}^qwVX} z;e7XX`?XNL&9V#|K@X>V>sQuL@qnzyL(|sFKUz`w=2~=AFS{kZO+R45FDxvW+1Px< z1iJ%s((x>eA@aahtTw1zP2S)&#d&(`MUDLuk45|UqHTxJFhALy*8O#t-Vf)4Kc~C7 z(Xj(Yc1_x&u3syXE)QnU$3I|9EG~xkZ}1gGL|bh5Kl`q6uq1`6z3qLxUL7NU`iJCl zyd=$?CPDJX_esg{pYj%l_orCu$-P?D;MoHjyznZgJr%G^A>a%~x8&-_Ioq0;@TlF{ zU~^VhzEVpQed>#OSUI>nyE~{bP-pP@zh?o?dvFvr@F(d9L!24I0`v(UPNRK|ZqK%& zwmkFLH&5Mm_xJyHA(7{mmmgCMY2r#CA|jeuS&6HwKlq4{l9E1b^K|IXmh0SjwNs@A z$7Iu^q!vIg1-b`gJH+-JgN!SRh*4h#WMaj+(~QA8spF(~%&fGkTU?GP@xu9D^&VVe zhl+=YQ+DG*n1;T+e*>A=4UzQKssdjovgiylR+cNL zL@;(>Q_PSA<$HQur&3ZZ(-62G$V8E0G5S%OJ^_577^nQk=Z?GAp4Z35(?!Zrf7Nk& zW8#$PIU$UFPxqZoRmP>+*?yuFYY}Y}$fGq^OW)q-=%1NiuZt4a9bm(+Q>46x_lH0z z!AkcAVhBr7U{YX*@~(zLb|ZSFw&u?<(St=M>nOq?H7oF96a=XJY5bsBX>n1o(1S@e zm2kHxZflmw=qB5)eF-H;SP1y}J|J}AeXW=cXVU7u_Y(H-@F=RNki>*9`S~-LAxJ)r zdtz#;yU~85sHB84LqR}NLOOPwGZK_@mCZ7LNlA%DlLJj0t^BVohxPN@ap#OW%USH` z{uDuXcAt(cIod!7J$=}(C{h74YwP^#>e$nb{g!E{iar%D@8U7Z-Umz8~W(t3^#D%5sWn23nzw@Hmr zjppFsV0x~Rx3`c@Lt1q;JGgHp^@Lx)-a|2fCCPAqx)_{ba*s2Xdj0y|+|tqz6fwAy zxhg|x+PK#9QGw~1nJR}ZnF56j8FO<6;jA$}8&5$papk=B_RK$jK0zkvI}9 zNK<3i*46^3>^oj=+1uOGpUjiS#l`)hP?*7|g!^5CsSiNZ9Dq5?*>W19NEJ0Taee(a zP1;eB#5~yHz4QzW(4UZs{Z>Neb)QNfHo7!-R%1Mb*WBC;wguAMyr8^tMLP~QYN5{Z z^!{;lE>DG_U!u5 zG<%Q_E}T@rMM+0TUP1z4&uM`#r>>zvRaZB9^~7|c*4#~yj6G#IfF--NTF8gj1Z7rI zKBSGY;!9mvFu6~1c{vLVOWTD?`|XJBBtUD>hMF}dXw^(qL+m`uPB^CN_J{yqt9}_& z5%}IsWtmx6Kyq^fd&BY1yUCw^*zwA-r);`*+>^Gro)py8C4}P8IV@T?C@U+Av8Naf z#L_Tn)el$kmbc$ou(bYrKe=}iBFwu;snK9V>icw_1+CP`$jHORhUj9|!n3KYr}%&X zI7!~XE{bBcu4BN z?LxxA0WcK*{nUL71NaMSU~6lOlbhRNglqO+FRM?CKkR{y7N|J&pPx?8hFGT-76xN! zWTmLFot&I1!FG|kt-%I#QM`EZV##q#NG?k_!}GW)I7!zh#Wc%1Q96zmOjt!vPXVxJ ze}hFH-b|R`Y9_j$kMP_+p7<(qr}c8m<1uN7YHAV=B{Jt$R7BIrCfdy#C!H!jUnnm5 z+#hK>O-N|_+-^C!xSW9#_-_p*36w+jrV7t9PP~HcH~Ol~r)bGMcHht{q)RzEa*T|O zK*7y!{XMN*vM76s6L;g$V#E2xl;YI<{J{B`$kiCqS6haV1Uq>aiEXLZr3VcDMht6=3znX+uh`FuS+V77yI-c)4Qh031FobU?%F4>31Srx*uu;A@f*Rtx-HhV{OV9{zE`{5g z2w*^&Rs(n(sN<%WRRb(DxzEj;ijF7#b-QHzuWtU&w^`5YNFq0|V}j?XpiKCp1<#Nd z8*It96$LTt5$;wzPhv()nszch8;|N2HQGG5#zdY4S(1kIslYb5*47oXW?U1#% ze+Lk>$KV}mw`ijA7cDJK@a9)|OluR8Bs`zRc+9V@^m-b0WhxzV8|_KlCDzCnwt?@pKemurLJ^7N8aa$^V|K;9Wv_b zuSM?X$8KhQA3s;mGXWm5+Z;7}uyxu`zH_^iwWGCqht~m6EKZzzsZl_=EZ- zV34iu9L&tjOAbTKg8w>S)HXDn&lyI;@)l+QDh?=C!AEU3SLD*KxuMpctQ-=^f1wXaYUp zezP8|jQhQx%o9}^cfQIHspIj;Hbul&SW)DW6EIzJ#?R%Opob2`d_Lb_ypH?`g^H%< zr+dvxJ=o`mv1d83Js5)jU<%C7?pL2P>9V}AlZK$g;`io298eJeJ5engF19!;meW@57=_6xk`PFN{c)n^VGhcP@LO7p7ySby(#Dooo|oimY1We ztApzWg5c?K^*JLd3LTI6OAjb1DcZOY2q4P#eW1SEFY;OK2WXPmocGn*?|>O|z;A7B zJ^km;B+a%xGW1l~2=dCxB0qn1|IX@rJLGj_shiu{n*NHl^~cYO z_SBi5pQo0VA|Uk8`4egD71-ps!|r;l4P~9siRcv})7Er0m}AZgxvc8kj&+i;J?( z&Rl6cwzLT{u$5l74r=P8+le*Chs&<3#uE?;ZI8YDhkwB$)VL^6rVfB2h20nhv^1El z*pVMI9H49Pr$YC{>a4D=4tgttgEEtQPG1MeOi30OEs&yz>y1qnqpULsg8UbcOxAyW z7rYq%pzS=PKAa(tq-E3eU7KZxeikU)enk(kK{$ZG=f>#RyiIsN#o0e*DsVG2IQY+_ z?c(BsSNOfUdT9R!m^~Aq6T$daQh(jeR#aS^)7nZRKlKqcV7~Ho>gq{hVPXGilC!I; zfJ{9oXMpy8&|yBMAP~8|y&V|fdPS?Otu4o&K?@X$Lz7+0G7w4qy5{!^M;<{@{%B&D zzqcHs#`t5Tcx^BQvJD9O*s}7L@dfDTfO;=52SN$8n}RHQYHsc~XoORbHYZnCj91_0 zeGFSzT5N&zU0#N=Fu)uEG<$e@0?-AkqNeVAw*jOKVj#eJfMJ-(df+K#ZJRlby=Db) zyR*)K^aAEnU(emID8$Al%4DMR@vFLeZ?*Bz?#T%qE(%}bveF!CvhKrQeDH}JVD7@0 z2G;F)aB*>=A5{YN0{Z&PmoK|}dv7unpe*47hR`N`8{inK8XCM1k-3kwaiAiA_CIx7 z%CT~9`wBSy-ob(6g4s|**~9a>$a5Un4fvx1#Vq0BU$ueu5c)F!n{42dd>#*UH%{Hs z9l%8bMrL}sKT}i!ruuLS2htSh?Zb}980bAHv;F5L2(Iq@cFdQon~g+saN}mZD4|rJ z02dGM@1=*ijSVd(@{ge{pg^HYuDxAYMphOGi*%<+>4&R^4r4H;ptEAhzMu5rre6dQ zd587y_-9a-q`?%#G^CIxk|IZ@R#<+}xNHOG@3)~iuD@nYBvr+mK*N^rLkdrBZ2O^`mXcUAw$3I$aRGN5WO zK%P1@rQ^8OK3htb2aifnW52;f9-o{H7~AId z43XiQF=1IrNhETwf3V^BtOY=ZPAQ6H0JQt+dBnAUaFD`fiHAd{U<5D>ETAyp7}Y@8 z0jUVE6d=qQ;5z*8O}ken(7N^dqeu@|+7_$iFi<__5^Z=%w!vx{EjK$u6%n{|AZdSo zDx-`WKxJI5H&a(9EzkyFR=~z3@AyqeT^(L*t!4F*1uAM9Ry-J?!n8{dvzsl5v?ZvT z@UXYAs%E6s2VwRe1V(K>_Q`7PK;C<2d;DnRK| zH6YP+ccll-IOEm#23kE~5WCY}{2IXJ6PYyMgKL8N4fj_^qXmCfRz|@TPlwTFNpjTY z0-{#RobPP|PT(PI<-B*r`v3y6hG-s>+?_%pEzB#&dqN5j{0C^BqDT z)v~sgq-z44CMb0;6nP8(}cKmz+WX%vlj;4 zPFC80=EjQdCp9*=t-M+?VkeZF+AOUZ1&dv2HP0SQ*#veCFjou*q?Cez&Q6%ALdBi( zmSaeLeWJigYaCEy3c|NWK>54vdXS9FFYXxnumwBBx~jq=`kwFfHTxs#BS z)X`X)>gaeL)d4^6xcPvk-x@05%NkZ>G&NH;JasyJgn;@|#%)>;BBp0yfoh!%K)1IR zSD&~gBtYlA9Oc^~83op7U{s87R&+RPdoolKX!|~1E`h2>Iz;W3k`o zjI$|}k9gPNCygu)Z#l@N^Tv=rtRX!BQojL4wh?fd)YQ~~suzm*Yt+5XAJnZcu1uXE zV-GH`(&gxj4-mo74N?Ude{%}JRd6)sMl`B&^@J{IC`OJJN+)Nv9nqkalC|vun=CpQ z^ix_2hpEGYdEq-iplsT2O>A0EKe9CMQUWN4m7NE?Z3c`=J3v8kLdAi+1^z?eL3zt4 z;i?k-W;$o*m(8oW1%Pc<+_Jzt(Y^VFuhHzpAmDPimg#xCPA78v(sjumiD%V|0|5a6 z6&2NP#eIj*pSMNZv%K|d#nd&h2V(&)(rN5EG!>PXyKD}Q&UrqZ_M6+<76MKIia8w= zqMsaXcirsQp$eZ%MkxOY3k#FVR~b&@iAH#Z$NMn<;x@m&&I4dd6)2zo2-5T82?w|% z%9!75t0f~93i&GO&VMwuK@|u--E0WnAJ#+-?E|L##Fh(V*I2*jlnO|g1Gr5A|6aiT z`7hDu!kw*3}lJT@fN zOf?`I__fXkTu|fyQOX!S(3$Z`NnpB5(c?N`qe4XjwX`-+EdRY6253OD^PvDn3Fa8^ z0gb^W-FOM(O1w#tJ6jJX2c~#3Kwuz0rDDawI5;{wQV{L^ge)&FKg!Dx7Qi%Qwc4JM zA>hidJpsHKT#1~vwhUmOgNlWEeV$i`Z-8m0qy#lOlZLAFyAc-_7Xi061#8);%>r&+ zPtPwg5f8|WbhIk)vrkVxre0Pw<}L2*DX746L(m&d=ZnH{1S^6@A-T)OXde)WmR*Am%4ZemT;dt1U6meMMcPH^BNxC=EVM+QR)9@I0h4uSNV8Q=w z+OsLS^N}2VB@<{G4odQI7s9z$TrpC>NyZVaE)y5f?7Zq~UbX?)9Z0a#8LynhXV;=zgFK90Lqr z;j?VEU9TAKP3A`saShIw9@a1Lody&2TX7%!_;)m7Wu^sdDtD+C#Wd6%i+X5Z$yW+c z$BAE_Hm+;uJg20@v6Y1Xx&CJlnW1JP>D#O_daLa~Az>tyxFws0IHOo8YLbI#lXSDx z?cW1ZgaKsHNFZ-(pHK0uCl*u21=KOMfN!s?UU3?|dER*OsA})a)!dxn;rT7FhNJGy z%ml35oj^*HJU6z;F3gE+q55w2BL6xZ}Ymo0@7X&7EYxYx8v!uV!p|d4tRpljst^Oo@coS z2(d$Yh$8z(m3TUf2$3)>2gvDl>AjSF5%OhV5$2esVhum{=8Hz2fo$p$GXrm2-+d{0~j;?j|<7m+r+^sCM(H1yPEZl)L@0-k*1quu5Zv$Eketi|| zQ^nU2fTPGDaecH%@9t_>{A=rbPn`QPk`fmsqq13;ftMxmaGYv-+;Dol1LOLk|MA%F zh)*p;Qe`Y>UtmF)bl>y7P4T4to&{K^qd!%mYAcWu-D?f4&(pGi2nPd?)Ju3ZM6y3- z(4k4&$=Uf7WOh)@2v+pqJmOFELG|tfIt2886_EE}AOtNVoZ1@=e5z#pRJztjY`Y1F z!VdWT+Vv=b<24|Vseu{;{yL7LpqQuUeI<{XmzoIrtYpP3u!^;ADxU9H=@9Ou;tzBB z26xU+|7h7(nN3jsJ#Fkh_*!d*1&Cqd`Ij^*<`cWs$cr{0Z=0G@fL}D(Bz7dl@=_#` zdv1&bU6Rs}yikz1|H1@5tzhGvKzXi3o4tqu}XoWV*qtY-HDQ?)kagGTIr#>`+a z?XZW-(QYik>XG*!Qbl^_CXh1JW!ysO`OUw52)zM~Y71A%x>6bK>Ou@CG}91}SlYGL zlKL)FRxm8VypGM}&H8qSOe3 z)B@FV`Y@0g1vBe6%qJ4w3mH%iL`sYSi!Yh-_HA!s;e_FGv@97|N* zqus|Tp>tJ$Sk4}8ZUFO2R_3UxPL~Qdx*x+JYtHfAMcEKQb|dz^={9HtrITRP9(bH7<@WfHgoCozu`bZG=ch1s&C1ifXqkMo)?ZtmP__T>5=q~=8>`xg_!GiW;9F62R1 zi(io>9g0VlTV8>QTv0LBROSO@5Y(0j-K6yOD^zB)S?BRHZ*!sK3r}|n$`8q0Ni{hr~v2(5R=H*+gCa2_XAfK zq>q!6DquU!t*qeJfLBMIG^DJf6IoJH3KAtCxYK~CyE~Daac~dDXVB1=0g&>o!1Kh# z$5&NRd2emaY}KPw7LE$ajhGIJuz{bDc$E5-&oO)uyv){U|6%SZ4m$>0Bb z7Qh%D{%9SzJ5V79M0IPcAj3=z2=k!^<=eNw|AK}At!{v2l!Bzy!NEaEUHz-B&a5U- zKv`aAF9`_=jf{*cf!2gFQ$UlNnwrjF9eGKhyM24UQv)!oy1E+N8zlki*}Q2M7Rq;! zG4JR;-{Av4VRL6kHZ+N6#VrsdXHvyPRd}IdhRH#aX<+xR^=7@MK}>1P56Ppb90;Lu6= z#cgcL)!^_rQ-RrFFp|o3^XPMSehzh|L2kJH>lG_C9bGWsnAH|DZzrdww(5oJIYtbs zD#1bn2~8<&4Q>JX`+I1I0m_e!3}3l;#L2@`1I`XUIv8Y0B@BeJ(WVCYCX{_Bz+KVLMvXBLe#{hz>7h%?30X) z%pABOO-;?S?_1aRnjqqY0WC>If?nfsX#sTtKrjgYP}9=FDQRjB0Nj_7mrr2r0wJc| zzcn#%i&4bE&y$&@BPO{eC1Ftb^nZZ_DR~Q=`}N#tVFSS2OLbZj0sGwF-){uZ#xw!n z9t7vmB(?S7Y-sYQHmDR3d=~)28=&Cn-*8sotpoPve!guFk`6Y9O(|$lQfoft*Nv*; zeSftDbQ2Po#|)|kQVX5npM&@YMK0yskEbWT&uP%i1%&1`K+D)PgI_(p*z1NmI$+7A zrKHw?xPxlkO%U1`F4kK^HLu}#wiqyRxUCm@z|1BD1q139P{uGYx1mC{y!8xtpvGH+ z34)IoQ=;)1mQN42OCS!9AmNJz2{3g35m5;!>e4<&67>SXj{o-UTMba^K$UobxCI84 zTsR$yG62Wq+ncPpiJ_5&Plqmc56Cz{WB?Vi0|NsfOMse4$4xtA*x1<6$Bv-+%yNrs zVL?IA3nX+lp9eST#2RSk>wTdNeJo*k*a%z-RO)~=_pxc&wBs!*E87C0GceQPgS(+w z7&Ien0&pb|lf;{$01fg1@W0t(1kTlvb;EKWFjxMA-8Fxt-Q^aZFi556wGA`?0e}b% z^uV9m`g(`^qXx&@t)yIf6p*#(193o2Lo)%u0?f*u7Z`#R#-D-x0-6W{;s=m_LNh(6 z1p?~p1`ICf(-6Si<0U~yL?`(T;)%|Fa^Hv%lkOvzxRjKEA8$Sg?<63zn)imi29G`1 z9o5Ymq$;*@^F7Klwpu%J_AT0BsHMZwtD0O=pF;VO*=u-Vz!!Q)vb zK>97Yu6hG`5eA-BvELnkLzqO$=RgfI*iIn50KAc)BZ2BmAZwr6%L9)~fecNK=n&9% zI}j$@gRwRB=T9H-5r(%%(yA7Zrl+Uvz+O6lQ56>--;*ii>2_GvZ)RrJX;7tC_hoM) zH+Xu@6WB_?SSR7N^ZTspod9J5>)pYw5I)fFP?s5$*I;Weu%fz;8dgU^WH|TeGG8K8X5K(c)X6r|(Tys2R-?a$8@+t8$QfG(@& z{Qy*%TUh*s(h3kJ1J@)tW3_` zoll`K4$6+83>qNlSGRQpAMk+18Q_gj!Ta=d-61QV3++It-2&!%G;}J1^8up{WP_WV zn|7e1|NXyIa~wR&(CU5;FtQbdJD@s&j|H{#n*RNIW$f#Hm?&!%W6eS+M+q>xf%4IRKU) zvYv?d3tOWIjLp_Xb#MwGKlA{ofNCm#5Kt9<;Qmg{8>HV}tlyVTTF*rJg7Vl?;UlmQ16w&nE$MAL;uijRxy z0DCbSP#M$<K0N5ZU<#`+l-hD|?7QMK5CR|-4z=7mI2G3GbQWQZ3 zLg=!Rs_Oc2`<1wol2Sajj6)H;hzW9EAr>ui@PP9R7-bbXBY}<}A}@H*F0f(#Ae#rt z2O%L&NtN8&7SK1B9dtibEU&uRl@g{WFH6vb0e2uI+f z!MX7Pq6JVFVEHt_pB%k6`k)Jh+hIsY(0AR&-}pr?=FSQW>3uk^;Px020CXH2DsCpu zfJTwi1IgvUfeUWr3;0e<3PIVW#60>0!J={N-}UX~VXs*|d2-Kgf>DX|Ym>7n)HNv3 z;75T$+6U*B9cXP}RD&Iin1t|wv{0y8dkbJ77eh#H`eqoX5jjxy7BUvD^z z5P1}K0H}Fjmd7pdURya0yJJm`4iE(i4jukncnjsL8p@=D&>h5sgB=C$paZ@#m7Vwa*p-4lF3=$GUaDtKxIgrB!=oC-`WlqFp z`9G*muvYzX3`mqpQBlzh5@d%zrXw!Sj)&Z6rBXLtMBt~{3Nd#99Y+_ayyXWpk@|^1 zSoZ}*QKly)jn5$g5+2CS^*7^Hgz-~{vS8N?!9g1{Y_kSVfd!O0M5%-$q0Q&)J&^CM zrFKa`Cjd3hkV`d@PPAETz=>r0KpJ;@_6(8mAQ1`~C{6gKN|V;D>9V(n|G+~)@_Jpt zxNBfh_weE%KWOv050a>D8uP5GygYhZ;W%6pfK&)*1^5lwDn6fo?#(2Q4h~305N`P# zRxAL(u+<14f4S)NWVJgC00cS;B?`XK$)@C$5^S@zzL>Xe>(c1rf`Unhhwf0!8RtLT zxaB%a7WukZRb(ca7mQ56^(cK4InWR>gQVd#f2-ATaO-96T_Q z!1QfjE=+f_0Ld9#2FX~un>mSeZj_jqm~h`wgbGGV;d%j&>A48~x~Y6kl!wiYsFE=L6{hrxIdG?|lE2d?=## zW+m^2?DdPw(@ppq zI`#Q${q<4(k0Cf@SvLk6PsMno)})k z8ZL+1o28eVnXoj-5rV{7kP0^8}EL<&Qy#M$USmLGm$o)nM1oH9Dpr zmfyH%AVS4V7}lS!BSKYJQUdqBl%8I4ViG|^gvn69>{$UQKXCU#fKjPxKR1Fq7p_w# z;ak{4nyj)QGXhLWZg1VK9Rg;tvD^`mNf=JQl9ZLjJzsKT(}|HV2NEs-A>hch?ve+t zi=^H1v4R$UCU<{zNlDjZeS{JJ2YAxIzdwhNBNhsEf0XdIeptmm_!AaCoNqFU`{~c=d>*7>}oKo5D*kpB0-l@4vzB|!3(59*HZ`5MhLNKg$bWAZhDv5n*} z8=aT9iOj&0&B@7;`YtUiJ-p$jgu;=!#x|4x{+r3EPfSpi9N`0@AvSma?x=9CQT#6` z1n?|>dc!YcUt<90RfIqmU}9lN?1Jm6!c`p^iE{~C?Eu*ZNCyBis&57A&D)Gj&(_Su zL}G{~0odPhC+H@(tgDj=##sUMnV9%oy4VRQ^aN{*kb#Fe~Ydr;*v=<>)%`Us1_rVXa0uKr4wZNek zO9Y`}=%?OpO;0XQlN<6Fso9sB># zdZ1dfMA8>6*e#9ibbj&+vHLg;YXjjk-fmhL2A6_Eus4v5@vbJp?=*mrF%tiZ6T1m| zRX@uqo_CL^d^lNj5{A-guZzOFn38=SzbwrQt;hq{gI=j$lbU>(;H-E zp(YsnJmfh1z$y>`5B~8GkMA#R$kFZ0R9GHvjcfBb0EKlc;Yf`M|0l9~@xDp%0Zi2q*>U&)vLE2)!VO-rc`$G!^HvPAvNzblfub zoVP|YqKN+R_@h@`S{gfMuVo3P+9V?%AHloPKKK;2c6KX(E1q0kUQE~^5N(iY3w&U5-2dzM`>yRKi(j)Zx+I57c!x0L=AqWsZ zya$|G0Fhdr?~fE~ttp-xyn6=2`OJBCi%BV8DP$NAj1G|TnMben*~n(cjU zMouHC0Q7-hAcKRMcnZNOL{ygIC5HeiH(ZWdkn!;DKIjMbMccGnWBnvIqn{TC;XMH5 zKZBlwBvp&c%h%!RT6P9vX82v6BH=m&$0E50enW&*f=NyEP-U(n(fED8( zx6Fx~K*|qE@*ux~IQVd~!~YlzC13!QT+FF5;b9W3wM%M&oAv${#C4GAhO4_92^mV@O1`>O}u~gASyUCPfXiegBSs>EZjAS#L6HaDUzdiSjCtRM};*@ z_(2-nC;1~utZS^Sth7{klX(iakv0J2t0Tb$T@(}WWq8>H=&V4p#t1L}b9K3NwFXBu zf*IF0Hga~vzy@CdX^av0a(%r3Tek>Abby5p!jISs7~ew%kY2z9^Z)uchDP%7j3_BFu{-*2xCQ5M3mSO8KW41KbU z5${FL#5H3OY#IIoF8bRhVt;dE12#$c><)r4AXR*R8}zzDFxnB_0J#dtndc(H%E`GN ze8(yFsIb%EF(htwm)hS!&L}M-gUajZM-MP`D2X^rdA=A_T8c;;V89LR z7Zwx@EC%BKlq;RY*9CV^6j{d z#Wb?h))XS9ppNqbO}~U($PoD={Py}@ad!4Y32c9=R)Ew1R^=nfI{@$v07W~6EQV8D%Q4$F;!5W$M$I?w0ynJxCH-=^u$jC4( zI(-roBFzCWWmmcJ%*~CF?-e6q+-S9dFj}YO1yuUTrTtAr4jLTnhGDRv*{AsQXE&fLR7kZ#MSl^;L83kVrxa{;xy;$r9{ z94{$nYV1IgGuk%tiG$!~fTOkXGUy2e&>7FBdiYe7m7#b*)O#Gz4?uEJ(Po`o1!AkR zQuc&9pzs6nSLq3XQayjgeYY1r!P=1*NTYN>y1kD2TG~2?khBmB%g`w_-s3wh^|_y(fF8h8%Wr8(gHr-3r4?a8O^sHtqs9HQ z?qo?gR{)j+&qY)RE34Rq1cv7-cViTObYBB61DfOzE~!S2LZM(AEW0(sk|y3fl-?|> zuTKPO04op{76y87Kh||~4ET1CcZQd7kKZGR5`bUQmNNRR(QPY-CdkI7wD%&g+-tVc z#C6HTqzIDag@w$3E#T|L-8>IAM@(=)jbH+SN;=p}^{W%CS7<1W&&*UaGNOE3)ig<| zNh~)4Js%a5m1+V!D3B+hs}0!3xIh#v84xZlV!1&MYa1Jg4UH+yOG7R;3hY1#3yL9) zNk}G61@qO4F)#!zeSKiWl)yG>b#;qhfqbBH%HZl3^lh<58r?KZL(lymh8;oNI+|7N zxuQ0kf2b@YV<35!Vq544U(FE-wNYpFjerhy`|6qrj@%2)emD1|I09i_JtrnTxBN2W zaPlhFbg_wy|C)=JU8t*ggFAU6nlf3>qkj?;$}LH}t4c7A!9YFSoHKOjdmAeordAwQ zTROKNt}aCItbXC=Z;9?kN6#c8vQ47fH5jR(FB-R|cG%14zu)B$J+!W@QWOX$E8Y4| z^o($TsfO8-$-MhxSkf5*wN{O`sD(I&T`I${Y2>s;P5;ZVm!VHx7*nYUhKMbRHc6R6 zS1&_FvDP;KoUS+E_u)UydzvB}sU_fyah;swCSxy8R>IuovSP3jm5#eYSiI1$rkbbv ztn`m6X4H2cK1g4+rdM8;wJ;?2F#l|siRtR=>c~Z^Qk0)3qURu-W{^;mbK5l%QAME# z=r_1;nwpxlqfEX$4jQv-p-U0mQZ;|O$)iJ@gX-_kH0=GbiSVQO`Nz^{Q?dR2INvAz zJkv9N%ahW+f2Es|A7@<7PyOQl_+-wmrHg!vi$1gNy=LmL=)Jge5|OpGBXakkd5z}h z1JmP-X!l6VixI#wKnd>pox6g*_kJz<{`=K%4y*D9f5|N#E3{OZTHkfG4is4pUAvDR z(S!KKh=cTGGz;M-X1pgf)|cUT=Kt@%6MQFBDxH~`xe_VZQsR>Q+*dovA9Pak+V@)0#yxy)6Uma@zISJSKKt$(9bP|XsY67Ut|W|-K+ ze+Pw9{NLYk^e%Z_#Og&_Q6}+DgLJ;ER2ibfoZVy@?;zfnOCa*Kl2wFHF0Pf8mrPYl zx>jzBGtA#Dj%!zWm`s7nwcC|{1^bTSid|!4BhtV$2_n`&VLPZ{ASsCMl-Dt?O#s;J z1$RM3T^$c-unq7PsA1^1l--E8d_Oap$CSII+wM=}a+x05WL{?8)2!^f`ob5AQko7&sF0}J)b^)l%2pSuLw7`jmc5eW)$YBTv28d{E zP-%gpAYTFT3BYYSfK+x0H1$xZO&Wmd313VS3ARBFn1L{C3@Q+qGNT}7GBpQJZd=Wi z8-fNOf+RBlsf>fU1Qr*|faK~?y=zAJNv`9tYew411fSt+XsSV6W#HcPt(*Mr_uqwU^lAi=U4lxVCSO=B1 z7F=qG)mfQh1xfQ0)6O{oAZ1{eC39xWNd6~kUrJX z(UDP7!i389)@@LFLI#Dx>G}kd3=mPDqw>8!ShjBwjS;}EE~*DyxEh01*K!ec%+Qpw z*!(aqyGSmd$g0hKQq{@x-|~7ckFs2QDas9Mq)TCX_Tn8B>J&oH6auygk_X=izH=YQ z`!4}hrQCmBIi=SEiVS0nJ!exP^oO21{$3w|0Le3GL#=^yn7avLu_dbh{q<#DMBOt~ zaPg?UvOVB^&PAnED|A|39$2??Qes0W4Wi*TfSckQzS`8e!iy`@uL3tmx|ks1FjsF! z1OexB=x&V1ssTw3KnNe8FT;3`>XV8gRS&O0C@leFKq| z!AFXrA^2^NPK=82ZmxZNJ%@+cOg0%gXuuIJEh7`4J4yUY-xVi2L7$RCnZ@23!Zy}x z{wHTA>5|b26gArHCP@L7<0wz2XdN2Z1A+`3qyeEN;Z})eqlC5mHSs*sxlH&Nim7-x zbqo?ATmD2wN~`w>C;>iA6w@fNGr|eQMKyp;f{v<>0MU`H5hLW|!W`-0Nt%S93#Z)8 z)BUQh1o0moF|1@bJT0(p$OcoHtRtxvWm!2gI zt!;)3`Ks)RV`VC4X}1f-MCYbin{(R^yP7P_V@wL8K-6G33k4@WwtQRHnF{V?SEBWeWYLlvx@2tZ%`2{q$3ur-{WG&j+2Rg+(@Q4xHK- z4{^IKc(qTmccEYUGQWPXy*^ z2ObanOn->j^od7GUMa{qyi9&=msXp{Cn-q-`fZRj=nc=6iIM8L;xD4^+a2ryx&#jP zska26PY8&EVCPpSuct+eAC8Y9cm2H2OG1rEmt>ce8l}@dCB0++pp854u%hdRoKCf< zAiY$8%O{Z<;Tf%HOApx?BFwC1SJg2`_B0gJR)m@SXP)Pm`@9zS-?vnnX!ZR(K9kfh zEGRAIlp#hJdfet=Py6?A7+E1iTKM?l0D3{xQO(2SNcf4B2gw&S0?*mt8be0|!JBL3 z!GNPayy3+(ihZ2gs7`XDF9@xL$^J&Z@HN>^bUMGlghf8h#I38(dG8Ox3-K{2b*T@{ zpYOcat{8v%=jLWXF_!#Xc4a|dlwCssLSpK88JH27K>H{PY> z*)FR~qHd(_9E6v5GuYgB#3_y0z>(e2!$tQpMQBSe>3+1{)DJnyJg{98@t}PiU1%2%#;3M6Aq=~*f}uBX27+z{;l z-l{PON=fD{T9*#_Pv>UD2H2!!Z)53&j9fMxm1p_jYxv+R#7CEMytv~pl2BoMknWqm zc^~71{@rcrP$IUFE3Vb(&I4Ag%m?xmkM;GXx3ACo_NQ^{n4R)dSN`n<-$*yKtg zI^hoew>_}))YPnj10fxo=jYxqa{z_~LGSP79d&Out$jf%z8c#;(+31y4^}EZ=DzN! zta&0w{fA~jPLD>I?4poINpw8A_HQyi7s{7Y?`GG3ul&{fX*w_zDgrU*j42DR<@~k% zJh!T;r5ofj)@>2v6c!+Hy-cTPmsguKM4r(~Ui{%F3!U)_cDND8Xo;av?mm6c}xS&^fjDqUyUNg5Jf%3<5$&!E*OKt~vfk45F{ zGK{zX&1P29<0gXzAr?8gd4O5#8;-@n{DBLMQ-%|90=w59e7A3QUb{{-=8>eyD@HS% zYtf)k6*FCuvxQ~T&A1g~7KkHICNEtY3gmb-VAqqNM!S93`=MRfHB5~#b!Aw}pAr6KN zoN6(FGTF{C15gggx|LB^_LtAFTFn0I*SRpA+7h_(35W@hWU?jT1E_;gR$08C9 z8GQZPq{A%CExjZ~5qp>0j*cCBGp>w}_;BHd%ljzUo#XhJUMk`6uDY&CK|`;GawS~# zE&)|tlvGp66wRS_-K>msOVpt>3u(GMtC?m?PU`nkPhQo(Rd$~;oft%C-`I$H;T*T3 zYqfaf_fnWY3=+Qc%5SaU5er$M6p0lo_i$wYc*qZ!X>3NuXYf@KEeNy|M3DsL9;!ZL z(5DhRE0UYTx!Sdr1R5r<|Mz^Z3M6+o z$Fua)3vCzt{7-nuw(_@S0~_b7oWNXylE{Cq*GkdjVl&X0v06;>YCiY<-c%7eG~~!a zmsAqPWBxjxekiR!Rd*O<_{U!KY<5N=>K%{t@qU5J_bZb46ze=2(>vH%b82vgWVl*O z05+_f?fSjVR6lj2nrZ9(WVyjEC6}Nt_lXBhyxVTE(bS`*w)eq4_^B7EBWvt2F=JM*9zy_tmUV zb#v|`C%;E26Ae+3=dRDWo7-tTo78ohV|qq+yW;ZiZC_rB5PC?w+`)fpL&I3n8j;1I z&DV*Jy8oq`Wh?T1>FcQnEKf~2))It=wr7^q_E+6UJ~oqKzxx_sqebrb%DKGJwsREU zTARAY7!~0(`n;-mGm_>z-}doE@wdf6|Gwjc?MEBNE*hq~WrHp4Z|nRVuUl5_C|xcy z4mJwZ?FJDVZ|n6g&Jj%p{++?^c>Tsn->%a3$uHAm!b6IT=dXAOpY0}AI+`7o^Os|` ze8?hgmA6cN`&&&7=W6MJ_HX0zERWY3-#A(J53R65id_EUYAI#^3wYdiRVMLXyWEyk z(1`u7X}D#Be_zy(0c<%ftD(AS`=mg~n+y z!512LFM6%xwbm`xr%y$6IAQaI+e|C&>~(&hsumI8k05k;BA41HAxu5VICq!MPm!O& zFGWK>CqjzM-SX2*!>QfB_*mpqZ@uOl%A=*0MhlM(x3@f#Cc`KDCB@^!Iez>S45^tD za8D0*LXC5=ztWo-*Bu{u`TTITzK&mU=o$ZN=^oAp+WY^ce^g&zF}s1%r|^8q?K3(+ zU-lfWNAhPh!@P9Q6RzSkY5O-s3c1lXDELk)+D?I6x(XfhUza6K5V`nMH*xPbry8D=nV=sGmOJ>oTp~&K`Om8LFfm zo!RYh|0fq+q~f7*;kE4`?hGZ;FOOtW&|gsc-}q>r+-^*$R(LH1-!_JHM}dBP0#Cm* zDUs@yuSTdMxvoja$_$?>Q5SFCfJm3DAnh`49#s#m+-7;Kj}cm$T+aek=l6+f7Ngvw zj@M0mMn2V0kZ%dYfDiI5(x5_i$q_5;m4`P_T2=|ccG8xq@75jeQ-~8DGz4PY!hz4B z{hMlwl;qxo)-x)8mnUD8I8;CFW6JfFmxvH@)e_Q8IpJfbn?3wQCWTtdGNLMCzHw2S z%L;Zp#D`#G!(V{@c69{YLUi#82D4|j?mO@LF9mVo zT5h8<)LF;k2KM@GI7$fx|D!%CDy@|LS$eIsQaW={Lj zO(qZ?2gBfy%Z~N2FF(OB5x&B;F4?B1@3pxMGAP@=oAtdETlEj7IQl-F@{cRXHq1b^ zmYwpR03SWIN2aoXw>hOk3U)5rN}$sdD%T8m{4AjB9X54wsi|S0)Wc{ZbI6ip`2O3* zxg!(_iElNvsP#coYp+}%F?@zefi0XEkZ za+6$M1@6h{^l$I<&Qi)Zu|ma0`-V|yPWA0K&C@1_hm2Oa_jPwM#a3da7~R*UuZjyK zzqsP;hKU86$HzKZo?NYu?_uU<$U zjhz9wBmFx{t940bZ`sPw$2oA=HokC3q>GM7koe~xct+Q>?)EcJ^!uc<2bb?WdB3+v z8`}xl|EZ@8KiSIqnGbyq!JLbh!3eVSjm1v5baf;hU!VODX>t$z9l5EqTFDi zF?K&mTrT2D4G?0UO8hqrg;4@5a;taA4?D)JBz$Xbpmg9E!gRKbT^#zM2*+W6kEj;U zhk&L}ktv5__cAN4Ds8rx{@&Z0p?6S^5-+2iYbw3lx8%2q+ zz$;*sti~V-J?Id&vBD)X7Rr?2x~u2J)=|pVCr}%X_U$2glas~xv}NORIR3+8@y<`! zwKXh1%3oDv6ioiL{K?vRyHP>$=iYLC4TaTV{k`v3ScaF{Z2Ol^_c85A`MsDlc{wRi zQ9>NHDYkkf5i)0Ah4h(XX@EXnib7I==gLrGcxWSVY8*AT%kv{iT>|<}f0*_nYDJnuaTU=UR3vJDL zr{_1B%8UIsKSkmz^4CSTeQd-~_ZLECRaI{iNBH;no_tB6UaS3*XUUHnn!;R^nbh$H zSM9T(!)-Vfp3NMIk8!g1`blBxQ!PnYgw?nHe%S5H?811IY`_!&%}z)pwr|ZGQYc91 z5zMA@-}b~l!u-YD8b&HS72j}8*2AOzQ7T+4e5^Y+7+4yub+xJu+YPiD3rpaX`PNH& zbnC;(qr9GiXhsgDc|D+N#DI9&1@ulz7WO;7&kSs*D?W{)VX%l#-j~(N+19-8>zo3Z zPC(sG-m)3@)(6%!WurDC;(KX0Kg{av%dj=;s-j{grM2}0-sBgLzg2yt_Mfv(>=fE9 zp^#`yS$}lgTRwB~?(z42Qd1j^8PBVCNzo{YdTO_}ehM}BoFJCI#DGr(ke|`|3m*=V z9Ll!xFVR7u(*B<8^pvfm1FQ6Kme7|U0dtFDhH~7yVWg2Rhdoo8-@8)ndorD5v`BU_ zDUWV>PwhH({TO4VOzmZPHZ*@Ss_c8vznxDeR=l`h@KKcbqYyRj?Krc*-~fqTB~nr5 z#oRF?vTPeu_wrP66Vu3D7Er0sqM5EHr?;>kV@l~1@3aVHK^F`-Id!0I;&hq8hy-NC zLF)MMm`5mGO^+(njjN-SS?scVbg4M*=2#+8L>-pwXCmi{n_}ULdEW|cv^JVm8PbXg zGd07}Nz;Q%pMP*fi?e+rPURHWPzKl*JNk&ULS4>IuDM-bN9)LEY9x zC1sj|+d7C%{q)#JIoXApgypxUAMR1T>DCK{e-~lCp1FR{0=b*ks9B8SZ7ejZW0Uvu zy;bf-SxXR;Ae3T#!pVw+3I8zoeo|^C{%Wsav@=DGkzLK*a^C8eO3Spu-E{~8BkQ59 z-TA*EPe~9hkIl@Cf=M|Q6>7{~vR_eJ#Hs6Iq_+;94<$scVM`^>*(KYCGE(t^3h>B3 zy0k3NdnF<3;6b!Vi!}K}r8j25%ghtY~Ay42C%j6X;y2 zW;DK)pRdWeGCCf)`~O~fn^oza%y^?^nNAFIeJ8rPpU7TZuj?TF%yN(0N$-RfRxTMt z(!uODthK@frv;>HcndH|Xz?-JCrpX@B;pUx#_@$~UCk(&R~~-02z&mt$2ELac3_l? zG{S)jX&Zyqm~2RZfju6dm8A|LT_^;MjEsucIpU#}u7RkjsP5NQY@V35zYqlC)L+#@?J z1)0d2N7*_Lgl2Rk2-{p6zPK<-)4E%f7MJFlP3CQAn$C@6*^*wdu1)=EPUmG~V4XT1_E0OgSG}$qpZ<;( z$?G+W+j3zx^N&gwYQ6}T<6Q(AJtPtQlJ&z8%R*%=&qTvC;8tZZ*0=ApbnS0AdI&e- zq810r0P6}Qo>tEZ>?$Sm6o_RPkH2tGX`orGwD6EEc%i=j3P3#Cx9ar>aXsT7ifPuM zn_Ii&?^VpbYsE6c(h$<~T!fXjquiOTdIH8FBpL!%S65kYyZMN_%&Cwt@~obih|fBU zGnb*=^&^j1>MQ46}69&Wz?OVSVS7T3(mj0^sw}6H1S9<7{zB73N49jzyjVt=RViWh?t8Shz}=4Y z=?X2i+BLS-UV^?^%!nSCUR`@nCDw_Bg$0J!AmfN(B0}Et{cjoI_h@;<;xTg-O)Ami z$Eq6Dgp;DtQ_6}cV`itkrxp`sYb5#?ZJw6+<42fytW9F2W*wWuBhBG|!h^QQ zfiMnUANiRXuICa+4R zB$g_tUXJ&Z*Hs0FEb@F)Ywrz3>m;dU@$zw?T?Mx6{ppt79ulTOqA{bLqK{lR?E6Zh zr~h*atRa`5GJ8VY>{4jJN1qvdaa!Z?Sw)M)|C?exlc<&AW22VOI!&chGzZ!Zc}blF zc8vK(xyE&HM=-expq30`W(3rvb7H4fv{6ZljM5NAfsij`v>|to2ga-{#ORUkir>x_ zWf*~*UIKR6M2=Tiy-XdrU5xJj_6;jU>mskCg$!E zGrT9H_rZAZ)$P6Y@Q_=v@%xNhQHp3OiesU@f?Zk`KZmYB&z8P3DOP4k;{HfCOTJod zTQ8}4iFP?Ec9JEI=7CTOaEWYTe;cjpIh3^Tbvcw6u`?ZUs97N1qYB&mmCUD(T~cej zT}euPt`Zu$44aj*mbGbuU(g*iLP_;P0^~Qz9TmQ!p4)4s$#gO93Nwbh>2h3|kUZ?e zNFPr&$9rem-=#{09;uaEm!nt zD~_yxuNiS-7@~Os@=&+Cofa>AB}pT0z8!+`-wsAmRwO(yy5+mBNcD&K3Tk?};%<_im3}yc#h6yZoO+CF_}Fxb)s@*$J$S4=RfNu;S-jKD=Y@7r1WB z(xO&SFc@-g-rp(0ZK`nwy}DU|bHvsl7wCz0V^sERw$~F5(zo*VZA8PAOn>$6zaag9 zd(FuHI!Fu3S=8w|R~BE(#3S;udgByoNg~Q8AII_#SmSEM)w*ZR(Sv}j1PsLXGn2EZ-f#E zLr_nkV>)lAWp|ZOxxRBbJUE~#TxX)6-CkF+%*ux$?sZ3h8CG?x`v*0tW)Iw3IBvI? z#*cS#{#H3=17Wn!3b5YaEou-_w26xl=h)en5C}7WyHUGUbp{G*5`q3kP72mA$`=F< z<>^X2(4(gw+!_(!I4XEN(pJNAQ$~BPz4DEnpny(YaT+QsJymQj|C2+$) zG%s;NBi**_c5L$I`fhr7|LzJsA)glS{E6qyM^`3`IsIl6YmvJ0SNTA2gp5khIlb+9 z7DJf%e*EwzRx7CB{`C8;a>>{6@E(FB6^+l;T6Lpc^TMQY@jL&ar0Pl&y(biZKGv9` zJ?p}0p$%E3dEO_WI`i>yFR+U2&RR0%{_QoJuUsFiMN!h1{aPOnMOH;fqmR9zZw3a? zlHmB34efjC8zY%28#*4QS^+Ml(y(omx7DK>5lN|d?( z|FZy6M_EE&Q-whM98ck((#yhCn9r?MSD~fix2yP*XY^?wSEsh|nubg)W)msj3vJ;@ zjQW`yU^p54q`c;w5|g!{a5}?0@}coH_Wq8Fr=)Oe^2~(G*sVhUQhx#g+p-uvv@QEY zt5%z;kO~^zIG?oi2$tibr4v=5kB>Sk3mT~9XR-?hH9BI6+x+xRdzU66g0D-=eCB4D za>_Q0ZVR>gtc!XW^s$T*CXVH=KH_xo)-(&ir5k2(rnXoGijcGxvPpc`vsU6mtxL42FfoKD9&aD%~ZxHJk%t_6^bl8eq=neBw7mu&rG^<)E^zjP|lf6c|ppNVk^;?O-Iz9dU@}5M-<<UtGDy9~kC>aXHjHQL zQ`6$SU(3}OX2qmIsNlOg%N1?>`=5seM=j^0S~;a;t9Xl>iuklxn1mm%w|@HDRyVo# z_3!1c^!xW)4PIy8(7e&S`BHIrWaO*Rz0Is8(WT#6HdI4-r^)0&uIX!|c&LApx@VPW zHX9LiN%S@6SzbcEm$FM02k%FqnR7miwZ@KCop=-t3QbzUPvT6I-C7rS-4ib zAIbMZtgj@q%i&~O&&otzFz9K84SU8MU+3w?+Jl1~mG?gbhDDM!{&2a56In+~@EQE1 zcoqGS4n70XjzsmtYj|Jrt8N)1ULU&qh(_lvO zbf0noVQJ~e*3hMhs}8f_64^*aOGzv>E2{9I?%fTyn=nUCI)daz8tuFVVa4n~)O;s- zjT^PK;R`d|tYLz(d$x}=vjwazH;n1+qFP2UO4&wnxe`8k_Uv5QnxM6-;rl366yG|xaG5f2Eo!%wHuz7?uUzb&PGvp&u~TUyq9YJZsU0= z4VWwfKkmy)in){>7{62elI^P$=+@E0eP-K2uZfjJ5{REcAk4tAuY2q1A52e)O5$05 z+tMJ7VbV1`LWk^pCM80cAdv%O`;ECntPN2$jzhJY#07&mb)04Po77Z8M`_ew6P0Gl z-cJj0hPl}sv*wXuGYS{gaCA;dWZM(QbB_D5hfruK35Fa{#YHhGb>61ce_PWXIQrI} z_1>a`&()7)k)&AbYc;>w!^WQVjD~ZU_T>B#%{u)}QSLwFkK+6BR@T+=-FW2(gJ{z= z!D8-outk#(2%hEuxpSnQ722+m zJ`Tpp_tIqcCx0W|&QqnFeDcFyB+$hlpxO>{Z_*Me?O25xEcyM zz(4Be3&n|@*6Cyw?xReC#`7|~tjo!J-pB1!))xv!N&=K8SsJ4&oIJi8XdcvbPFDxg zE2$e{k8_2wiTBTz#g^~iU9Pj$Nz-qe9K!bVdGq|LS35Fv@bn3~XtSjvqj7_qyOdw8 ze9^?S^C9)AXZC-$&k~>E5&6gwMlq9_rZ3Ow1SH*_7hp1Qc(V75tZ&D(_xEr1s%M-r zs*h5lkCguUv?qN&UxgQdi@9yMdbxpg6{%eDe_d?z?neeym(?gY2#ThS+F+rELB?$%@I9VXTO|!*$PvJtANA_V9N)<3Fwi#cJgZ zN_;N3%Ri{> zIAS*Xco7Wr;%~&?{}@^EHQ#@S?WUxPMS4_3-q$~=au2TjxDU3-qVbh&0~08@o)Y3@ z4iDqU#aWm73lTokU#;c*_F&f2@MuroE5`ce>TUHn1AO{%+t}?$-uXx6)x-INHA-($ z-qVgM9iz{@6|LTU&=g3mXrBu+5$l`u^G#kyBbp`Uc+Dj_`*_+Y)~bf0Y%9+0_Mgg8 z&ehX)vC*chHG)ny+K)Hg&Q7 zG}#tG*~waR`<{Q4-N#-B4tRaP4XWvx$@Sx1{C`TOG8h#lJSHcc{9WC-JkREZ_e4uA zb>sQ$GmAca9-oitw=YJx1S&%Bjq6*TcxS1;N|8-a^33i&IHfv@$d&ye8$f*FO{`+CSTFz*N2&G9!pdEMtCd@uqi!Pns`jW$!`II6t;twsSqg&Z)`m9c+F2zl{AwJlTXcr_w94G#3d|Jy92T;Iq?|Evw)~&o!j8U7Fzmz( za8D0oR3SG{T6reQO`R&M$C&&rbLBjX@9~K;8O=#m(^xHY$EN|#gaEm;$U{kBGzH8Rf@#gu8@^m0$~+~dUaiXOR@SZcwoVVuN*u?sUr!Ov_gD?c z$6!GjR=k&|Padf>agDCP942BiCWn zhF#IDXk`K^;Xsqvhu>0yvioz~Ehx-RBQn$W-09`SAlV!dXSsTEcKUna%tUHC{#=F1 z>++m!N2gr|FW=t2`bN2uwR~C}EYfDi${ejkg4aPp_Sk9+_oiXO4UZ;~rG(6w<~%)Y zp_G5OC@UNEc;LZjij2^qg3MPzdf{P06SQlEJ0g!+a5t&a>uC_5YYsMaj$k}1?28c_ zsQjQVNbJTydUm-&Z?9;+@75WHzMfx&D*M^9AH5mJ-k%ki>{oQ9RR?+lE^zGE*9++SK}9cp(E< z;L%KOZnfdAxQ|U+GllakK5BosV4vT?*Or^80<`q@ft4J6{LGj%`-cD7U-#?9^(KrI z3d&xIx*CX`5O-gl&$$w>)EJin+XR|Dl zl$Z&WDFby@%}0-_u}H>$Hm$uJ?Mo+Y=qh|zCpd;vT=6gfgI#N(5yohXM0de+bGCo{ zKqOKC38X`{{hNPK>3c>W-xwJ?{%m){b=w{;b=pkWCFy+T^WZqM=>ciVH|Vq)?Td<_ z5c#eA8=LScS4Z{?J98|RDs#f&@$sJt6&^l*{!U~BO`70Scs*jQAc}>QVaoJO-GI%u z`HFx$++QmC->!*Qk+yCA3C5QYmI^v5tWmD2&3kFH<9*J^p!njNCu&kab+UYr5FKU9 z#ShUAUQy8jP?nqBw+Ug|0Wxx5RZR_LdM^N9C*kvx{WBH{VS#~vpJY1<-Eo~7B>Wlh z@1bx|ZQlcF%lu8Rl9Xz46471Ou4pIYeuE4ghZn0IVEUiq~!ha?j9c; zOEV zTuHWiB0Ie4ql;OjL8jEjYQJ^;>S;>M9croHI>ZG=A7Q$fUD|)s-DRv;@YukC0VQOV z5>D4Lv=h-&M)8Y@83mbNdxlr_Ej;n(9ixF{hqoP=vGAC+ zN(6h7)Lb_;C?jSb+�AJc`KUY`*uWE%$kwk1wzM3L+tO1)j6Z>Nf> zl>cT!8Xuu;aOYeB+O77Q==tHkU3WxBg)g7G(k*#; z^uTQkDI==Bjz&i~Hvd{;2cf|fySf%&r z-E617&CcB27B-mzN-naD(ysD-%v-bB``c%_jJJC_3`Em4jV-r~vw#VYx6#Q7SZb!Q z1~5{Q$vW#1pv||9IdR>Z@Ovg#K%JY;Un}(Ua@pXn=RnW#!x&Z)ql(e+S9c8GGY=R% zzgD)aCuoz?d8&6)P4D(V=k6F;xYb4{Css9G9wkYUu@Y60iCfTRCF44!ppM8qx*yN% zTt!*%gD$&Swq|JyH;Hd?T4f~ooEuL~Fc_8S@5X=~gJ_wMA%RDMe7m|lCW`1GCnqn) za=Z0@cAiwALFvd#nfP(l`)xYoc+TOEKPnD6P$q@PTZ|Vhg|Wn8$&Xg2c%uEePRRr5(^&^Z)ka(Y6$O=$ZX}0p0SW2u z9=bcFyQEX3JES|MyE_D=kw&_^@56V$>z~#PbLKo}@3q%nzmU*nQhLjENXn>%T%CLR zf1~or1XOmQbIeQY_S<5{Di0$Y1P|@60?d|E9*%L~t%?d~Ia&K{`k_Q_WfgXXUOlui zi#DAV295X`Gfy6(p7c6ZhclQu|6rO>B~`Kc-AEFc{QKX$!Et30LO34Xxz|d87Q<_B z?to-r1F-i0l5z$r$`@WBO}v4bSz(Ia$Nr*XTiC_)l4rbwV@bszzR-r<*n>0$RIO-Z z*R4gKm%GzMtJ}d-=hhin)4M#K4VhgZTl>Sa?YFgGZdl7`hV~uVNwxF$m!zqD%R~7; z>azlSQyY&{6FF|u3D>^^yO*u^G1W$^2p*Q0xo)D-g>qyMaPGm0xk_ z+EVggG6J8kQ4bBH;;O!L?H8xZjOCCi)GRGq6M|-llo?5K>^M@@_Hk2Sl&hqn!OxzO zmFb4(*@WNDnlTecFrfMAsN!~)GfKvzjaeTbwZ@4{o2J> zBPbpMOr4@tYCU#oxbLq(6$!Xh5ifAW55XmvR(j*wsXt9AXX_OO(`lCzBvhyb2h-fW zlT-;0^}G8u8V|h?Y(LI{SDL#2)63C~IpzHj7OOTGQ*s>iSF3%cj`gDQF$hRQ1 z{SWbQU#aEnknrkJh#jAAawzCW&Fbr5qWz77BZa*$q#Oyudv8;i4DsZiPR&0*IU@-Pp!wpRy4BAGYo5N_P-a&=nr?QFM=Gl;5KY(7JN3&B597R;R{ZmU;* z8oQEnK^xnNaKd(7N0vJs$;@06YHtpzJyz#u%{#pSr+fc+P1VB@R~2_fv~v&k0MhK$ z?w1VX;qm%kR+c=xCzC5qRmVgOlMRre>gN4qygD-tEaS^=8E`XxvghruZ+8utZCmM& zp~rQPl(xMI^*(x>&MWoK4b7TTG76@LsPCK{-7Ydv+)H_$w3p?(K_l8W)V)tueZhw z&#E7$Hj8EQC|4h&fkV1%R{bxUBFc;6F5vITX~A1_on$?rPN2x{3$t+T`xFPxEXFjH z|IkHMW$s$f$P300d=E7%P)XBPU7j5{b7A`#h>@@i73&YeAp7e!MD8NmuAvC=d>_ff z^37sk>Dp4tObt(D%9!hO?)=lPi1dZ}1wnF01a%i;m0v8|23`!!xD}r=oSXAto|{ve z)3FUj%7g?RQ^UFGVyFr0*x|<qIq3luf@S6+Mkahs+RR^^npG%#vEbl@{FT5^bC49w!QK1JMkc> z9m@Boo%vV!|I=G^hN=?BO9I3Rr|Svv+YbbKAbQ*Wuv zqBS)Hnjhx`iU^75ca$|@sjnL9ejCBAN$VxHz_ZPYAyDUH2b~TPsw|i7j16(*4M$^C zzsWdcX49hhi$xLhhf0=)=qYyaQ8S{I%tl^Z)nF*ztAZ5#gH-P7I_H`fxG9o*e^lUTUMUqrU#1ALF5Vt*;0!Oka{0mk_yk};3>vP z+kK($rA_Uj;-Upi3VpR+V{NRG<5?1G*~C&9zdoN*|kG4xzF)@&nDCtQtXGg>aWvnOFiaLR6OFm!t?ySAE;7Tt^ad@>^=pW5PUrpeIgJ6X|KJ*$ z$J0@EWlVHul@_az{+1U~sdr^G5jbp}pRKV|d1nOk=^-j8BEgYJ5?WGe4&K?))Z0I) zCNXX3&g~pTaj! zgP?=jqaiZbgbLKIYgfn&n;yDceL1?^Lx)6Wq6pM!E9_xVTX4F_3fdtxZ^CQFr5xUs z%W)p-X%f1t=^v6IxIQ4uo^58Pnf$#^9sC~8`PjwOTl!t4bH_bWu5^r_%_x$W^P36H zAEyA3_2fVi5j393#{9!JnUhwBHZ`8K0T)yo_=(aM$$aE8-o4xktD&o?ClEWgpvK-t-j8!EOPSI zyY1^AcBi%Pfv)qriv~>WI8UnN(cjuBQ z*fswB86&~69;&>{q9CwrB2E5LFE=8J*})nF@MM5`+uhy$659v7Pevbw|JKdl=udoafXX18k?Dm9Ce;L;Mp*lG(NY>yP6#Y{O zZ%($P5f^EMGq&q#iS~bS;S3Ws0@|i=W25GT52MCV51Uct--7Vq`dAlESf<{Po0`0|6%$(i>rlzRT^S9J6?|- zW)6M^P~L?Zx*goQvu8E*#eCUUJLgBwYk3`WBEQdz?(LNUMt+iv*HK{4MS0MO{59@Rdl=q&M~7OawtWtyfkJh<4OUCu|GmqfY~IO z#9UoC+m=B9R9Q%H%J`yi$VfMOkR;sEGD%)=Yrow+N-by5qrCy9o-QV&R8kr#l+dJf z`9IIFSOdk1WDB;5xazI|rZ{=VS&~wD-P%e&Q;&%2_?}U+9CS;jlOclvia|8l`R<|l z9evDEWrp@>iR>W;*|_)QP8c#K2a2!2fU!0}-YMB$NBNJ1cxNq7p9g|CZ>|REoXA@+ zlhUD87;BXN{%%esd$1$qUAFJGfBrD2`#1SRAJlMpN~6rMtOJT0*FBe%nN=AbuT1I0 z{e0iKoY?#?f9WM!Yhps7&T3xJ)ReN<0Cl*!I3U25LklzHy#{h8uYZsBVq)uj%n?$3 zW;FQ(QR_^)>ntd{z23kRL(HlK#4+)#8duld1ljr70t{)Hc%myV-m(eFo0mjDbUO-b zq9QDBUCYJnCi~8b|Kjx(%Bx>{ZICiPjJgp%xD3At>!n(--38)M4RiiaK-rQt|Lg^Q zHHbawulimDJya^DuxU!A9-W}1D5NukCwM2E5za(Iyz`exnCkbT#I7?2d{OF@2#YZ9 zT5WsS7(uMhn~JbbB(P^Ob(B=UUKw;?Z&##zswQp2Dc{o8-Kx5Eoyu1E#3XKil=zJP ze_nuB_8sTk1pNZDmll_MZiMCg07(o83RzhsAW^k@XNL-y2larPG2;98wI&AOZ){@7 zQw#-I`|bzZ@{E0};geMAWn4mVZL`?_BSFiB3uI{)ojb2(n6%bkN22K7cDP7STAv9{ zox3ZNeWg@oNi3;#&-?XH)$_ojN2{0C@V>r@lea_N`mA5kwnX(*D7L~E$A5G!Loau zYPg=AX;NFy{-<#1@}_SvcBPRNoO*&un33-Bc-Ift1HQ8>9UCH>%}e&-~KnhpVFq?~vSZrEEy0YvS-h!r3Rg?RWAm`ngzVq|o5 zbaBtxs8;k-;ptd&S<6IJz_4$;%Nx!PbT0+Vp=7zr^V7OW{-3?T0GkI=HsMMHra?Xk zkkr4)Pk}JYb&wVgQZQa%HDDPY=i|pRia8gH7M2CrSrShps1Ogal-{NAxnR)pPBxt|6wN9-EsZ^u+8U2K+=~i54 z=4++;cgfK~{>AQlwvdsE2Ssj-d{YSQ*8dL>WC0ow3_xEhG?3&e4pLr$hFAdd)%J5Uxo zOFhD+|AUD5g=Gl;_o^iZ(eTirqDe+QrH-))9)tNN4Q^Jj_+dQLkVtj09wO!7-S^rn zjGt~pa+?i1)uOJ~`FD7&HGqnQ(hbK+l7pmv5P-ye1$a>)W)XmgUQ}sTyfR75;$n@z zqQqV|veGr+p+@sb8tbF%hi2h!eMgZdnsBKE@@iOorE0YaBb6nK3RtEu-(Q#QRjUxb zKJ9JGz{{^DRY=^YlgE1)8MF&EP5YZ+C@VIeGM>T3B zjXaNq*If-D7wKc*AoeXD9w-j5bmRC141L|VIF!55Is2VSU$)pYP zYKok~U(z!)20U#%2=%2y;ts1t#?Ym2>F`I*pE0!I#w!}!#T!1@+^}#iy75o3{@2&v zUsO@i&noj0pZ+pR*qbhC1mP3W8@LQxqu*dz92W?$?t0}3HG z!rOI8jTuOBKyV3RW)YKfRR@cYbAk+!rSTL{3xFHs`9b%G-7KSH<*liPox|Aoq7&4F zos2_h?2l4Of}4JzOeJsT__QP#IfU3R-wxJjd6N9gAo|65yMzMN14ydO2c8+Ruel?8 zZ}BBq1K%)gU7{GOO`k5Abeq&d>?<81L=-OEPH*Qw%shUQN ze4?kCMa?x6jXJBT>b6LRztP#*_Y=zwlBt+7ajF?idm&LZMJRoc<}pP>^3zX%NI?7I ztrw>=yVsavAONsA;qBX`D-2N|#;Z}c}FlU{TladO*zD;7LDv4+CEa*id^4u+! zo{MV4A}J5ag8%MsIbX@=#m@J1LEQXYj^BI`UC17#oO}=^a!qS!w9pNH)`0mHr+1-Y zXU+6ca9`)iVkXqDeFMSugBFMF$98g$S9lgZTJB@qOqKNPZk&g*Czsx@3hrSC0v*tp zZkgx{=ynHmM|U|`?4+mMlpfvpiRe7) z5Us_@QspZqRW>@h`sL>_<0S}FFRuTiib)!|O%!!I)V(unrVlNqZm27C)tsRyE<=#O z8flCjN8aG%wcd{@)W@8)pFm7L@<)F-`5{;JxI%} z$IGvt1h zU|QXU7hATxjq#u#Q=4NHzFz}Z z9sQBLU=vMtr{$hKL4lzOgK|i`I07}=&MKPVwH@~CRps!qBcm)<*L-KK9ghzj5;Ud& zy?dG=Jp29Ig^ngsg+RixT=6(5hENLsw?3BCDr2aAe^cn(>x|b(OAE8h*5`R+xb~9> zi275^uL=v%Bu8r*$#-hq{oI7I`Zz#-_kGnr}5mpWD;@|mwA4j`O+&yn|04O`7%eh5` z^X$~)zSWV9NpXT~a zH=UbQ1V=0J)3)atH2Pdc1}<^l9sT&tF8Msa%Tt1#FR8|$A{L1^*FZ&QC^bfw@QW^o z$)ipMCW9v>rEGV#RN}Nr>WIY)0-OR4^?Y-6f}be?M%vljYm?2EN#cFr`2%sU6Qd~H z4_UoO;|cDMHVO?a+349rN{b2B6`+nt8)xw(2|gBlTz_}@QQz}x2Sk~%Mngl_5MbeCWk`lA^`L3W z4mgWw-R$&`KRxb|M#(#jq*A{tIV5Ywe(rBE!*3XmgbbCe9Ft990R|U`zo~s(^=Dv` zAT6>KMAqMtj*LFy&e)GN5C7f38dUmDMyGjm(t}m1dR~|fgW+RFhlAIPo$qsSCB5p7 z;?5^S9uYV>xwS^#U98xqtB}gmB6H|aaiteuqeIl)*t?JTli9l93MTZQl{sM)SY16F z0==3d#HeOBb&VhdO(I6#C={sRkN_@?jrDi)S!gL)=o0vtw3nQ43Gs(TL4JfOva;no zWm0RZ$}wCs1uvdF|AGRuHgex$gjX4%ZD`h(u|~mk6n9~)6%qar?k#1ZEFeqScNz~S zAc|$|YC4w4u=a;mP3iz<1S(_t-C`OOf;54rXU604Pz8~r=YQmpd|$*l$`yv@ zi3gV+cV!d)Y6ow2?_!H_)H;OBXvQL@52H$0(zTF_dXM}I_Hhi$a!~5QLzLxa3Ba8# zVR)UAB|oyj{b*{ccK#dY=xIw3|7I78icZJ~`wH6jWVFQBk~vzab&Qq^Tq>>F@>{M7(7ORPAo%6_FWGcp%l-wH z2yk6c^iqffPLQ3_V)xQc17~b0=~|pN7?R~`3g&7Gu~^qyX3`2YZf1!Y0S%lMm}Zqy zs&BWS?bBXAyM~TkN(fS~VK7ZX^*Y0Femq>+UsQ&bigVv@o8oY%Zh+6ta4qExn5iG! z?VoRo()N9eXUy7Ge)x_O`j@6DZIONGN>``nv3;31O|#uG4P4=Vp=bT%!fMaZ#pT73 zYL{s;OEkHs3F@n7C1fB`(P_mtSZpZIKs;x+d)p7Q_v7sdAC?ps*mH54<4mtro0AA? z0yMDL`mx0a2GMR6!hMyLmd2?OaP-G#n;I{pDL#AV!WJByA7rK*&psb! z>r1>mLDGGkGSJ5nt1lC|)ZA4+29|b%DoZ$Lu$iwu4irLfnu<^GS$|>9$=0u#Z+g({*_l~r z8^QBgs(=1^ln|VZ(M0w0pdkk1v4(3^EEYBsW>*ayqoz7F`Zuclpm`7?2kPlxG%V}v z6rK8b7c=cty$vx<&_jRaV$V}|vl04^Gd9BBeeG51C$yc<>hfgurMZ2kw_}(3vro(S zJk3u@3a}-sIx|mas8i2HsNp=i`=UQ+=0uQL%B#<`F9Vd|z8X7iEf8kq%1(vhw2J-O z?57*4dk2OXNzCyt0vfnK!0%c;ga~_&7}R_j&mJ{+mYop#LG{N;w87CeW-#lMlePW? zMR$el^XuobpW3VUyuc0ty1$q28K7lRVZgtn_=3e|(D_lUo3V0%%q`vt9YS`~n0VMF z@*NQg)!pl+y272$KG{eziB)F|;K{Nz!(pn6N5*b~Uc_?3!$b;iNobyJE+TkD_-w)qrf@&wT-5DVgC5k93)(z2sB9!iqiOdXeNc6As2CPC`kSuV$RsKqErYg> zi%m~1FnT5MS&FOwWr;>4g~dCZaA!t-H+TPmka{>%0&&QJR$xsw>+4ALEKK4EBP{LuQ`tMw z|5nY-hDXzK8Ga-`tw zwFLvZl^x9a{>Coa`$D*-)4|W6R&~48Omuy?mYb;iJO)mrq&pGRH8S?u?fT702S*t7 zc)KvdX!mq-7o#YsEiJ;Q@yiLeP%!HsJHXQ~Ef9wo{&wLW_KUXzYBOG<$ga1W-+J7r zt4*}Q%!_5Mnlv;%1i8u`ottXQ3PdqpgjniBo61!`n(XiGf!J%n2zsf0rKdIxiSBU# z5Hva(RT(OxfFV5vvCa3Qgm2ff1V(X{3q0eI!oE%Z_v1y%5C`#N3ADm|!Q*JU{tP@L z`+=@n9#O_kCeo=nrE%0{)wQ_DbQj=aIL&}@S1a>WCn!xLdxtK8Nmd$SVWuJ;!Wdlq z9tW8hqx!R`cxMO|Ra2oiRLP{Kq+_B04tIY{iJ?gvDN#W=3gh++J-HTLJ(^}bQN5Bh z$hr}f2%bbE0b#hRYw)hh%F;djq%DxxHBpb@^Q5pM&m|7U$iz69BNEUm(1wtLwDnI!i!?SBj_}OaE zS>DTC#t_kxNf6V1+MPjh1!nCDL3npzk!d3^NGt9&>XxfN8Oq^#IIL*t3Uiru7=Had z0R66p*Y+fT)o@E21G;lQ#=uN2u^Qg}{=0SiT&K&^u$|7mH($w7S$hQb?)|H*|Ez|^ zF1-@Ij{a_A=-tH*n!9Ajc0B--iWl#|G#;AY7F*Bjg3V|(y|a^TRTSA>js(?RMp`Jh z6(;q%yAf9x*dQ1PgqesC`1&W?+znAA9t@;6dK`oz(ioXM8Ghg@6j~yOljI}EAd5CA zhK%eXzZHHZqEH-Joh1)KS$B_*xAPKpfVt}hm-==UMpY0tp60 zyRYL^tzr}m_wve@?;#!OCXu)Nl}{I1zDW%h;_IA(99q)(y`%h<-4u6{4<|lpUGyGw zO=Lpa9!XUhq!nK6$0^LMF+aX--oz6XGDVu~(`oH;xlg?p5>$TtE|v3g)*n;{n|chS zMBqY;ERh}dZuP4wR$<0Dl2ZKSV)AX=fBjG|`gZ9r40SLBuX>3gMC)^h!{d_@zjZV1 z&=ZWrH{I10Zx_kSGvF)cvCGBO*X-kfI|w`FI@`gdG+m&Iry6E3mSyb~#)iyxc2>_2 zZT0zmuTybi(rO>cs#6#Pnw0sZz=ZLPml;V>0@KRfVfV{S4LoFgRRwfLl1wGhOq9uD zeh2&t{(%C$?imdU!>=~H1u6wzqUbJPv`9>6hy|--P?Z!Rl2kUB`y8qE;j|`EP7#tU zo2}1fe6v_n8k(PmChEoCLQ9Um#RJAWuu_3kafkJu_d4#obtwUV%GWp z_%x|7qKt8;SZNb4%M$e}@}c)8z2D1Dz21u?tVC%Z)@r?8IX@-%(d%LoGLw4nWP!cm zMV^iOktN@tM})ipSCHW5=9dsC!h_pt!rpp2P}jG&8XDC%}E#wQC3=;EZIOzA3W`7*X$$HRU7;FqaIaee~$e4 zvci`U%?pyV7N-TA+!NA);)>lNG>Bb4&t<$ba5${jnK+U^hdR~?%X4Pln&4}{ff-IJGOKkx2afN&ypBB z!o^fx*62rsfEOs=P)MpQc|Cz^gA^~k-3@*KgFfh$k5a>BaTC9#_$O##QoxB}tWl`E zU`aLw+9=5yaw2wzr$l)Ndh0G>CFK2PaQ5)@p2h?X&is%}-*o^>FrkXMZl=kNRwS7m zqI^4*puK*QeJ7cU4KO7*xX&^PZJ)DN$o|BGFDL7%ViU^Ypw`oHR})eAV=;|ag8+je z0C0sbdN&9`9;hAx=vXt5DV#d0vIw7G4E>7=(y{0;059;n{Q|S}`dzhxz+@ja?`Eb_nm%sc5Wq=HBKYA8&6xuTRqA@~p7E zz&oSPkiqY9>i5gAkQ6}-${>!*2eAJ&-0N?cw!|Ev%;_P4Hb_!P#eXr9qS|Ywp1zt_ z;esx?15~FA!sJchB#Q5p_y&vRJYT*6^{JPFiBw8u;t^Zb^BV6DF?Wp|-^CVX>VhZx z3;V&l0K4Bln$}Ba<-Cgim2#pXz8aKKd5(IQxChtdX74Qj1U88T>k`xB z*`{c6wHoSfSKa6$f$;cib`;6N9(*MCAJX>VqaXZ-vU_D~Y=5+_<`-CV*Gb|0;InzCL)hXGWKk9zQK9j)ZiX&8OBa6mi;(qq=H96M;#~;bPD`C81BeJ`k7p ziwISDv>B_gV#(m|a>@}}9_*m8e?S=&E_TEq7%t<|9QZT`ni??`8B>%IYckvylvUySZE3U)|ay0=gcF0QFQy6`e`kf!SM^^eLt3H*rJac>X)ZI zg7L?8Q?MQvgCGMg_4d-T!UO!hR18TR3bcGX^s@*@QBI0|ZQ1I*-=ujT6x4}h-_1XJ z*930JA=`sz1*o`o=iu0z1ULaLmQmn*w>9ljK+3~Ba!?9`N$yp8$_i1oJfDay836T~5 zM8LrC-{&TDnM5EzKN9$uyqi5W(@n(UQC2q??Uspf#B^Q%AzO7MgwS}el#YW6%c9e1 zkiZSB837ya1a|^_Ui}oOURlVtE2fE+7v+d50(9r#U9#mWYp|`8?&V8Um6Mc^uIX^G z4ptSwO^{`awE@vwy@u02{n|viGlPt7e5#D3Nf&>+?wUzV zIF;kX47oT91la<^7EmV!nt5AsM!{s4HE2v`!o^Y13{IRkE1=ISQ@bmB6gMpPGpO*0 zm-Y0719EIR^41f0UgR*Ulz?M+zFH?DD}5n{kd1M~7^@HZ!WdebmGI!j@e=#x5tD&d z=X!HfE>43a^+uL+3X5XiN~Neh=75DwV-s}93o}OVDB0}MVHN(8z^Q}!LQWo;I?nzx88$qa4Cj;ieJzZ*!~*_FU@BQeLnLCMNod=O8Q%OR z!cmSUTYS^DqagcTog+c4rBfIo)GNYqn>vCMbnHoXzHh(hB8?-NPo+dAV8kuJxlp7KZmZQTy`$z9T%;eaCfOeniZ8^kq#~2N zWSd+i1?x%N*a1!S@ zAI}YLaC_KLppT+^kyrbZN0Cp`XUnWA(|FBZB@i6neH zJ@f^P$3jhn<8LQ{mUA{w!h7tQ?PKp6|-@evFXgex6CT|MHf?HmW#2T zcC}En7jLj7wmwap5|B+jfVmU94gW7nGplMS<-dPYXwz*4rGs;@RaP_7xa#q+Ql>NV zv{3|aDu*-lcyR@}ep7o4NcOfh(`kIDrpXG9PySlj#?LtrW;Cghbqkjrv^>FL&0lVHsmm0y_@gs-MkVBmn(8?U@oNA3N#{XW=e z<@&vtjHt)i!|HY9q_btpVf&Iq3?Yd37~`$3-~3+8BLv;(Jyj2IB(T%RT_?uWn8+JZCpaWZ&kUZkBv#{ zyd8qaG7ozNiI({94L=OA_-4ddV+rkS_>X&E=Tg zahuuUv(sVpq~r76EC?I~Z{%=DACmyhL8N4#=2N#5Z~fUyb9p$SVxy-~1g)5;`fZ>| z7jS3k415Uc)&~)>U_D{|WUc!pFeIK<6|8SCBl?4!ONv;5mjv04k0PumYL@xtveo#i zP)zj%AcPCHRhN1(#TuC!P<%CR$ewi8CSg^I=OXfD6#Z`w1hNRHs8@iycF&%LGYBY}ZWIO+OLbkI7UjJ;y(fB8Z?`n2UBo za1a&L)g?Y9zrZuo_V6v>%qt`HD-qon`2`aM zD+BJ5*S+)qm-5sA9t2cipyvaag5$r?uPfTTICpf>NafgD{d={rK|w(rz`|^3Xb38{ z=cf2C+wM_}ay?6S1kcy?n+;!S1EgS}{HQhy?Pqw`<+S=<1p5gk6v&yfuIO8f(MjAD zg>tp)F+=&4nOpaJ?%g%1txuxI$ww|bCifXfRbD*~Cur&U<~TvV8yp}rEi*8$crSO$ zju_=9;BIDQ5WZ}iLnKNyYQq4$1wIgF-U@5ANk0Ef;vpR)qe2ZZ4Z8vnUSdSWAzebq zJi?^WdPYV)!4C2Dh}>O*yqRJN#xTC$hCMei8y>$_* z{9Em=fI0{H(tn??rVu3(0?e9}C!-tYO%D?YC?o}!od^A`XdGn}jIx+lTmNaK+6&M( z%Fg9)2o<$FzGFuqDO8H|Pj}~z)nP|s-wu6j_Kx4%ZE&Yii`=-``A@F=cb)YM1Rf3! z&UHPMvaqD&ytQHIK6E#~#rmT(g*r4SI%4ovAvs?dHicBTSAzywBmqYjllg38X&Q$reRULB z27zjT1}B53o-XdXRoJ7sji{J`WiokVvN>l&9jdKZb9XZ+KS5zz4wnCLKLG108qID{ z6GQzUr)!NYIHRD7%?3xkIJaw6rFpcj&%EjOGknkZ+TCa~PzKI3u1G0j(x6YXseMv0 z#8z_&{>j)$Dm+vOG?vty!|+rBz5RQ|uNsZW9BK(m3q)4STFTQ`1M^|Dj*pjD4>!E> zx4wBS)_F-=Qem8V6zP2Oy4^|~H2KAS`A12Z6!lYbgblr+`b+_r@iS}olIBQ>H1I+^ zK0dzS>cF38c%DhDpK^fjulFVL%^?gjkro}6S3!szT77Ma^}+`yDDw<`a_?wTbgwSS5h?|V{5(>u6_ThgB}sv?$-~;f3ExO zx`N2mz#qZq920LOP{NAv*H zNPLuXD41-C9G`-LO09D-s3SQ~KTi467`AdQ-}x}UVn}V{RYgG=lK4;_m3+Vxzg~8% zWpq^yfAnaN5JM+3T(?-lz(Y>=%~eZ{)Q#Q`VDCT~4bls~fKvznXybrO4LJ4ev}bic z_{;=oe}!^H`WvhBiaJ|aMF3Rf>1M3l*@9(7mD9e;3pN{cd*I46luL0F_A?;@i$sDk zDk9tj>u7slCgkh>s#FYrjFyoEQ#;1(-LuhqWp%-ff9Oyon%v-UtH&AK{!N#2a32XXYgk+_y@XCIKqDMl>m=J#P&-X;%0-rR@XxWzMzj+D^oz%(N8()w=`| zHW-XWn#@y$Cj#cKpW53;Jf4>hHz4GYi%Pl+SS|jxyCg~?EcBP1PI&%w$=VvN| zsGr4#SKgz-E1fyTP3D?Y6}rt%Cvq5dQQ1GQ=&rRAx#R>>{wW+1nlZ9kG+tQ=-B;%0 z>r0!SPFwskf)AWXT9X&JUKw%Ogo?Xg;tlqFIAxrB^d^Lys8V|Nee8qI?}I>h=v&yA zcP;96zG!OqQSC+#hRo*IWqU@}eYc%&IDH_V;y?rrflq5Dvd->CmoF+r{i_=97O$eX80|-Yqv!35 zAF`^EnX?0a5bUf#5w4pFU`?>B$pWaP;*B%TNRx3;#9q_BkpsBbt%xQLF&Ase{B zUWaftBE%ACRceR;yS;s0ze(b_c#2z&5V@Z%o%6;a-%YSfQ)>Osm_SqH_w$kGs*phB zKl+*y78EAoF-|CZafz9%3W8W)(8?DECIBy z>AbildCe6^-tj1~{ajUJ2vgDUlUP;Li`!|6RZ}HL#VJ|+?L;R5br24*-l#<+hp3Ap zgm3Dnu5*<79e!Ex6aS+j(YX@eBf@@uRC`$e_x*R6#<&QrB#8YXrL?M9>K-cWqHUG* zTY5-gxr&`116`t7ze#6bt0mCtQ?Sewyts2xp;;2T4{-n2k#=^KZ} zJR0W{=`i#~IJHZMQLDQMtzWvTDN~}fuqDtl^NcwOZWDPgqPkdo z8j=<`Q72!+dfy!LuC5|CnKjqri3Gd&{1JgVL=`;ip`P9mhku?ue_Y||Yv$X__tqat zB#grhl?oPBP!7GtN7wRniEAdbB*su;J`+rvbs|y0ej~B|@PrDwelcR;*3lL==5eH! zx_-Oyr&jE}urkRc%Xi5B-;*r{IIub^O#yiFfZ_Oidb+pG>s}m!W;Is{yyIgX9pA?7 zX|Te*8E08!A6kStb4P#moU+K*o}c=>BS+71r-%iOI1bz z9@?bx>savri!vLc+Mo>?tV#aOeA`HF5@+1da=r02%sf0_WSwA9MMZ&Ku13sAo8pV& z=0!P)MuO_Q#Gq<{^iuJ;{L%QF4M!g)SrS79mM_x%K^iovf{40fXPqUFMq)@-!&_T? zydqQU93Sz~*A){9ZDSB(NOLUEvLt1wbQ)1?-u<))tGKjXJK@kKf~eoQlA)o!Hl13! zbmhVPF3@)$7C^&_#iKS3jx9lp%5VD}W~v!Z?URyB`7wLr=w%bhEIMITpZy@5nA)p%sqAQ zj~og7`6m3grEtehid`)$&c~VjPq1pIdxtv|`T}>G%#%8ptMUiQ)}OyFiPK>j+S;OY zGXbhz4-?|qZOhG3JOS!a&)Upo*O#~5Oi_@*3V9whL54(d*u1QafGRCsRp*7Wy$xW4 zIRNPV^yE#%a=^*w%I6ca?;yt8r=^Nm`)^tI`s?nuRScCw@kn;`i8j*BU~ltEAY;5DrtVVdq2V}qDmia?{42HDN8i`v z&~kb>Mc~zl42>;6Yn*fpooa@gzuMl$ZA&BP`)X^kNZgJ6OE3v9S`Sl(6h(pa%7W<2 z(>hEHDS8=#?WV5#&B=FfAKcQn#$(6$YpZ-t@O*4C$rr>5uRp0qMpoV1Fnn@UDE#^H zu7IKLX;9tXkRnV+@DoQD%)r3Bnu!F$tmTTh9^Pjty*?J-Qb#EJTaGJ9K5!SFUb!$# zw6KmnII(>j-Xb$RcwD57xW*o&kcse<5%GFAj1u2!9rve0nJSkq#tT-fKQEg(!tnjR z>!Q6>jPHkJ{nzRV@@%1N;p#yZM&_E((Uw|4u9J(gwMjQQPXVj$EI0GCo~3t`^~eVC ze;O~MK#W-OzcOG1zp&K~w}O45@XM8#Y5 zs*~+{dAo_2`e$IT{k)y_N-zzJ)@El#J&TJB+u$-c-<>Ys>SJPnM`^Ltll|Yt1iIlJ zedf*{ti4ZL0Q~Ok@>vjtI3gCq|DU zV#<(YJUxnthY7n^h8Q=yPUkTCJo{>qWuH&TJA1!3C8iP3=xL^ zD3OQgx=9k=ot)T=N8|PpAvu8?pu&DZJF9qS#s2jLhLZ)GFx`-G$snpO9 z(-r6Pf9q?X@YDCN>}-!dI|uPAlh4O)SFLFB8ykiQ4jD}NJFzl^O#MdP0?mSW!wyN_ zMQ6A*^{e+H^z+Ra1R%E_dAJQG?G0E(jG-&GRe!Y@$MHPIw6^!3!*L0z4tDNi8y;{~ zK;}~miaELMN)x1ri+`PTzFB-aAmE`?s`;xK2&?P2*b#I zifz-eO+wY;aIM_;q7|sNongLwz1p)6!PZBzG!QH(TS3>@PLomWYs-?A{N)P1xlVpS z_rcbW(Z>T0b( zW~1chF@DXS#$DGb-NjmS7QPBJmSa_%CCp3uY_5h;V6FgL^h$r#wQO`QztSu}H)n5Q z{cAl^>c1^aM{fCW>!vq3G!CCTKw)ag1%Qfw7GM${o{ZTjpy|eXQWNmBHlJZt-H_%L8D= z?5&zh*jVh9UdW&=4-B|DC^zmQAq*hhqDhf9$?XXAUZ&CX}@%M}N9SUt_pi7WU* zS1rRRtF0WkK-zbZCMLTOE(Y{5+Y3c(iBTf$6lOkyw(vssk?VW_QWo5?uGi9DPYr&vz>{>g?z48whxq36g1Jmyq6zpO`j^Lg7XJA2j6#jIz zqW+hw0}nXI2^OCo=%Vq`)um{Korv#Q@c!GRUNx9SZCwzLKiW?m3aj*0aB_23TT~>^ z4h}&0rclEyBX%Q5J;_G-&u>iyW-77Rs^5_^3Mu9!(*7e8eO3`oBk?|3wcubzFA0zG z=0JFB_NY8pR6aRo!1`Y9t7L0VvscOY?F)TRJ`E%L&zG#zzsO2&4A32pE66dFp7fca+z!4nEtJ(%PK@`WXAuf?~f+;X2;VfZA*@A;&F|mvqAK{8lJAZZBN5oAUPwJ z`h$0StdY$tdSb(WfstjU@@D`v;&A++ZEByLVC0)}vpTH<$7p;TXhUy$btY*wl~qjL zgFKe&b}gpOx`HXDVgyeet|u)tjp=jC$WYh7?I*lST4X?}V{q+4-H7oifiFqfDLE@# zy|2ms4H=DQyAxbL9E(j1K0D_#*p?tHqg2E^;Zyy!gCh4vy`d=5knx&nCbi&NIpsn= zn*7JieZt@BpgRa9ln4KSpUmNXIiYCv4jJKll|A(fp z46ADE+V%*DD4}#CjdXWNN_T9!L8QC8q>=8 zV~l&;5#yy(ITzjA>+L;tlz<*d|5js4>NULfgZ)NIYY(HQ3jt~c9j*IK12418qb$P* zu~zG;zESzC-|6C^{lP3*w}E{+JZXOelkeTm6((x-W_A8O24fR0icezw^ZAPHZLUoC zphtbsF(dJT>=4?6MeF#lVtaU!q9?i5iAe5uYk5GprZ7qWc4j=jsw5iL{3*^3Xd9gM ztqTFa)NIh;ph5m#&}5}%h*Cpic)hZ4l`m<;&OA%8P+nX#R;0g|rctcS37RhIiX?Z$;(|P;a0{ECWx1Lb;cX~2!*-szW74Jb9wNo7~+ z&5X!eP4>7^0ofHyVN6XaV+5{nfn3CVg4jgU?CIflu3iqrEY;HY_xCGe_E9st{aHR+ zIr_O#Ux~A%ysDf|<)WfiH3L6zJ`sm%alJ>ESsO}olcWR|yQKvjvgTMbQ z$t1|F6cG84$Et_FE9+pDDE@mq5*O@ItO?H3KgUcI@6?(u{=JqAh~HUYbQJ=AD-(cj zxvIN;bgUzyY?|N~Y2A}?|JBal_38A@yi(v52S*-mdaZ-9(5auB38!nYTO*Q+tcO^ zUn&I~$wLlO+|&2x4WZgSKzS_bGn$k4QBu$pI4-{X>6owj2eBlbfLssfuj$d-0??-h@)tOo71h^9F_@Wwx1iwwN#PftSbG|Iloc%?*oL)?N9b_`z&M{b;DLSgB zCsm-H13%s-Agk*c#8XygFB=+t$&sB>q|iTY{g@-|NO=w%>DqAZq38rpJZTN51T3!vFRdp=@G;$QFs^AkIR6v@KzB7F>q za?20GSvc0)fWF1mwxIIiQ4pB+Z1qMb`RX3}SmTx&y9Ij@>+vCWadZB1I|7z*YZkmBr zLX&%ay&QYt$fPZ-!ioO6ewU_$?;eaq_?wqP0x}aw!kFB3p05`j8n2tMyAydmpF2hf z-E-4F``VJeC6TP&h#0eaWGZ&MjZt8>wGIHqK8+az=c7kUBh~vv&vxbrB47KgidA0G zk>A|KE~vS$Fx7o5uqDyWuaUniq&k&XiBDr4=D|U4R{o4dCE-#jL zzI6^Yj=s*om;te4R?1l>WyTW<-#hl6Q*0}c$-gAlyF$fY{~HAX@+&ZR$>ei&czST3 zsn8w(fiA#81N05ZJwUVwkls?&Hv{%w|DI%JQ77zYG5k+)jY?I+#mKt0$I}0sYp^9r zE1H~~1QGEWe-*<|DvlI1|9J!q#{kKzWpKPGM8iOPMIi2 z`a4h@R9Y2uW#6b@7G4GRLNu}A}QGEvG-6YEXlw!>Y3eETzyZT z%+Awcn*!Ztjv%ST2;^1ykz+L?JSnzFD`55O2eZV7a_|!J-7OHN>w>eyKS0+T8LjD{ z7FvV@oI(G(zqn?(>H5u&l)aeDzDlYkuI=1hk%{YFwCxxxlu3p~kiNyHH}LXW(s;PW z%(q&kdiOd9x=-Ej>Z8|ViRBg-`#}*m>(q!H-xLHJMn*?FJlxm=0|)Rwfn^ytRIs|k zIO}s#?>Y9kY*Q*KZl)!|RQcKCJH??z^`nl)oLft!7>ju#L>=9~Bs|CfvYs&d2F?i2 z0@F%F39FQXSy>*z*;)g6kP4-D*l%IB*~ey&!!(by^56rhLK?(Vgd>hjw?)L2TJ|Zj ze9Kso=<|ik_d?)Cn!q5_cX~jIu;_v?g_5i&3#Zu}K62blS)akEGFoD#lKlU<0I3jh zM23PltrhDx0v5vy$kG-k$pl=%)9#7Yf~${QINbL$?}VPSliydpRUU=Rwn}7uiZJEI zWDU66=Q)&?mHj*I7irmoS?99%P-UMfz34!cY_!nrOp2=#+$N)kTxX*B0*iv8LpKi* zE3y?_n@If}s=EDy+Je>)<{6VWh0`$p5gn^p*IA~mnr>DOz5)+blS$BCb6)jHd^%T0 z0wqh06V-w1&1wW|h#^n&r&(ucSs5NK?%EjFstG_X5lOsa!Pu0AmsgrKmEzs&8}45Y zxws&O#5J-~8*2+r_}IfTZTny^L`38-fBaB2Ag4DsH@lq;QKt&|3c|s`39|OItZC1-2eOMHlpT)E$ZhTDQs)`lV8vL3N%K`V%U>>Tna>T z>V20kBhgbrzKd<`5a~U))`_JW9ny@=%yhE5R29=#!4kbe5vS8Q2&&E-d>gt#NU_eR z@K}fCmbw$aIqG_MD)&{|WeUaqamP<+Ok;lfl_ac#WAiS@(FANVCwDi2Da(tr{J92-C(#;DWS z32;Kq78eH4dkYE*mU_Ry=ov2adD3z7O3dzxYFF8sTC$XNvAxUMd+=^v%pAWOUU)Ob zTXfL&(t%0tL)=jAO7)bWxv#&SeV!;5v+k}Hw76w=aE11dh4wA0PPqo`k;FJanVZ^{ z7cQQTE+!})kooTvSOM!E*k+rwkX$xao!*^=x!hi?)ki5nciLr>A6|M_b>}mCmzZ!J<+VI{frGz?cUKFgQSI7it|h?PtkD5 zIiic#dxi0Ga`qoob;#!`uFacgQ+}8HwY)3`2n~QUVeTh)xtex&F1y6t8oKbuQeB?+ z1#n9MjdATf{r?GEL0m$$=?FHsbHR#v3hxHyC-tA$q+F=XHdMZyQ5^hy+ijTZ94lX3 zW4$=bL4=EIFk7ih6W&c8!!H8PNiZVx5)=x=zrpO$exE>~qOPX)K1#xUC)3pp{0I5* z`J{vy-j`?lYu93u7M6u_m+|ARnGw}LzmwgJ%7Z&mY`H1Ww~Nm@GwL??f{6w2 z3gv$|=>hIJ9mhMR56SsxW*b-is?wF8C1Gc{|0h3?#0!3sJIKWZ?!E1n)ljHl^h|B} z;$h^AFX0#8pX8D+I6f|YdXEW@HUe^HzhWh zYJvqyAq8eJNe0Y=AUT%@sQihDh^&?x-%G{e5)=13>jJ8SepeEjmDx#EgOKdh#p!T} zA&3KHMh>*%lp*_`Q(GI?6N**`R*janwmTpfR9mO}`~L^_g{DVCg>H@{v-*!l?pMyB zeBjt?zG98bBOPHSA41O0$HV4=51KiUBVLH(n>@TOPc2mDxL3kB{K;I(#)3h@F??UB zq8UL7@L8TUQ|@H1iFu=(0c8rX5B>gXTm5!fA*{^ z@!I#8gX>QF_PMG74Nc}ic!PfAjKmIf?~Rosx~|LOH4vC6;s2QG78az5(tvz}pm#fy zc{i=ZZ2gsvcCOKi6WXb(5RTq85{l&#)9-%V8yu%y;dMzcEQ0b{;5Rwb1@rI3bEXtE zr*E@}0Fl)So7qnZwzO=N=S9_o*excpX|kJvH;pZJ`(wdb7iJ9t|FRVrjKSPffXR8a z%aIoF?gz+0J1W!=_vwBl{y_Gml;4EEwfwW*Nd`8c)c{*2pmD+!H=Ks5r4$XpjJE-0 z$a1Ef6tuURNxv@JDiAgErjulitGdymxfMroUbo*0V3NnQUh$|3yjWVo7gd6{zPQLD zz4#`w7*0z#(nrr5RL1@tBBQF?a8ak4m!0UVH0>wLVqSOMl3el?wPt@ut2(@1!QJU} zg^qJWi6vOVdj5F0duOR7VK^l*$R3Ac>iQv0rQt&+f-J9 z6?1jGIen($>B(P&9`g=o8uV#bn=WmWdScDpc zq0kY*;^o1&#aav{ilg(ufpIu5bpP9*U6aso+@vUCB^haHj33HnG^1}5{ivs?*B7Es zN^7Yb?<(omc|{fz(Y>cflP48)h5x%ev|RdKH5L$T@eRHz$;psX<3gCe2g?IKJ3);T zqk(@oJ_oEq^NGkRkWcBvI|jbpE^zc7ilYQ{ua_gWxFjUk4Qk`qY5UZdb+p|_!G^ei ztVByk2Y4tZb@M~<55IfH2v|LOBhS>k{`~dK7dsFb9o8Vuy|UF9}K(XcgzN45kW*V*bXi`xiddTpRvLEce+e4a4?oGX>SVSh@AK*xW)B zyVy`T1I!v!c<5et_PI)Y(bgS1Y@w4v!QAx{8v3FE3>bd7*kU<5<`34c^<^)yNH!|x zH}j0nH-rvG;;}Q8=2)91{*q-T!qgR+G4Y5l-sR<#2NTkY>C~3yG>GmC&G@01)C^DW zpc-F*wYS(c8&?~a>jrPHjXDqM`CaoUj*x3BN<85F& zEe%OVE>@Rbc@_|2>|ve*Gd0lRGHBQTnwgQ{OsCA0zpu)aKFA0g0uEk@iHX4QsRj`K z%qFtNfY_&`q~rr}%w}_?kX5)uemw0&>7V(S`<%2pLA1+t0Z3>_2&C2oDOd3u08FER zanva%wWg-T@0Wk0Tl-FgywZ1zn0}qebOaaBM7G}X54qN>v~BS~i9JzY%+}k~b`6mZ zbq5|CYWJ9ggwG}Ac+^*xZ)7pCuWM~^1maB5d$;;;DR3EXGw9uJst~%@B)eN$rq)5j zC7u09o^45(!88u-(SvV}S&$|JAx^-3=2@C4#qcy$o{3MD@dvM3T^QkTGxT!vHnUnF!kX%nWD^cY5muuO5#m0rJxM zsGk~ztqxeN7_W!^#!=lrU9m;^43%N3ZgHq)VIAaUxOpJH% zD+pR_q@aR%jPf$NSx;5{`|@8jX7uQeWMCLHo-f5KBwM@N#S1tu08ItHtn2uh|Ip%0 zKFj8Xy@+1NfK!0Z+CN zL)qUxkDAtqved2r4;-LBJ)5^~>9f4V29w6yS z@2D;CP$P(;=2NpfM%(l{K~H7BuAE|Hzfr!F3=c|ekRcn&*$-DpIiVF%h`|;c5l)ge z^Nfp7dq=j~c=8Xeg{RF^ad)(t82}6}@?yKe&19ONF?a!45|eN;KIsz*4Zwm(tyx!8 za_sF11@aUnwJ9U82s9H1qtY8Wb$Bugo>jFP)1(dl(tq6+ld(bM09+TOo;RHJXz^^q(k&t-v@(QKz_68i75zY*-^%YtTiu4KY`EUf-#ZmUPN~Oex*5@ z4=+HQj7hRqRk{Gf*U9SpH%d*BX_FP-rsTlYW0S5TcmQ65f(u5!7+Pta%MXg7vLhP4 z(p-2i!mK?B4=<-|Vlv&w*gTl__pJt8`OOAB@62qhT$&{ME~#4ME1H{^3v8$JuhC}m zp|pTKpwr|Koc-{Z`UPyOfE>!H#l;Bg#UK$9r|V5pgqCOlG|H+eVwa`Y*2wV#-Ps(!tuOs}f+YydirDJOwOiy_N2Pp)ruO70g@ac(DFh_Ga&FJA^j&D<+%vmoqi8r96?_1^g> z>{@L;yK{56pj-uGmZ?8~dO^oK*W${gtE&rBM~$X)p{c0>)%F!7<;e7}VT`TMa?M-b z%MPzoH@TmB{xC-_%1Oim`Y`uYx`>AOfQsJDhspz1c4hct#Vf5{5;{e8X=ZqTN z);XN#^A99xYXn0XqODzpJGTSAWXaJe7%8Z2Kn48qec1fq!k4aEZ|Uye1+g_^FOv=W zaLgtz4a1Y4PTCfLu$&ohmF)i;NXN`7~=MVqQAP4djL zITNS=&0&bEsK*DV82p1AgElO_L#l>jlP}&ef15IoYd>$)hGuvmU^9_NcyNSPeTvtLVNFlDEq>=1E78^IV z^M}qp87q{2b)z?O%%3HCq97jXmgOQxmc{ye3dUCIs(!Ekv9rVB zG%Vw%Z}d^^*-jc#kgB}ZvH6-6zM2O3V85DMhp*$(KwrE?cyp$gg@_YJ5tf#Q z4_+sTj3S1`SOCjW*e(Rz{m#x80K8BR-omEt9H`9mN$TE>l-{`BFU0SMO_ z&E$gt|FxjK06-ONykAmUdMdo*prO?OPH;UUQOkAfs(@ zG-Zg>*H03RO%wZ+$#WOq{4L*(Sc)fCqu_`qPX@5gzYp}1Zfuo+!b!&EpicB2p&h?c zQA^Ze+}UJm%Q653FXkI16_uW$cxo61=eRSzwH`{+&n~BLO_x1!Kf@+8(#@DnG5qnz z)-#jsx?2#Op8@kX`Vp9eRKto#1bBx4SApf*1AeZc*LdJkum~v#l0JqU@Tj>7oW-1{ z-VV4dE`KeInK5&|ef>rY{R?H;cBvs&aNkdS%mlSXy9XjkD6WxaNR;;Qb6k+^{o%Z^ zC1twJVushJaN68mGCu7h6%l&LcA^OUcWN!BjZcCC0~#aMGNRSL>)Da!9ix9rj~5m; zAmQjDXudysv*=(}U6bwL#!OPxe43Q{LQYN&-0Lv$RhED!1duKO*&<(&CU(f=;p$Tj z+&wNc96iNDuI*VvO${VR!SeC|mH+}e0I=TE?0oP|A|H@CfUTMr&yZ2g zuI-d1;_{pC7kKxnsVQLuL5KsVhepb!2@@dCE@G-!!SP~O37>!fR)7JhQ5fJjDtf4UgY;gHp|NRA*YymJhl}qPj@w~DE7N}s) z;=TeZjlmbkbuD<8F1#%NQ!Q0uZ1tcW_jAap7?7v|JH~pL5b0mrwH~MSLXh=h!PK7A zoF>q9V0ilD)pk*bo$de3XjKyYMDJU1@Fo<-ss}bHy<=v!``{9*8`10fl9np6S4_U>u{iYpAn0ynyG<-A3%c~!60p6VF7Ta>hzDW z-yrzjuY5R+=f^aUJCq&mW$!NgVqAk;Z(V1*Dmb1kGyzON0kIzi00ryohJZtX$h4*G zdF!=8{lRTFAoa#g3Dxy{L+ho$*7TPeh}abS^Z99Yt@(JydPTzuNFY1wghQ(a319%o zYG}Zj#hMY?k_?Q&s65E?+9X)L*`^je2M;+Rm9W~WXKJ#@85I>J8P^L$2Ryz{{0FmD z=D?a5pld4h*Z^k(Q-8o&r@ZEGE-$huf%0y$-y<3GiuRP2z*V7NdXy!Z0;C8i!GKQ@ zxcUJ|33J&8NEknHab=}V+-^j}M5znsmOZ&;`XcJOvPtE^5ywX_od59dv5h}bHvOrq zIo8>Y&l{rj4$L0!7M(O%LifHsN7qAVNTyW93>FcNHF44%uqOm{6A-zzd0sn!FQHzc z)dz5JP^tk<6>v}oi*91)vEHxPn^p>a@=L=1a#O#gT}|5Le2^fyk}H~kQ=bNDWwb+ z7`>$e^SpJJ|4A9PC=w}4_No>+GRf51kybOfqKnC>Q~t;aFy);KAvaL2<@YacQwt7y zD~)u0Cl&NVSEKPC^uPI820NlI**cW2ckyaczk+?GrR3G&O>fRc0%)qZTL}hR!dgvz z0ML(%%nDFVSlrpc!DjpYKVtxr19m2mpG};cCY5kOf0(UlXX_=zOI8*(Zh5bS=e>&= z08dkAK5=%nXd5qG*!cW(ui57DQ-9I}PF7)|8bbf_2C{et|4(gn#dV|Jd0h=pf{lt? zJky;4i9MBoN?tQ0_w=PeKDp{=OiayoLj-!e!dQHoyf5e;lJ5iPDg6__j}z7+pWfvd z$Yl;yZ~J~B*D1Vnn^C}zLk_mb7yxX=Q)|;ABFapB0g8NJ=f)E6^}Ewq`0YnPN7Rxe zWmEq93#~D9>~3k=~F;vMt$C6VR)@ zILr{ueFxMNFh~QG;^0Wy-Q7JYd_zY|YezUR>)%F<;MmW(T}&{m)$N&GS9t&yf|IT} zNC5dWJq<(0z_ll8Ys&;<*5~ED)J*ag8UCpy#C2z7s~zX8TTPVQJj_hDXjycb)phz3 z@wb%KfOu0#%TaH?Fv>8X@VY%N?xZ-{VwL&k;tjmyD1bE}+<;X~@a#d#jox+FycKR#gBFHkT4V&B>zAvYKi(JMw-p;_PiwspohYgn(vg= zR-yHYYF1B|E|UeT0^iii4d*wbxUZt3@N7+Kph19e-DdetfCBceAg@S{4A1b8t2{2@ z>nWuGIGzuM>i1m%r~y16cv?W*h3QCCX}65&+SG;F@!QrvSyDCm+}Y><-RbIR&1$MV z0Ba|1h@#GHY@F1dR@$C7taZZKH9Y4*+dhoW# zK9#CljaMR!mTpMIRb8oXf;fL4s{0Y+cVP71&7mD!4Y7zKTLbeX;f-mv6u+#|HU}L_&dtu% zQ^*WLbB=hU`NBx4hBkBvwJ%6b#nUeEH9@GcA-jcw2MPQpQ~^U>dIWukS70OT9A}Zy zym9Dj7`6r9VByi65CXRLtwHaU-%Hv?D&N=QgN zxQI6WiW%5VU*KzZ6!xU-EBmA>{B}5KgBJ%a`efUePv(9BpYz#+ZxCH#hDy0Ge`W-e zRRno)B9B1{<9s}r7!a8C&8fm{|U(}3#e#K^< ztYbr2UV8V_FK^`U0Lse4xg+53^Pi7V{-`MFw@0X$`I#GwCI5C4PUMRSIHjtk87+Y3 z#{<&ENqsj7N~uZH$c$j)x7P4#h~(z?E*n5>^a@L71Z%v76ru2f!A=*a?!%IsvmEx$ zQ7~LBS$?S6Xsf?95-IV(`-CqMZ)@wE-o%^0_o5ga%hGr5S~&S9lK?s^*HuXhLC$c zWXfa23|M^qy0KTBUDVv129&tW?Cia;Zrsz84|tpae_w*D`8K^1qUSL?A~0|_{y{eY zn)zH8`JhlAV`AlxJW%0OpiRN$PTp>>`hi|C!+oaAw3kbEbUkgiT|o*QqD!pa)Sk(V z0r~^bpL$4=3fVaPE!4Y{FN)VyP8VbnPt% z68ctTiy*3;xBh=Fz(RquDaT0mS247=oJt;ZYk$W7yHhA+dCNInVVEQ|FDYks9RihFwQ6H-#{Lk^AX2FotU`_BCy&NvWjA1WHfQk)c z@&020LmIY*-2_{d7!)prhd>}NmVk}t&H+teK!qk;cCk%u>1W}80(on5jG_96AUy^U zod_SL(Bx!jA&*nmv3*@C2 zS+Z<9D_@O%{`cl%JQpCnn_nSMHs^&8hrCEejXLd``HyhKaGlD(uq>6R$lZcaEqRC% zrT$re2bVWH_cBXb2l00xg4wFB)Q9pUh7nVpp{Z*vE zipByeWbHNRz^|}NtdQTA&cLJ(V9ek|ET=rU0E7khhR?4xqA4u2HO0#%sM)>(5JL%2 z5ex1jR3}hDMvB+TS0T~lS|B5qE07>(Gdk(d&M4fu;RaN>UjcdM;F2BH)Q!p;YQ65U zk#Fbm)2uGFLROx}1cdNN<*)Nggx18o*>RjdBM5Ps42UL#E-o5fJNSk-pKVB81s43uKkZD~KW(K`D`MuRQ6^@5CBz9Z zOszD=<3)?9*;;j~ezJ6wM8O8{^U3#Wg@3T}od5VC^YY*IRe)a2`xiB_Yp()6kiH{( zEltJ{633v8AA_Du^*ugppfpmaG}3%HI=&`jPM%+B-c;cu)V>KlhRqb149CaOSi*^a zfB9eRhmW!FNPh4&`IDZjmxt#At}Bim?O#5{GAObf+2y^vg3s0zG1{u?D}~!dhO}k;Ve10fkTE&e>!~cX*SsvD*Rl=+`NpcD4&|+F z{b`=BaOWXKiglXx^}QOt$0*|+?VWRXZ|W`mEvmP(d|V!LTtA)3MJ{Xgv7_|cl%D-1X&u+TH=Dbg z+#-B9*c{EYK0kl{=c2y6jEIC>=@W7M+$Ux8*!i07Uy0!ka`y+L^B(f0t3jFy9+D2C z4r6;w0c<)o9dH=KXy3x?Y^-zvafgGLbwt>qBJ|*Y0PgwRm(w*bnY?c4Z6?hwX9Qnq zU|Ed6>NT8|=0KLr`y1ZZApUS)RPh*TU9OmYWp|Ek+@RicVixEkP{5gHZX%j`S1@6@ znwF!2#&f^$vflWYMGysrn6PZSk>gYwoS*+JvSxjeq;+{`NTw*}SJW}Q?Dj2$;Sq-$ z2CRr^ax4|Sx{7S@Oj>pSxs02PwZS2m)7U)?z8u>#&G2;oZ-j;C?hv!e$MfZY+Isv< z!NNqA6cDL=>a)PVZ_Jro&gVs^#t`%+mhJRzxshd>Tn3HI$_HJHM^XDWA{5a2yfsxu_aE z*Lc3;u$ukr{d{O<#6`Nl{WHG>%_!((+AMGB7i9_9(g;1y`0t<3C_*fh@$F91NJCPa ztHOBQ7nOJ$zmo)h+$k`s%Uy-AKQvdsM|6`EEgTK zF6hv(7MUabOPun}{y?+#m6u z4U&&eOgR2q;sIPEJ3?ym)QCh{Jd3uQwdGE{Ckp}(f)9`-4Y_}o@8IEuWB26Yg*y)q z>5D8tSopYcj6gpahPwgF1=#zCRh6zw_K1K7A*-N(0q_5{@>V|MS0dv-Ujp(EVHgkU zgVsW9{eMq6Cm!~+RVB`>o^PaE&76iBZP4quU!?>{#nF6VC7MnnKu){}!;l@xnflf& zhkf~;x>sp5%@YxKRcC8-9U<$H$@ZKpo2Pri+k?$Go%SZG(sUP_VP=J^^FTp&ZH{ef z>HaiP*WV6~eoFC$g$o^F9L?j;;-R2)t|q%5T~p5!+U4_{o%Q-UQmbxRQ&pqqH^urY zIi=oIlh@zdu_KB-!(L%a6^IQoXgH5JpFtDd%}EPd=@r`dW5t-;o4O|+ugu64oCB(L zoQVyohoBpAZehkZEU3EQhnOSF4Grt&;hPH+5YdQXb}dUD2Nj1)P4U6O2xjKyLt74R zS*}W{1?{%CL^hZNI#r@ouMYsFFYn8kG>1mZGF9>jNHLzPF-GKCcEZrV9oD${o!s8r zrdB^&IslylWji3o4p|h3m*t=A}#?zzH+G@!0=!xG@Q08qX6X$IKBr+4pp6@8y72YWDM75%AI zs7k9VAT#rVaB=OgPW+>7#sFuF&hNqy(==H|r*GZw7Kb10$OjbH*0{*Ygs8rhiTE#f zG)D&yp(;Eq_TVNtsBJR$+d>WM8wd5+RBak_U6RC*eCWE5dwcD>Gkt9{;+ZB+VHepc zoT!*^cehxma(19~dW7FcsSorTtIrd*QytJxrAz~1fpz6Awtia;)7XykO7`nI zL)+fZUIMGP@%dhxLd5HZ=_7w6beK`h{_orWq-u$)avtCwBX34f)KrRU`b> z#5sldMQSEYokW8dB(vnndtDgRSEfI=o0vz@NFl2)>E-jUp?`iCx~~;!4OJo-+Wbkj zL9>1JxgQsz_jl>QS$1SC>)DXf)%y#*KvIfP$B3NveT_~;Q=N5y%jhtl< zzt^*ye~mWu7{WirtlCkmUe*T_x}p;C!lr#N6wZP(U8m8Gbc!~%p8Pize)F=DZDe*< zZfFJt5*2Y|Nx4)5a@h5K`ve%waIJc=9l50A=(+g=LYKa2sVJP4%7(g-$>K#eg|M3B zWA*ofAa4z+lReCje8omkVHr*9q_VX4AwI}8(0W$6#0#>Dpl;PMtW6rKGYr|qoIl4# zDQgX);ogi<7TM3&zV7~A)0ALYbD4J1@0c$_^sH!jo-AC2b_L~Ne@(EywNm~VckFeE6B$er()5h>2ydG(IljO zJImbVLZ2t;e90kKO>`NOurbVXN0j(F9-((gJ0&`=9Ixa!GC)l2_kS+(0wqF>-?Ius zWRVqvUjah+4=n~*Cf?{MGDtcz2NS5&7IRJPtQ}KbY3HUMFTrd|Nt+i(3KPFP!-u?a z?y}eiG1UVgjh7yo%B8(fwX!el_%K8t;4e>i$B_mLP&O-Dls4!pmvXX(n#>SqQ7LUH zwi+%T)QUX}gMQIq{|I|$6=GoG9lQXEzDt;J^tF$}U>ZHk_4TIXvQ}$;jnii)N4~j9 zW$$46J6!7eo{j7i6y=wrdEK1q0q~Y@+w}EC>gN=;vs{!Hmf*>oabMCN+Gj4%ervV)F~FYTLyqpdlMbCQL^sicr$u4=-2aHp7F0fhe1x(eGm*!6iN0lz|gJc73MVA=^YBsQ+uu*l-kMx038_jilaVI&ti<`0#BsKt@ej zSGrr?NdyrQF*QAXvt{+srs#dM!_wDZX|_Z<_#gS(pV9+XTNTZU`)F1MnuaD%6uk(fd4aTNT?WG^w`YxO(+{ zctiPdSTCY`(4`^JofIqAX+CnDS#qTxG{pu+QpGQk`;1QV%ChjDEr{CC%KWm%KPQsB zm!DZ208FF*dCEE5U07uK+*#<%!c@s%;)MbK-;oO+oOxIs2vCU+L<4l^5R5_(3xNx@(%mDzgrH{R@o3KD-7WEn&oT#p8ehhJ5@V z*&lps&A1WgW%_oitr{7*B!V>$Stmf*CfE9Q`6i|E>RXd0c?9*%2cv56#^ZGLc7|CsrYbDh&*h!*Q!HLq z>?b2;#o9e4Eok2PXKq%D3ZsINkc2_K1IIz>5ufME1S;nz{FJ`^J8Hv#EgIp|Ul9os zU3^IONKox+V|15|NOYH`+yUu62dpv`dIfjguY;?=j16E!1AsKa=W^KTth>FvU0a!} zY_QhM*nVtI#?qPB_%F)d_KLjN3f@5sMSF zwSdM8vo(NyX~4G}1Jrmhq5@HkaTG)0NI^;;vP1jAwZP8pZ`9h{cP>NdrZFt38WbQ1 zX$lYw&q%kfdrrKyX;`4cwHYennO;X!$l5u=*?zr1ilhi_TDlu#PIo~u-boN!`^i4~ z1O4lLThKB`l6_HsVe1iagcUwnez+OB9 z>eIBQ`s(t;iB^0LMhAH=T#usqVH4MW>qW07Xq@pL>D~n8mA3b?&=0SLSI54pCRk|d2bmM&DDx%uV1EIY6kg5_zfb7b$_GW{}E z9Yq&um zj8fj{Kz?_ty|8rLPIPZSP0e?!h;=^3D`*|1j5gee;(Z%WY@cAj7anbv5^J)Ppi|zS z_`*!<{bw!R`VuX=W%_@_#_EYl?Nvt5eGVS05f=NmNgmm%({y`pk`5AZBro|H;NpLz z+bmp<*3vI!$TaCtoxrtsT;KCIT=Up0dJzB#b^o<@QE@Tg9KT4-DqeZg{G?^n+8Nb5 z%farWy1!ItLVbDdnO!w<)Z%*Iab$jJ?>vw2@p4bPZB1rvD2`x(2crY)^hk)Oe{>I3 z=z4Dql=s;b|4lK!en>ffzFjOd#b*v} zzE|vfm)R<{TZoUe*Yt5sc@a`{C$K9U5D?Y89UgW83S? zS)N|{>4=?VT)_M8RdgG~v#VNl{l&qtmPGF$aB*F-_^s{jGvaxNmOgll6#*YIiusHQ#jZ^RL4NCw#j{e|Eg1uU{g7*^{knAf3g8r6zj(h|9Cm9yX+A4@lXc$00j zagpn;=dnSU?t-@Ymmc+@AwB`o(P}|JmXHd<6NrIm&T|>)UhnlqC#)MHy}sYqk-9co z_BJJ{3siq|H*3u53srO)wJC!08^30$Q~0Ke6o1ZN{9>j%-tDPIW+W_gyjjG7)LHv& zXH3)_D;TG|YT)PYO|yoZH>w2%KR_;MqH7$f*oqfgua1z+Gmun+3dYHjXcut+V8 z>-ZDlw%*K|m*}6|kUVedMy_fV@@$&Vlv)rpip$vh{6`1E2K8@#<3)S>hKo!ao+C;? ze6*tmBUtDIZ^JlkLF&!uDV04TTYFP~5n|}aKZF}J>z4vJkdzCEv$@bfcDCW2SiG9{ zUE{%V6pLr`m`qG|Aq?4t?7BfA@mE;VMjH>)2MDg516P6^|75 zVwlu_WjO217s0t(3KWR}yl@hoSIvj&mRiHSUVBv&ztb+~Z)0qf=N-pHkRMaLCW}~(9KD{A zxsG)tOjAc(pZ?@5gd1KPtrtsakI| z%q7twiNo+&e65|cPdxa;V;ygm7iy;N5Q>uJbB9?`g}nDiw27dDvwN zDewH6onZS>Ik>jZDivG3QIFrlm0V*Lm>O^0e);)xs?ZKgBXn@7iBnI&WEy)qN?qFh zC_~DVajoguBX0fD^xy67n+J6v|QmQsf=(cH6Z43E7&j zG9=z3Z^25&Q8@33vQT9ofxAZ5C!?;_J9Q-TbG7Qp}&MLi-aGoGB*$oW5cb@JTw$ z85z8*Wr~i?eVS z;k1ZRLzD#sk6OJO{w(KOi@h^WeJbiSo+z0P`TMMxiby94q*ri~LFdDwe1ob#eI$i- z=jD-!Z*5di(%*Xze~l};4@_-sfaB9=bb9y01Vv@&a!kQxaMtRuwRFQzz>z8%oi>mM zc_c@GfCi`Wi}B8H0zU_LhJjuNEot3hR=3lzIvwtXHJqm-YtRo$680V59NouNA?^Dj9^W5btIs_QOJ2_}R0h)jPzzwK#7ablg{OK% z`CWk&g==Jk9a-L$zHozr9rKh|QG0&r_1kXG&&^p2U!utu5pOm+Jc7wrGfk{i5}6e< z@&9>PMNZ18A;S?rH-x%-PaxELJ0XxC&_Q?*E)I@KOcn>!*IbR-ua5Q2S9cUnJE>=@ z53(!!#?!s-W1>&bX2Hk;LR|i%7ebE9E5(3g7?WH@UyX4Yc(jlFKbV>*)%_XI~Lpr6q5h>wIH_{F7 z@O$t1mov^da6TvYUTf{OyaRSA?H4bpRd_JIxHNsUU;L?8&b)Pe=hx7CE$Bh!@6!$U z7WwU~HIgK`1Y+|+g78a{J{;UpS+4);16MHA-G8qw{fDH~$`=;TRjhnFQz*1G_LGC< z3wl3ESz~SA{z|)8A$c6r{PmBo#SLlPmOj$uE($ycB&NoivA@fd0peKwfswnwS30NwX8|i`Rn5FaZF{*`r_+|7xuwt^x$?tJ_Zg2vL0s28@!JQE5RoLs<2MC=wkOh0=wEI8xet8Z zen#h5!~S2q6z#TAC0BFy(4=L7$1aoQK$5-P+y0rwTAzy!|H#4Ovp-`*X%wXW#Uc89 z!qJC~K(moUKNNv!uC{D7>HF|)m+ZHubi{yCYhrfpj8cuZzzf);Jfnrav6j(J5~f` z*wTUh>dFfU8V&|wJOqImRdh|xD zYbgb@zqMF;v22m!t95Zt;%4#&8bKgoao1OFCdW%o7L0$3uX&fJ$G<$C>0yfag+5(& zjMjX#rMU93%ip_Qbq}##qo>ub2Cq|ra(zNoJyI;3bLE&sj%iK38P4^d&YIZna4Kx? z^P3wEly;|7Nu$h8Za@Gag~IGhh@7akI>ggmEy%kme~s!I(;s)S5A-xEs{6X*l(t(p z<%GbDjIC+9lBylFS%wFS5yU4kYH>QxGLmOspE6wq$iHOGa`WC)xyLhceu~OYm zS>|s&l;0$Ll;5@B+9W9yy)g;gx70^7wvd&DYd&gsDoBc>nlYLS+gC@a-!XL-u{0rfR&zDyXkZ~y2nE?6jshK)sd4$!dmc9&O8S} zGqao1Q25gLM&N61FaR&F|8*<`&qcg!C2GjRdt&Kc?TM_FGU@t3L1MNKP`2a~D)@%1 z1@LXfJv5e=6wC#MoAOf$f)FeUjh)BeYgZi!5A(JAr?x#^K+bT<$nUfp;wt%q$z~6E zFmQ%murfJRo-8!bCG#y9&%*rlYTI#8!y-Q<(IxQ_yf_HzowO|cb4N(mcvkJqbEGG; za!MW6;hACibcTwL4nv)ghlgq?vl}P~P4@I{?ys?rmECnl4B*?}hYAGvj8aD+_^_>w zMSrU~!`-jyLa zl1yLh;QQU$p0>EsPQ<5qQLs`*#txlP5tObM<=J5)ri3v6jnT;hpwRrhZk*JhArHwb z0s?}X3gUYE_~A|Zq+u}T3P83^7k*nhqte-;SsQIa^LRvz;huJ!C}zgr9yA|l!*j&T z|4#Ma-l5z)W_BprGxztQggQsi7MM(=zq+Z7@|{Ejy6%7;cB>JOjR+n|TX_Hi4|U~@KaOXb|0fYP6(GNp z-|`CgTkEeM(ceF9>_Q*6o&>s3o}#~Fl(U%Sks5c9O%{ipf8Qkd&>-*A0Ixu5i+#fZ z0L*V`M+cUd5^3t9I+WO6S~WyjY|fUf3zXt4R_M4Q{TXQ{014Z(3cU5qlr-Xhzhaef zTJ-`oAF7 zb0$FSf#yL6l_;Ffp0@+BbwwJC33B;(V)pvHVe5Peax?%v;bQrw&zdyo6tvcE1eE47 z3xS{O2hsa!ou~e)B$2?ZT}-mS6Eea_4NlYuKn__fn|}MT!`{@Wz&swd8o(o z$@2MH1)f#1{d+X}FurvaJ&}r4^@#wq0Vm(bNjFcFJNoumd=FB$F(e;I-otM>1UdNNIcH-M4LXVxy#G9pY-w(D( zPHb`k^NZulR>xASD2lycKU<6iLx~@)NsyJsHYVl@JNpLnJJ>UHgbZ%DHq9{DRdiT&KE=BUkq&HRQv@q+_3DLiu4Np6K{$StH?PQvt z-Xnzkre`9DCbxUXY1MvT`SvpCD}7Wadks;lPVH$!>!rg>!gIY1?R6hk=`N$aV|n|t z2H|?ceGN-^*&0T9YU^;i@can#{B2Lbj#?ToI5cntW_h)Z-QNq9YcajBUOC2=Mul16 zO7D4>&N9~NeRpXpONOs6547Wmy!sLwLed=h1&SBqxz}5OwH(PPPfgQ(G8R8$ajqn9 zraf)a42{A&7&IjQdWY0kFOVEAU97jdb$3@BC4l{=F)Hn1H6rKboEsPVCjcg8#V>FT^%ZicAthG zop?z0vO{fEl^9VdUOnfu&-4T~Ok-2GiH9a#GRt`513y1GO*_IqD;Cd)cQe&n2ymyURg(JPh9qC**}) zzHCDmt8>@iOFzfBQ`59<(|m9G->`QL`>v1*SxoPnn3Zh#ojG(tSCRx~hc)qms~tS% zw#0fTsGIaVD9?PoVw)jK*7PpBpkSI?U2<9)m<Kn8pX3&W#WGVtshd*I&QH z0dV+nQ!ZU2(Au!Y0W&l^L-hi;aNJIclr9*AkA(yX^}ApeyBOlc_q>MUz3!(%?MhK3 zei18vo}fo{@ZcK}qoETl4thh7TLVn3DSu zf1-+=C|Nu;$+TZ7d}wN#ho>1@;41%#$F{dC#597~KX8t{R)uZ~rc4%W@~6vPrq!HN zcW{Ke@)nsPyO#dfO6%$|akTHKV40RdciGD%C&~^=D=wI41%E2gHW(!X~p=|oc?2UPBPyS0p-rJ?JvqG z$u+(%*|-GdA!=KG^iTTe!tEQzfQSh@zAMwMMV@o3y&jB4sK2c&C@zzqRs%KxkV{w= zzk%x9;;^sdF;7zMUpC%~4MDc6rjFt2`>Oq#89y9Z9eo7rEbf<_OiT~y7V{8ih1%IX zty0xujpuntphtgJu|IP>z;x0#drYD&%0w(%rITARb(Gc_PrV|c_IkNR*INulY9}ZI zF6{A9jV801pb|67l;yTv85?oF-V33`y`x#a@*+mE$_OG~6& zTwJ>M8cR1yh4I#iKz0T+QfkFuT7;OCbY!RiJwyU|0Zi(wPsoV}1~iiA9>4OZkNNhp z8&YSyEqYiwhH70u)Tr)q&Wz&lcT+ z$F1>z%IxVu1T;rD%764j<})oMt&16v`C^)VYT*Ua=xLX4VRmz;dwMP|%jXMzyF}SZ zKP2Wjr#mD=;j9a%O}xBFR;~bQ-_*np4xb5;%YR)+B;Sz%o&2$Oelx1zybw$(6>H?^ zFoPd=$M$ghuJztCUf5dAl&CabfeXYY)PL3GYT^> z)u~acnL7IMa~E%4-8-1v#CZ^$>++pVog8bD+0)}g>+N3Y(&t5cyX9v5l`DR?J-hZNJtcK7dy*!)9etKksNO+ffYR|h&Y`5-7T7@d1eu0_;A^Z%W5E%1j!ArT)XbW%7Oqw-g(poa z;*&h?v&Hr7o^gLa{v-sPY6cxPzB}8$@(j4Z_}N-840yd!(3*hZFW~QmNg*-6Lvg6c|hE+(WxSo1b&Wkt+z?T7WW$c&R`9?xfOvp8(ae~94T8mypDNL z8D!~YnP>9zkT1?=aJ>aqBcvJ2aKqoCh>PLT>{63YT5*GZ_NU&S(1&uZ`YL%lo`^2j zUmQ-$LYpq(5+=kqt&(GI&ZL4bG;i9=Fs@2O-f8nGOlu^*w*Cw#QE=sCY@b}ONB_^) z=|4ihz%X*JuX6cuP1MKr(9dmAhB32r!4A5hUj|#&`|4z9!^ie{LF-i`wdr z^RLXY$`r(Qnrn{xoC3cYX3ZMSZIU1vpF>|oT5C<%OU>KyaJ5^N&Qe2h!2barA7Z#V zfJTkkEPjR+gL@DdSArh{=+P5~HuC#~Lyv5Zcq+Fc|9y})rRoc9i|IUGB{}THN z#y+J6W%X{~#@@wAMadZy`CKgi@6DoOuIz1MF zA4&-7&IM%Xh?U4-18P&<=9nV4jJ5)v8di(LrT=e!I?23It9YvFz`s8 z{fFhBj0H@;G#K&0t^e=n6Io?qc1zVQ0zICfL9DEHY|?^rc*`gdSYH1#+1lQI)-VCz zvaCrf?0$|L9})By;qP+#&2s7WH2hiPU5f2mNNX`;+FU%_T2+=Wej6RvWtkfZ5bag& zQdZ%`8b!5TT_Xx12_afR;344|U}0V#;Pd|-wmC=xcb2f?^oW?2=x=am=Bt^Qn?qXI zB;1F#&w#^=$s&&l5%9WWSL8B79(YJZ%p)h!voV>dRCk1zs2pZn+&;TGczhFz<1smI zG^Wc}TcaXd$@AcABJeevhmS9rW&!-(fH#)Q4_g0YeG*tp|GAV6ttOzSI+EuxBAw|!wA4;hs0x(yFZbp=~kK}iXxp93UIuPQ&CEA#tYvp>5u z5Wjiz0k5TnqhbvFXrFd15O%T59eK3QUx0lN&Vvwmpg;q5)_&C%eR6W5&?|fS7OU~d zhB!2q1Jyj!E8V$RD($fu?uU?ivwX>m+IEVRiDeJ{pH}|Of~6l8PTMOm^83-;n&b7A zAKphTa*rxxNtG$VC!-UxVk5$Xy_J%Zav-?b9&92Do*BJzHP$3z5|W(C%4l%VbYQq3kII*4g&2_YJjCafgk@LUaRbIK|s7A07}ORdj3L}ZSz?Zh3DYK8+?+6 zYKC`^oaQSXdWRr!(uT@^P@Ohhnj$;(JHb_p@vWP^$2px@>!rC~URMq_uMy{b93>8K zy9)ip++2TWrx?u6g)|J56m@zAhzBl4=Z#tVZ>oD-cSV~%3g9brgf`=&Mc!HO68qkK zsJx!4jE2ks3DIXeuWuSr(8@R*SZw1>mwrsn3teM3)>3AA(_ayFY}+)E5k8g2cQgCw zBcr1QGDQKAf7fR(EX}ak@Wp9%hkK&f^0PVsU~XCIlO@_7k;!5 ziTZ_Opi+LgyZW>-@Omsmcz9d%$P#Z3PP6|UM* zY|MCXa}0_B&a1Vkc3_70?6=}7Kt}F&Z31I68Y@;WGv`Jo)+&FTt360P& z&k++m_`Nu%-3&n00MtUjd+8vZWq3&6Pd6`*NV-!_2+6=*+|`gKkTHm(`EQ`g_=ab- zJ<6QhlzB_a<00$qWVg0J*05XBlYCgCWf)K|Vg&I=xMx zoO>Q>2g6IxD+VH`fg_Ou&!iVF#jX1;YsupSCoJ{4d9n0Mv4cfKNH%)>z>^8lM<@=z z3_NGIiYY`5bI;Ro>-QKqj8M9jD=yoqGa+zkhGq{u#{D216rw7Lw5_x}*i7H_*KIx5 zDfD{<9!4*untkRub-%fHug+CujwSN@^Dc;rt;&X?gMH7}lOS68YJ&vW%WJR_Hcv$n zy2@P>MBM@5@pYh7ocA%((J=;Zb0ish z|F+T`3+C-ut#6iyL?5Y`YIGc2D$O^4%fB`9_z&q>nmUxo)C8QbbnESOX`$N81eLP; zZVdktpEkvRi|a&F3a2rmaN{Z-6O>lv$d07ZPnLnVEFZ<{GcH-!F(&K&{4@ zh}NVZWmA{h)Czw5lu1e{pLxT=TUk4mG3kovcB`Fp26((CI?i9xU&O>T$~aKnb}HJ} z`E-rAp{}T58e;|o>fwa@CJ6lGy3CLdY*eDY|A7~WA$Atm24NK%Xa2hga|2u=N-f_r z9o~ksJuD2kk&%#?`uGS5ie@(tMmP60PiZCHOgt=i$ZnSL68z|0i+4aleh?;hiJHS0 z82S#!Ng!@yL_u*g@SYDml0THf;^~x6dvKNim3G{grsO-DwQ@<)RxZ({1b|ltXy4!r zy>@AyjWd7(4NK&jGHRWjgCmv(0%HuDE!L^xW61kp218oEcYFP zCJS9DXN6Y8?jSzo#lF4l(!l|OJPP0DhwCsMNnroUoi=)~b=y7;B4D2_?w)rMaJ&Vb z$nz!t`QVT93-jq}jT+11D~p|@t^CVLbO!+%sKmQa6P40gV0ro+2n-;O=O{bi6^PzB zGNJ&(j-7o1`~QJ&LpVHS@M`ZwTR6&wNCp}2)2C0mc1oNVrue|7#3Iv?CyfDH=BM7M z#!2ze^)(-;ZZI$~nB@kB)^a4!utRau_M2fpqQb0V8L>6v(%R6w*Z6AW8l_Yf;(8*N zKI3a2>K)bBCvTh~<uZX$u~@zIQnTlv;T9EEKY+kA)z? z;x|uo6OY;}TUM_^ug09{M4CqL8-*y#^?<afux=W}bIW$Mk~$#3A`3K_O zEHCzE!3a88zcXja4-=vkr>{Czr)_a6Q@AWHLdzmhbHm8SizyZjIS7p(U8`DgTcrkL ziZ{cYERGzw&u46WHA?XnrUzWPHkLGHv%e56qxEPqZ1v9R!g2R;mn+yw?ee@q43tYS zHyy8DGYx7?mboR4hiFMm)UU4>N4s6)5L%CY`(#@E|i9 z_CbL_8l&X1lM6d4qg|xe@>pT{Vx`FlX@`w}KBIYsi(@0}4i+DK2CD`fL&I&}_ew01 z30S)fp7{z@e%Ze9FicZ=uRG8y!I4;`QC@(yiF4xzfS>)Sfx0XNL< zubtYFUU+>o({kf{s>{l__T+pEU9;%u$a1cRiWsvBofBdnuh$Chdbks>Ka-HldR_3V zy+CY+m5LBnq83Z~%BCyRrpA=X=L3mV7vc5Nwn);Cp66+av&fF?$YVXX3d6o0wRrY-qi}4+;1UN`cQ*G2bGj-bV1z~R~K$nDtfO2@w_JX>22uq4z4F*sMt?i9ed zi;GJVPdc(OPk=^l$&(+m`ZJ9>8$kdB2Ds$BYe=;qybe?!KeD$>VTOB@`4cDwwQSk8 zt#k>R($T-(o2J93%+!|d6TfZSo#7aEqirdGSrjndqVXjzw8xH(J6K7LpE9W^_Rg=f z+7ECiScNyvtW7nj4^N!6lxuPh&$+O(fTrNA38B|C&@@|&Cf_Igjbo~oRx|}2YAmyu zvjkrMwMkZ);&;p~6e@uBl+NePYaIFZ+ZN6he;BeQkt5?6DdX zm3$J5sX@tN(oTmAN(=OI#z9mK&Ol-TLMp1wdl>|r*X(hu8AE-2i5qShvoyhwCRx2E z!sHf;T`$(TU>YU>E?Yjs6wz;v`uM7 zKjKzS|6)s+JL?)@`b4L<9V{mYUKzJ>#A;ZC;A0bUQ{P*hWsuYPcg1fsa4I`o}hP|`^ zyb#M$MviuR6l;%k3H{Lsk)%Q4Hu3hDAa= z*rtMNUb*7`?R86Ht|-bC1}V_b0WrXIsoJDFRKXu0{^lluUTpy2)Wv%%41AlkmLZDA z8{Ra|QvkEU@d7U|_=v-BAM)4}X%tjrhK52h4EdM&ydZ3@X zMXyQ?j?x4V%1Hx_^F;G{58qVbrLRGl{~8Sjl0AoB=UNpv=8w$*q^Ppxv8+8!CJr)( zH83>#cwi|yoYZl@dGPV+w(>~;SQQQ}4ek5tACbDwQJCi=&dQlNw>a*&+`2xfRLjs@ zzFaP05$0i{g3rE9E|@}k6%+t|T_-R$03OF*z(guJIe8VBTg>O-4_|?lbm9S?G=Q&} zM(Q=&N|AdYhY0v)32 z2aX^xF=I9nwd_lvPL`L1Vx{n0ubo1?^x`kmO%8q@c=buz*+nJy1$&ZFT5+O++nnX! zj4o027AA$73c&mabSxM}7ZLA=YifuxNps=yd>VjzFg`0Pinz9nN_1GHQ@ze6LY4qh z38C!fl3S&$W$<~87!1v9SEEIq#ww}#=ot38|5&AAfnp96D_{k{r?(Kfn;%EmgNWP= zDxaQ2`wK-H8I1Eng#%o1UqnhE;y6>gp-5tM57qp_d86ShP8XRAO&0|C=^%y5oVxx% zNJz-Hex1rW&%48hl;q?A$eG>ZM;n_6)9Qf&#Wc=}vK}8`?@L5XJh+jq8w%76l$6)%hU#w$=W0(3WyFCQPZ%Bp&m9pgke8Vm_<5fWH6 z=y|kv(5D?2o-9_;ozS1?RDTXpq&jMM7<8AUig0I~Q#4&~qbxp)*-RZYoo?xL%bbjy zXT7DKL+@%^yxJml4QS8!o|oU}W-&Mf1VabQElDePZ7aEkmAL&J&(Rl|K(<&D5oi0K z%!LShv*3*FJ7&KCDyUTCbZ7nY$mk~nx=k@g8p_Q+FI_j)+Ie#?uh8ORXh8w3dT}c~ zE~|B&9$2{l?nJ=vpxadX6X;xqpEC^v1cq1|mcaP!GZLT!>jeZHSFr>?8v}RDb*|wW zuU=D{^>)5!zRFfD2(pc2mu50JhuAmj0D`)*rpJC3q$<^FM{LmS&pFx3d~f(#MH3l zHI6NHrQEcpvvvyAN;dQJ3_yi&@bXHw8CsgIN%RpDM3zk!efqBp5!CO`HWPO9oWCm! zBCQz{3&H5I84)sA!7{x%Ml)hr{ml^Ut4QgM)(@JFXXA{1ndC zZVjp^7AZg5>`>wPp+3;5_iHfDU`du!x11O@F&3JfHJeB`ruoxfzkVsi19x?_5Fvn} zYYw>+EGsia#GFl9Teg)2env|bXzX|XW=*7f5o4W7{K?qE!$Y-Zu$~!Xx(AN=aQ?N^ zObgx)<@^V`so|=akq%}x9GBSr@>2)1_ES#K0V*yYsW%X%lx(%=mi2LXq5-s+1hTbUMtX!J9BA zUxqE_0^xVQ;r{ab<4XZ-!(B_Ss}4Mm%Z!x^%qmWbV5GNk2{`r5tl|VSqoo>*x;P3- zmlTiP{sW@dC?LQ%#)mEp`x2;%#0p&5QoMicu&H^1-#cBzSD=nh0u1PO-QOb|*7v7y zft!zOcGi`iK(noRf9pBH1W@LH!0hW!T5oos-C5do?F^6*i8d)(Wcpnm0CSj^Ew%wT zcSlDiu%>bX?Jw|rc%I-)l%tv6o-uF}wx$Bw=+9biG?n}Ry~qwm^+3(q3!-U`iEM1U zt?qM953hZBDDTKYjjO$&G3>dYRbJLj^c59BbUk)YPQ^=2ts`B;=FI_V`spk z0~!ZrX{_q>?jMhz{9uT0$jP@F{Pr7aWPFcjBnyqKC?lIT&xY`Sq^7QICK+ulHGKk} z6gOwvDe38XI?OJBvr>?pb0fRGMb@c1rIpL)OvDqrwRs0)qX2`>1yByn7W+bcP`{d^ zR%^-k!m%tuUJ399yIq5pyjSCylArXEVV$o}0mrU1jUI=gRb_bNO+k@;U__}q{46(yX*VUu z%rT&#g;_TZWQ*8eB4}p#wFQ-Z1F$}L<@%4G9*-?YZ~V3_{X&&}_tfVh{&WFa?)&FM zDS(j&P5I3lVaLF8gAPo~fLZev2=KA+@=8_qS;Mtk_!$nW)sgaYt&(rwn3X>ydtA2z z!?7{bY&)pO*PwVMtt%m{xjGJoFO>g)AxJI4#Ta7T#{Y|_0LXcbX)hW;f<^2W4K;qz zXr+&ZAJkz3{z;}UDLKDUWlB|CbE}V*2d69fam!whcpBq|}L7uXtHqQxxfn$Xq`4kRXl7xf%|ZczTw}cM9t{sEnIA zs&UxyOK|i1#^+lmkd8Q-R><#1T#>PkGpmNhCEu&%XWu6_-(7j2mj%M z+zI%b&4952qKCb3ui>LejMAM3%oQe z-Xu_o3YMa*ru#kOIqo_3DTA)$Wjy^9y?k~Vwk-Bxe2y$Fs#z>yJ|1ju zdn=-XX-{{`|JeI0UL%|Z8RU;P)d>85k5rZGd|>AIJ@$gAZ?^xt9%0Q5Y+fE7Cxav~ z3l7>>2_DoIq zRc}K`8VaQB5nrQr?On0@zp@ITv2cnpHcGk94a{091qmC=%gfrLgA&{`DH$1CU$8_b z(u}W;me)ao))sKZg~SiGhpkBm3$>aMaq{uKJRdlw#v%%(0&V?u`#4yb7oET$yoxyz z6d@Z~-@K;{bK@0y>H|3+()&!f)8OB))yHqc# zfJK!g;ubr@M_R5oNsZ> z{N-5P*t`|1?w>POo5=*ocpX~aI`6{PCu|yaf93}2V~0ZQS}KQX?b3dYz|Gq!eTYg% zQ>ojV9QajU>Y!q5_ff zVuKS#jK{Mr{_8Xx!C#flaj^FVtLtAANioXFX(%2XX9so>W74p7Y~CF8AY(pw{y=vi za{o^fmXzd78umV#-1*_wP2^?+7noQ7UH5xUWuLDmr!6ui5?NR6A)7yKO-n}yc3y#6 zaaB!C7vO%u+jVjAq*DI7(dP#3eP92s7gf}Br`qdrEvHGPLPc!Ep9?H|7oh~0o;9_S zZ?()yct1n`z#Inc7irT*O&57O9xmU=F+2ySfg=Wg4og&NlIqvwLhKs&Xzo}UzUaK$ z7>m$e?>ApQY29+&9=0yUig2j)X8fvpO-qm~*@RM9EIWoSF-qe)KAheY>lGG93^}ES zDmr=Hf!|CQx<2-G>}EJc)@+I*IctpUA2FhCjOx1}i)?0e`Qoo4n|FvNyj{xn@>r>O z#)pE;G^h*pWHgGyT@jC5a_!<`*hV1h*{&stsT+>%Ymq6eCRdWUMT^PG?&k{J?HHK3<(~jJ$3^ec_Ox zrR7z5|AG~F(cJ!wjq>hKL5x>ev7=jSAt=$=+2XWO3M$Mp6>vb%XI`s&^tWwzZ;ugd za{X41Sjv~6Lu(fJL>g9JUhc6t7#-))BHgfGv;FhWqHW(L+lh;WUGbEQUNGQ|Q%A%? zB}CpAXqd9s69NZmouP=h)FON6@F9waLzq_~ua%eKKAHc}A3dQDEAaGrINwTsn|C2o z^Mzao{L3YbGJb{MA(IZtO$tZW{@B7w>&2*4hbB*&R zr@hpc{Ce7cY)dRi?1Nfwg&ElM-Vby&SAV^+R<3}D6{eY)8F*A{+S|u~?a3HO76XP@ zGdAzYg}r2RC(T`56I`0`N{z@&KW-tWj8OiM-lD$o5nt3mKjH_fM50h1U^P}&UhaHz zY5}02LAH+j9F}B@tXV7WpYJ}G&h|N94q!-W(wWSRU0v68|A9$+83zDw$hzMr-wCFS zP*dZ*%V7i!J8ekt9m?b9^W((Vj>Ys2Es31%Y~1xRw}vRULeNJ-A#RNM%*&?(y7S|w z?Mg4~N}XgogiqK^*s1G$lfL&QXXaO72ciBay@WouyM?#NPdmBMjb0af=og6b5USha z!_OZaX<1lVUCy=?fuU}4YHE&JF|dOGr#N4qb)64$czC$1tPGeF055ijhT*L(TJRUp z@;R;bpuUpNQ-j(G{u&r~&Xo{INwuxS7G4F}=FcuYM!vm$eaK)V0l-3~at?fg8OFPu zH?|eoj25p$MI^rv`^paV_=(=EY>XhA5H(ypG{2bWaIrq>PFtEHbjBv{5x@Uog2`dw zW_a!iKrw6U-HRY}NN{6&RaIxS=;Ht=jKCuV@(Z1|Mu>r13XtQmZTN=#ecP@PE``wV zEDOPT21RCPHMO*~=o95`_d!_#u3JSQxd4%kARP_tZNM9dijK#=eXsN3L-(1`|1~~4 zI69KK9OA&6wBvaft;uLpTwG(1myv4QXnqCeHQx3{WN#E)!<>KNZXnH_*cnM65?<@Up za~_ZW2`Q(wfKRa2%nHC9u*RS$&UChV5R@o*4EU`L^5D7C6v6AD&#KOt2#z5551y@0 zq9{Zw_%p%A1J2#R=D$CR>{)_SUoX?74|>zkOuyUk;!*b8%>&ZDYnAh_{YZcVJ^DgEWUTU?-_wtN}FX>+a-iQT*r2aV>D*4^&!7szSmz G=>Gs1&9~P8 literal 0 HcmV?d00001 From a9a6afdc6b9b389079e3136fd09393e2983dd9b2 Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Mon, 29 Jan 2018 20:42:03 +0000 Subject: [PATCH 002/119] Deleted onenote_checkmark.PNG --- .../trial-in-a-box/images/onenote_checkmark.PNG | Bin 7237 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 education/trial-in-a-box/images/onenote_checkmark.PNG diff --git a/education/trial-in-a-box/images/onenote_checkmark.PNG b/education/trial-in-a-box/images/onenote_checkmark.PNG deleted file mode 100644 index fc6cccebc4b8d8a1f12bf0492a4d84629fa4df59..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7237 zcmch6RZtvIkSz%W4eo9kT!K3Uhr!(?I0W|)B)AO_+#LoOhQXaca7b{1TW}rRb=i-t z+THg)-q-uM(x>`%ox0Ukw@=?_byayxbTV`V1O!Y)1sP2Qgg1zOMg`ougX zne{dVQyoXTeNnKA|CeLipc+uUP8D_36LB*5BT<-*nG6-OsT_v<=YfCFcufge#uxM-Z^&^Y=P6Je4LcQ`nefwgqLiq&|F+OlKK1&w&oYf|G zci2NmDiG-D5Qugtn)ethhx+r6@UQR15~&l0A5m!^w)|!T;zjiUkJ4Fq6p2G+P{j9w zrdfDW0Y|eO&)z#DnG(?X4KmNv*Ki-gJ6leN}?z2N|I1CJ10+<(FzOM>a@2uv>ENRn!%6C2s3NW}8AY0J+ zYiOiBJ+jEh<&7H9^Lojf0H)7)QZZPQ(CJ|FUX;B`ICMI6_6(I2X{&}xiNSd<*RrRh zd7`P9_SIo{^_|_6;q3k}e#(!-;^>Kg9i28bH`44lS;PMsDx9^D3Ib0}*W z7X2mZp=TKv=3D~AMl5Z>isC4PF~xF;r!>t?c-T#=cUU>!BZZOa4Sn;mmVcyCe=Az6 zwPO@=%Ey|o>%j8(Zuk-K&7l{b18eMr@$9~806L6%=}Y6UPqh|vNxvGw{qEC@66BLPYFI&P1mc$e|h&-JTAlTkXQE?z8hsg?(?ayR`} z6io#H>L;`%{!KR&y(ZR_S+_igms=IUy@G3#u;-5!oUFKjDF2c9U%xg1BlzAyTz03s zKRc({f3asDrj7WCEzm^RIBnEo#hu=~L&ZGF;bN`I3>jdvrc68c!CCa^xY-I`r)CXK zdOG{biCxE|s=Y1w;O9I}^C zUZZ=|RJY@nXEl)-iw%4!#1$~MG&S2ZZsBJGN%ovoFY)YVF}x+^qi0Uhq}D9`O5Ek6Zw`}IwhO+DhRQtf zM4Zo#4R5U>3ikc0k=$)bDR|vm)6QK0043=(jIT2DeCWZx0Q1~%I~**3pMOx!p&gn2 z&TQDQl!5sMG5lHkEkcL*cRYme2tWjcw@hykPz#U{X#NK<4h^fTt6N@P7Dez?85$n0 zsDl60zSA&Q{%;35AV52Nmg+!1=NmeEXeH!}qcx@Zud|%gAO0)3^z>!mvANj|*57}q zyxv=3kJy7tQs!W~X9<ER2W)^V@$r^b6b8wPP<6*`cRG=jOZhbY z!+@EJaF2oH@InhxX(np;7?A}qPZE~+|L&BP7X}YFMgN)XB$H$cE9So z(3xK2-2scS>907?wzoJ>m6F5H_S|3^t2VA{Gbhhtri9=z<#?fkMpMxr&Ry1M6W!2>uBQJ zH1T=6@(KrsQbY3JQ^!OW0(W(kbA6cPnTpX{1`Vmy_eLEL-E^G{hI1$QD}LD(`JEZS znXRF6`|=Bw3{6mRbbPS-E|B42pp))07Vq5oT}GR!&CwrK;p4fXVS=xx$)G`3VOmh z?86pt^Rmi9%6B6Dsn(Xp^^{cLSoUV&Nhl>M>};c#dDfxY%ku!tMj}^(eK`1rwhN-H)>64iC@1+SD^Iv}+^h*^ z;cga*2&_&f>sH*7iH4*oE#p%u<4kLMrx#1|4^r$ZGHwXeFsQ`43=?<_&VceYX9Ld~ znzZza-_GVY(cS(4q1WmOhKd)Zb|Zh(y(tMOqx{;Rr4lj zaW|U@JU9Iolzrr{!^* z1_CGs@0^*Bp}(h6K@^4;#o8caH~aE>4OgH+6nrxFMF`+a@*tZC_Lk^h>tik|-D-l? zMYPA(_mW0x@niL~-(rsP;hxWUsr_r(FfUK)d*5*9rtIz6J+qO~8dqNhkUtdko`wk< zbo!W`rwOa~F;TrUduEt}Vo=k9)` zfXpf20TpZv3(Hn@AqV1E)}iJgH(9KLodvYQq8{#U9`rFt>z(cLKAsG5(ef@?0g{RX7sw$4ask9)B9VmVxAWhs($SbTw`x!IcyV@ zuk_eu3p7BENuu31VcfXQKJ=68BVJ}Tk2tzc;{7T{$C3vXrMmhW<8bSRVzmFXn}Ty} zx#5|4nIbT5L@pw)&MvEo?ucP&S19o}JC8wieV-WK7*I5%Q6e-a>YLUQIVLnB1dMTe z_&1H&P^urw`FHmsc3-@yqO+-WDF=&{Hp|)bOwv0B7~{R`N^III6eWQm6_wnb`Nzt6 z_nYS2F(@vTT2YiE2hVppVQ9*brp!tP1O~>VC!))xE2ZFU+uH1?#v3_}ME~1cwD?Jx zX3hH1*YK2{dyipF(W5jihD9}&1dmggq&`S|X-Yi~E%1ZgT{g%1bL1LRW_ zFk?1=Clz*Ouy2{@aq))-2d-9ITIh;e9fWq(B}EJb2d9|BjBqO`PSTEs`lOp}mrx>-t1M zRk$LVgJ_|;o}}rzrl_KiQ{3HK%0h4iQ`FfTPt@P# zewI+cz*hU#c%N!p4BKN{IYX>|TfLTnfbjI@|5|YU9~IdDUtl55$CG?`fu4a}=)aZn{vVcO+2y0=VK+djKq5&$it&%pxN* z1u%8Ncvjwtro!=4n;PYaQy~@-j0xPTp%4cv8!=2EBE#2~{ z;DIUPp{U4UOIsE6F5wm-dew5Yleu;O1HX#^KY?yn^B_$ans;%g&)*Eb;JLIQNSG*M zYhPnMM0$K%&k`VNuRLKW;gp!ddZ_O8ZibyNJhK%r8a?+^taUQoEobJlTX6bek)dQ2 z-Ob&5l#QXP3rrKR?U^_V1b6GvXH1Dq>gAaHq^30Gb}{pDcUNSGeh$cLP&ko9HSl{U z2dEnrVVhX$eekE|$)0t`wr!S!TxliZ<^rS8Fg-6WD_=#JDj;QLoCQ`IM40O!c(_55 ztpTcHQq$ty!*nt0D(NW0PW{EIWCkp#FW!lP#dom{(SIHVNqLAjc_=~h%fogwPyyE? zG(GIwIApbsa2I5(ZtXAEC5fAVui|cC4+oK5Ual2o%(n1+Jh_M-H|fcK3J9H$)pH50 zQeZl7?Rj4*Sx`W;U1dvR{O>4S{JOR{{NOTeJ;xPWs}g~)g6C1ymc;~wTjejvQu4lr zrgLYNb~ysbPc15sr+MtRXv=U&xRE=HlwD-WGQ`E!JT&tLN+z-OM`uY8FK9!-s<}eF z49~YqHL*r%knH|nRkOAiCcopO(9huWzY<}qBm-J=s46Vx2Z+`5uNlMMwzrNpQ=)QV z$P!JG6@!64H#+uXaVTYnNWuWEv_*-*#9Dw3N?^mLXYQE%WCs1wGz?T5Remq8P;wD} zY-Lsc#BH|x0cS~=yf0pMLKqq^Z#M$JJQB(DNu3*cHu)2a)Sj4^$MNVf$|h^=KfU7VT&-N^+S=}K+fFW8HuH}K7_;hN>vIZ1wD&*m0Y zK}#W#BKGr+pJTJqJ*u~IOijh#g{}Zt*#Tcq|KaAL#T)abQ;0mVeg$k3)~_auN~RPv z`6YGF_-l$BQb-jOrVs!C*g&eZHiC4e5MEqw^y2=V4Wp`T5$pDvcDyWx;^xft5y{Wp zJH>?!iYqngx4usr0|P_O1X^Ob-ShPmuA&HiWEA?Y8KTt6qt=L*E2aYjp3I+bC=6`f zD;FQj&C&zJkDgpkHldY`I4U_(dPt_0R3d8SZEjrlo69K@o!y91PK!=p)C+BZ@0aHg z@YBfr*)v$RnYGwyD-F(TNhjWx-E}*iQoBT^5cBdx&QuO+VPUm7<`GK3?A{sHRYESi9e@HXQQ=S(8a+HY6T!%2;+5t2m_2({!4lTUv7L zJ5jeAqm%0li#vLI&b=$NhkNc9%AUZvJEgM2HkbyP^Ap#lYWQ-%@viLi+ z??Eg}%$vM4Z51w(fJaFB@C>bDl~{wV(2JZCB+0z|nxt_w`t3xohJ?9VxjvNQeLg4P zdnxthrt*>Z>Pb|1gN1;Yu)9`L0**iNCJjX+UQ2?}GUR$pO~Lzb%6aYld|^?M8Ej#6 zWERt#b5LOVCaz5EUtwx`@Zv7#Lzg0BP<(!zb?ysB?~_roaM!*s!$DpD zP2E}xVl`F()4JOi4br^F0IADNdQ{rPZWoaMHza^l9^a>wJ?Lz_ zR#i<`nT%?_5wcn9ND&9S_9b_ph*E^!S+Q6SCOm^0gY_Z;HKYRk3iiI4)nVzpjDpQZ zwwq{p-y~oU>b#IWT}O2n6@$iQdHRpWr6PC*Wzuwdu3t_MV#% z?U~WICzca^vORV$DeVTgu05RGN60y9@a=F2J;mLT02Mz{HiPp7J-fa|?U4KztC~c3 zS$M?QU<8V82!p{UuMq*4+TMJVS|7X1XUoIo3fgebsNd3dbe2_lAsy$;EVE?MfiWv- z%j%D=xMCa>1faX`4KB(Wy6@}JH=*Zh2N+g0D`aO}Q0 z|1tg0%k{>x<~+{LliQFvMz1W|4Jpb;vrM3mIj#hS7ZN@CJYW3&Tin}{t zYkm?n&iV;!1Us$DA$Wx*9QI_jtml8$uIR#C1So5wNhn*|N8ri65}n>bh?oV0`~v zg0?xJ))z6*e^5`B-BkX=1V5w7@|%r(YP5@5UjHINDSM;k?=Y?+RHr1bU&oW75-}YB zoBsEqjnUH)|M0X`DMDt~Fpv|TCpegbuY%LNV>Nnwz30Y5$x$(FN4}!27r7yV9}L|#H-O&Jw-YY6Z@yy+_mQl`PqZd4MDl=&P4HpVP|_LHkOOm zE))AQNw!E?&Sng1M7wYkCX27xW1@?$)6}6a-z)%j>+3}|^>ZgyS0K0G%&j~!=d8lJ zhfJDK&Y&e96gHBF!F8sv03F`cXlcfPkqpgP#$*1Du(#^rq`m!BJr!vw z*x+Z96HbczGl!<{Hv3k%vhw_vNT#AsMPZ8sW*>x;y~>3XC8ZZC*{(=iI7RpU)9N>E z9e-5i$m-R03vjQU_p-&+lRBMUOYc+-u2*SIB5%X`gW%!%QVQ^l?Re^4CSe&(!pV6Z zyexa*OZu;jYjJXegzj@DXuvBurW zlFv3FBv~g5ElA{rE2*D!up|{!rEzkNY-?YZNWWnD3hRT&Lv*R!3k>nPUaZs0(&sj? zBMyzJ(mk%dEJ$f)4d3B(^H{)E_ABwVXl22= zWE~hR8A!MwG}II-Lc{_p@KSXfA=#P6H?CtotHb+p4RU`uWB4| Date: Mon, 29 Jan 2018 20:42:14 +0000 Subject: [PATCH 003/119] Renamed onenote_checkmark.png.png to onenote_checkmark.png --- ...note_checkmark.png.png => onenote_checkmark.png} | Bin 1 file changed, 0 insertions(+), 0 deletions(-) rename education/trial-in-a-box/images/{onenote_checkmark.png.png => onenote_checkmark.png} (100%) diff --git a/education/trial-in-a-box/images/onenote_checkmark.png.png b/education/trial-in-a-box/images/onenote_checkmark.png similarity index 100% rename from education/trial-in-a-box/images/onenote_checkmark.png.png rename to education/trial-in-a-box/images/onenote_checkmark.png From c3b81bed86be8fb97d6d99acfc736d87c7c1ab6e Mon Sep 17 00:00:00 2001 From: Benjamin Howorth Date: Mon, 29 Jan 2018 20:53:32 +0000 Subject: [PATCH 004/119] Updated educator-tib-get-started.md Minor tweaks to text, adding period, adding addition sentence on where to store digital pen, etc. --- education/trial-in-a-box/educator-tib-get-started.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index f448a10be8..cb41ced535 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -107,6 +107,7 @@ Microsoft OneNote organizes curriculum and lesson plans for teachers and student **Try this!** See how a group project comes together with opportunities to interact with other students and collaborate with peers. This one works best with the digital pen, included with your Trial in a Box. +When you're not using the pen, just use the magnet to stick it to the left side of the screen until you need it again. 1. On the **Start** menu, click the OneNote shortcut named **Imagine Giza** to open the **Reimagine the Great Pyramid of Giza project**. 2. Take the digital pen out of the box and make notes or draw. @@ -120,7 +121,7 @@ See how a group project comes together with opportunities to interact with other ![OneNote To Do Tag](images/onenote_checkmark.png) - - The Researcher tool from the Insert tab can help find answers. + - To find information without leaving OneNote, use the Researcher tool found under the Insert tab. ![OneNote Researcher](images/onenote_researcher.png) @@ -153,8 +154,9 @@ Today, we'll explore a Minecraft world through the eyes of a student. 9. Explore the world by using the keys on your keyboard. * **W** moves forward. * **A** moves left. - * **D** moves right. - * **S** moves backward + * **S** moves right. + * **D** moves backward. + 10. Use your mouse as your "eyes". Just move it to look around. 11. For a bird's eye view, double-tap the SPACE BAR. Now press the SPACE BAR to fly higher. And then hold the SHIFT key to safely land. From e395fd44f9d548ed2891c5e9ab7c45da9d588a20 Mon Sep 17 00:00:00 2001 From: shortpatti Date: Thu, 15 Feb 2018 15:44:07 -0800 Subject: [PATCH 005/119] removed the inline comments and questions; ready to republish --- browsers/edge/available-policies.md | 136 ++++++++++++++-------------- 1 file changed, 68 insertions(+), 68 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 70a990a885..70d288c5d8 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -10,7 +10,7 @@ ms.localizationpriority: high ms.date: 09/13/2017 #Previsou release date --- - + # Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge @@ -38,8 +38,8 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. | If you... | Then... | | --- | --- | -| Enable this setting (default) | Employees can see the Address bar drop-down functionality in Microsoft Edge. | -| Disable this setting | Employees do not see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type."

Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting. | +| Enable setting (default) | Employees can see the Address bar drop-down functionality in Microsoft Edge. | +| Disable setting | Employees do not see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type."

Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting. | | ### Allow Adobe Flash @@ -49,7 +49,7 @@ This policy setting lets you decide whether employees can run Adobe Flash on Mic | If you… | Then… | | --- | --- | | Enable or don’t configure this setting (default) | Employees can use Adobe Flash. | -| Disable this setting | Employees cannot use Adobe Flash. | +| Disable setting | Employees cannot use Adobe Flash. | | ### Allow clearing browsing data on exit @@ -58,7 +58,7 @@ This policy setting lets you decide whether employees can run Adobe Flash on Mic This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes. | If you… | Then… | | --- | --- | -| Enable this setting | Clear browsing history on exit is turned on. | +| Enable setting | Clear browsing history on exit is turned on. | | Disable or don’t configure this setting (default) | Employees can turn on and configure the Clear browsing data option under Settings. | | @@ -68,8 +68,8 @@ This policy setting allows the automatic clearing of browsing data when Microsof This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable this setting (default) | F12 Developer Tools are available. | -| Disable this setting | F12 Developer Tools are not available. | +| Enable setting (default) | F12 Developer Tools are available. | +| Disable setting | F12 Developer Tools are not available. | | ### Allow Extensions @@ -78,8 +78,8 @@ This policy setting lets you decide whether F12 Developer Tools are available on This policy setting lets you decide whether employees can use Edge Extensions. | If you… | Then… | | --- | --- | -| Enable this setting | Employees can use Edge Extensions. | -| Disable this setting | Employees cannot use Edge Extensions. | +| Enable setting | Employees can use Edge Extensions. | +| Disable setting | Employees cannot use Edge Extensions. | | ### Allow InPrivate browsing @@ -88,8 +88,8 @@ This policy setting lets you decide whether employees can use Edge Extensions. This policy setting lets you decide whether employees can browse using InPrivate website browsing. | If you… | Then… | | --- | --- | -| Enable this setting (default) | Employees can use InPrivate website browsing. | -| Disable this setting | Employees cannot use InPrivate website browsing. | +| Enable setting (default) | Employees can use InPrivate website browsing. | +| Disable setting | Employees cannot use InPrivate website browsing. | | ### Allow Microsoft Compatibility List @@ -98,8 +98,8 @@ This policy setting lets you decide whether employees can browse using InPrivate This policy setting lets you decide whether to use the Microsoft Compatibility List (a Microsoft-provided list that helps sites with known compatibility issues to display properly) in Microsoft Edge. By default, the Microsoft Compatibility List is enabled and can be viewed by visiting about:compat. | If you… | Then… | | --- | --- | -| Enable this setting (default) | Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation . Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site renders as though it’s in whatever version of IE is necessary for it to appear properly. | -| Disable this setting | Browser navigation does not use the Microsoft Compatibility List. | +| Enable setting (default) | Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation . Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site renders as though it’s in whatever version of IE is necessary for it to appear properly. | +| Disable setting | Browser navigation does not use the Microsoft Compatibility List. | | ### Allow search engine customization @@ -112,7 +112,7 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | | Enable or don’t configure this setting (default) | Employees can add new search engines and change the default used in the Address bar from within Microsoft Edge Settings. | -| Disable this setting | Employees cannot add search engines or change the default used in the Address bar. | +| Disable setting | Employees cannot add search engines or change the default used in the Address bar. | | ### Allow web content on New Tab page @@ -121,9 +121,9 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it. | If you… | Then… | | --- | --- | -| Enable this setting | Microsoft Edge opens a new tab with the New Tab page. | -| Disable this setting | Microsoft Edge opens a new tab with a blank page. | -| Do not configure this setting (default) | Employees can choose how new tabs appear. | +| Enable setting | Microsoft Edge opens a new tab with the New Tab page. | +| Disable setting | Microsoft Edge opens a new tab with a blank page. | +| Do not configure setting (default) | Employees can choose how new tabs appear. | | ### Configure additional search engines @@ -132,8 +132,8 @@ This policy setting lets you configure what appears when Microsoft Edge opens a This policy setting lets you add up to 5 additional search engines, which cannot be removed by your employees but can make a personal default engine. This setting does not set the default search engine. For that, you must use the "Set default search engine" setting. | If you… | Then… | | --- | --- | -| Enable this setting | You can add up to 5 additional search engines. For each additional search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

``

For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable this setting (default) | Any added search engines are removed from the employee’s device. | -| Do not configure this setting | The search engine list is set to what is specified in App settings. | +| Enable setting | You can add up to 5 additional search engines. For each additional search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

``

For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable setting (default) | Any added search engines are removed from the employee’s device. | +| Do not configure setting | The search engine list is set to what is specified in App settings. | | ### Configure Autofill @@ -142,9 +142,9 @@ This policy setting lets you add up to 5 additional search engines, which cannot This policy setting lets you decide whether employees can use Autofill the form fields automatically while using Microsoft Edge. By default, employees can choose whether to use Autofill. | If you… | Then… | | --- | --- | -| Enable this setting | Employees can use Autofill to populate form fields automatically. | -| Disable this setting | Employees cannot use Autofill to populate form fields automatically. | -| Do not configure this setting (default) | Employees can choose whether to use Autofill to populate the form fields automatically. | +| Enable setting | Employees can use Autofill to populate form fields automatically. | +| Disable setting | Employees cannot use Autofill to populate form fields automatically. | +| Do not configure setting (default) | Employees can choose whether to use Autofill to populate the form fields automatically. | | ### Configure cookies @@ -153,8 +153,8 @@ This policy setting lets you decide whether employees can use Autofill the form This setting lets you configure how to work with cookies. | If you… | Then… | | --- | --- | -| Enable this setting (default) | You must also decide whether to:

  • **Allow all cookies (default)** from all websites.
  • **Block all cookies** from all websites.
  • **Block only 3rd-party cookies** from 3rd-party websites.
| -| Disable or do not configure this setting | All cookies are allowed from all sites. | +| Enable setting (default) | You must also decide whether to:
  • **Allow all cookies (default)** from all websites.
  • **Block all cookies** from all websites.
  • **Block only 3rd-party cookies** from 3rd-party websites.
| +| Disable or do not configure setting | All cookies are allowed from all sites. | | ### Configure Do Not Track @@ -163,9 +163,9 @@ This setting lets you configure how to work with cookies. This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info. By default, Do Not Track requests are never sent, but employees can choose to turn on and send requests. | If you… | Then… | | --- | --- | -| Enable this setting | Do Not Track requests are always sent to websites asking for tracking information. | -| Disable this setting | Do Not Track requests are never sent to websites asking for tracking information. | -| Do not configure this setting (default) | Employees can choose whether to send Do Not Track requests to websites asking for tracking information. | +| Enable setting | Do Not Track requests are always sent to websites asking for tracking information. | +| Disable setting | Do Not Track requests are never sent to websites asking for tracking information. | +| Do not configure setting (default) | Employees can choose whether to send Do Not Track requests to websites asking for tracking information. | | ### Configure Favorites @@ -174,8 +174,8 @@ This policy setting lets you decide whether employees can send Do Not Track requ This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their Favorites by adding or removing items at any time. | If you… | Then… | | --- | --- | -| Enable this setting | You must provide a list of Favorites in the Options section. The list imports automatically after you deploy this policy. | -| Disable or do not configure this setting | Employees will see the Favorites that they set in the Favorites hub. | +| Enable setting | You must provide a list of Favorites in the Options section. The list imports automatically after you deploy this policy. | +| Disable or do not configure setting | Employees will see the Favorites that they set in the Favorites hub. | | ### Configure Password Manager @@ -184,9 +184,9 @@ This policy setting lets you configure the default list of Favorites that appear This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on. | If you… | Then… | | --- | --- | -| Enable this setting (default) | Employees can use Password Manager to save their passwords locally. | -| Disable this setting | Employees can’t use Password Manager to save their passwords locally. | -| Do not configure this setting | Employees can choose whether to use Password Manager to save their passwords locally. | +| Enable setting (default) | Employees can use Password Manager to save their passwords locally. | +| Disable setting | Employees can’t use Password Manager to save their passwords locally. | +| Do not configure setting | Employees can choose whether to use Password Manager to save their passwords locally. | | ### Configure Pop-up Blocker @@ -195,9 +195,9 @@ This policy setting lets you decide whether employees can save their passwords l This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on. | If you… | Then… | | --- | --- | -| Enable this setting (default) | Pop-up Blocker is turned on, stopping pop-up windows from appearing. | -| Disable this setting | Pop-up Blocker is turned off, letting pop-up windows appear. | -| Do not configure this setting | Employees can choose whether to use Pop-up Blocker. | +| Enable setting (default) | Pop-up Blocker is turned on, stopping pop-up windows from appearing. | +| Disable setting | Pop-up Blocker is turned off, letting pop-up windows appear. | +| Do not configure setting | Employees can choose whether to use Pop-up Blocker. | | ### Configure search suggestions in Address bar @@ -206,9 +206,9 @@ This policy setting lets you decide whether to turn on Pop-up Blocker. By defaul This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable this setting | Employees can see search suggestions in the Address bar. | -| Disable this setting | Employees cannot see search suggestions in the Address bar. | -| Do not configure this setting (default) | Employees can choose whether search suggestions appear in the Address bar. | +| Enable setting | Employees can see search suggestions in the Address bar. | +| Disable setting | Employees cannot see search suggestions in the Address bar. | +| Do not configure setting (default) | Employees can choose whether search suggestions appear in the Address bar. | | ### Configure Start pages @@ -217,8 +217,8 @@ This policy setting lets you decide whether search suggestions appear in the Add This policy setting lets you configure one or more Start pages, for domain-joined devices. Your employees will not be able to change this after you set it. | If you… | Then… | | --- | --- | -| Enable this setting | You must include URLs to the pages, separating multiple pages by using angle brackets in this format:

`` | -| Disable or do not configure this setting (default) | The default Start page is the webpage specified in App settings. | +| Enable setting | You must include URLs to the pages, separating multiple pages by using angle brackets in this format:

`` | +| Disable or do not configure setting (default) | The default Start page is the webpage specified in App settings. | | ### Configure the Adobe Flash Click-to-Run setting @@ -228,7 +228,7 @@ This policy setting lets you decide whether employees must take action, such as | If you… | Then… | | --- | --- | | Enable or don’t configure this setting< | Employees must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content. | -| Disable this setting | Adobe Flash loads automatically and runs in Microsoft Edge. | +| Disable setting | Adobe Flash loads automatically and runs in Microsoft Edge. | | ### Configure the Enterprise Mode Site List @@ -237,8 +237,8 @@ This policy setting lets you decide whether employees must take action, such as This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps. | If you… | Then… | | --- | --- | -| Enable this setting | You must add the location to your site list in the **{URI}** box. When configured, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. | -Disable or do not configure this setting (default) | Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. | +| Enable setting | You must add the location to your site list in the **{URI}** box. When configured, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. | +Disable or do not configure setting (default) | Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. | | >[!Note] @@ -251,9 +251,9 @@ Disable or do not configure this setting (default) | Microsoft Edge won’t use This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on. | If you… | Then… | | --- | --- | -| Enable this setting | Windows Defender SmartScreen is turned on, and employees cannot turn it off. | -| Disable this setting | Windows Defender SmartScreen is turned off, and employees cannot turn it on. | -| Do not configure this setting | Employees can choose whether to use Windows Defender SmartScreen. | +| Enable setting | Windows Defender SmartScreen is turned on, and employees cannot turn it off. | +| Disable setting | Windows Defender SmartScreen is turned off, and employees cannot turn it on. | +| Do not configure setting | Employees can choose whether to use Windows Defender SmartScreen. | | ### Disable lockdown of Start pages @@ -265,8 +265,8 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | -| Enable this setting | You cannot lock down Start pages that are configured using the “Configure Start pages” setting. Employees can, therefore, modify the pages. | -| Disable or do not configure this setting (default) | Employees cannot change Start pages configured using the “Configure Start pages” setting. | +| Enable setting | You cannot lock down Start pages that are configured using the “Configure Start pages” setting. Employees can, therefore, modify the pages. | +| Disable or do not configure setting (default) | Employees cannot change Start pages configured using the “Configure Start pages” setting. | | ### Keep favorites in sync between Internet Explorer and Microsoft Edge @@ -278,8 +278,8 @@ This policy setting lets you decide whether people can sync their favorites betw [@Reviewer: what is the default: enable or disable?] --> | If you… | Then… | | --- | --- | -| Enable this setting | Employees can sync their favorites between Internet Explorer and Microsoft Edge.

Enabling this setting stops Edge favorites from syncing between connected Windows 10 devices. | -| Disable or do not configure this setting | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. | +| Enable setting | Employees can sync their favorites between Internet Explorer and Microsoft Edge.

Enabling this setting stops Edge favorites from syncing between connected Windows 10 devices. | +| Disable or do not configure setting | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. | | ### Prevent access to the about:flags page @@ -288,8 +288,8 @@ This policy setting lets you decide whether people can sync their favorites betw This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. | If you… | Then… | | --- | --- | -| Enable this setting | Employees cannot access the about:flags page. | -| Disable or do not configure this setting (default) | Employees can access the about:flags page. | +| Enable setting | Employees cannot access the about:flags page. | +| Disable or do not configure setting (default) | Employees can access the about:flags page. | | ### Prevent bypassing Windows Defender SmartScreen prompts for files @@ -298,8 +298,8 @@ This policy setting lets you decide whether employees can access the about:flags This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files. | If you… | Then… | | --- | --- | -| Enable this setting | Employees cannot ignore Windows Defender SmartScreen warnings when downloading files. | -| Disable or do not configure this setting (default) | Employees can ignore Windows Defender SmartScreen warnings and can continue the download process. | +| Enable setting | Employees cannot ignore Windows Defender SmartScreen warnings when downloading files. | +| Disable or do not configure setting (default) | Employees can ignore Windows Defender SmartScreen warnings and can continue the download process. | | ### Prevent bypassing Windows Defender SmartScreen prompts for sites >*Supported versions: Windows 10, version 1511 or later* @@ -307,8 +307,8 @@ This policy setting lets you decide whether employees can override the Windows D This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites. | If you… | Then… | | --- | --- | -| Enable this setting | Employees cannot ignore Windows Defender SmartScreen warnings and prevents them from continuing to the site. | -| Disable or do not configure this setting (default) | Employees can ignore Windows Defender SmartScreen warnings, allowing them to continue to the site. | +| Enable setting | Employees cannot ignore Windows Defender SmartScreen warnings and prevents them from continuing to the site. | +| Disable or do not configure setting (default) | Employees can ignore Windows Defender SmartScreen warnings, allowing them to continue to the site. | | ### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start @@ -317,8 +317,8 @@ This policy setting lets you decide whether employees can override the Windows D This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. | If you… | Then… | | --- | --- | -| Enable this setting | Microsoft Edge does not gather the Live Tile metadata, providing a minimal experience. | -| Disable or do not configure this setting (default) | Microsoft Edge gathers the Live Tile metadata, providing a fuller and complete experience. | +| Enable setting | Microsoft Edge does not gather the Live Tile metadata, providing a minimal experience. | +| Disable or do not configure setting (default) | Microsoft Edge gathers the Live Tile metadata, providing a fuller and complete experience. | | @@ -329,7 +329,7 @@ This policy setting lets you decide whether employees see Microsoft's First Run | If you… | Then… | | --- | --- | | Enable this settin | Employees do not see the First Run page. | -| Disable or do not configure this setting (default) | Employees see the First Run page. | +| Disable or do not configure setting (default) | Employees see the First Run page. | | ### Prevent using Localhost IP address for WebRTC @@ -338,8 +338,8 @@ This policy setting lets you decide whether employees see Microsoft's First Run This policy setting lets you decide whether localhost IP addresses are visible or hidden while making calls to the WebRTC protocol. | If you… | Then… | | --- | --- | -| Enable this setting | Localhost IP addresses are hidden. | -| Disable or do not configure this setting (default) | Localhost IP addresses are visible. | +| Enable setting | Localhost IP addresses are hidden. | +| Disable or do not configure setting (default) | Localhost IP addresses are visible. | | ### Send all intranet sites to Internet Explorer 11 @@ -348,8 +348,8 @@ This policy setting lets you decide whether localhost IP addresses are visible o This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable this setting | All intranet sites are opened in Internet Explorer 11 automatically. | -| Disable or do not configure this setting (default) | All websites, including intranet sites, open in Microsoft Edge. | +| Enable setting | All intranet sites are opened in Internet Explorer 11 automatically. | +| Disable or do not configure setting (default) | All websites, including intranet sites, open in Microsoft Edge. | | ### Set default search engine @@ -361,9 +361,9 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | -| Enable this setting | To set a default search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

`https://fabrikam.com/opensearch.xml` | -| Disable this setting | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market . | -| Do not configure this setting | The default search engine is set to the one specified in App settings. | +| Enable setting | To set a default search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

`https://fabrikam.com/opensearch.xml` | +| Disable setting | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market . | +| Do not configure setting | The default search engine is set to the one specified in App settings. | | >[!Important] >If you'd like your employees to use the default Microsoft Edge settings for each market , you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING. @@ -374,8 +374,8 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. | If you… | Then… | | --- | --- | -| Enable this setting | Employees see an additional page. | -| Disable or do not configure this setting (default) | No additional pages display. | +| Enable setting | Employees see an additional page. | +| Disable or do not configure setting (default) | No additional pages display. | | ## Using Microsoft Intune to manage your Mobile Device Management (MDM) settings for Microsoft Edge From 0943e65daeca3fd182ae64e02469b69c57559cd4 Mon Sep 17 00:00:00 2001 From: Eric Scherlinger <35633680+ericsche@users.noreply.github.com> Date: Tue, 20 Feb 2018 11:39:22 +0100 Subject: [PATCH 006/119] Update online-deployment-surface-hub-device-accounts.md Updated documentation for: new azure AD PowerShell module update 2 commands for Skype Improved prereq with download link. --- ...-deployment-surface-hub-device-accounts.md | 40 +++++++++++++------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index 6dc990e855..f8dd53e34e 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -25,7 +25,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow Be sure you have the right permissions set to run the associated cmdlets. ```PowerShell - Set-ExecutionPolicy Unrestricted + Set-ExecutionPolicy RemoteSigned $org='contoso.microsoft.com' $cred=Get-Credential admin@$org $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection @@ -70,37 +70,52 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow ``` 5. Connect to Azure AD. - + + You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : + + ```PowerShell + Install-Module -Name AzureAD + ``` You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. ```PowerShell - Connect-MsolService -Credential $cred + Import-Module AzureAD + Connect-AzureAD -Credential $cred ``` 6. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. ```PowerShell - Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -PasswordNeverExpires $true + Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration" ``` 7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#sfb-online). - Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant. + Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - Once you list out the SKUs, you can add a license using the `Set-MsolUserLicense` cmdlet. In this case, `$strLicense` is the SKU code that you see (for example, *contoso:STANDARDPACK*). + Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. ```PowerShell - Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -UsageLocation "US" - Get-MsolAccountSku - Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense + Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" + + Get-AzureADSubscribedSku | Select Sku*,*Units + $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense + $License.SkuId = SkuId You selected + + $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses + $AssignedLicenses.AddLicenses = $License + $AssignedLicenses.RemoveLicenses = @() + + Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses ``` 8. Enable the device account with Skype for Business. + If you do not have the Skype for Business Powershell module installed, you can download it [here](http://go.microsoft.com/fwlink/?LinkId=294688). - Start by creating a remote PowerShell session from a PC. ```PowerShell - Import-Module LyncOnlineConnector + Import-Module SkypeOnlineConnector $cssess=New-CsOnlineSession -Credential $cred Import-PSSession $cssess -AllowClobber ``` @@ -108,12 +123,13 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*): ```PowerShell - Get-CsOnlineUser -Identity ‘alice@contoso.com’| fl *registrarpool* + (Get-CsTenant).TenantPoolExtension ``` OR by setting a variable ```PowerShell - $strRegistrarPool = (Get-CsOnlineUser -Identity ‘alice@contoso.com’).RegistrarPool + $strRegistrarPool = (Get-CsTenant).TenantPoolExtension + $strRegistrarPool = $strRegistrarPool[0].Substring($strRegistrarPool[0].IndexOf(':') + 1) ``` - Enable the Surface Hub account with the following cmdlet: From 5f40eb058946949aca8ad3e340242ce65b603214 Mon Sep 17 00:00:00 2001 From: Eric Scherlinger <35633680+ericsche@users.noreply.github.com> Date: Tue, 20 Feb 2018 18:14:39 +0100 Subject: [PATCH 007/119] Update hybrid-deployment-surface-hub-device-accounts.md Updated for Azure AD plus optimized some commands --- ...-deployment-surface-hub-device-accounts.md | 117 +++++++++++------- 1 file changed, 72 insertions(+), 45 deletions(-) diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index 1281d6ae51..7eb0a87af9 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -38,11 +38,11 @@ Use this procedure if you use Exchange on-premises. -3. Enable the remote mailbox. +2. Enable the remote mailbox. Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet. - ```ps1 + ```PowerShell Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room ``` >[!NOTE] @@ -54,7 +54,7 @@ Use this procedure if you use Exchange on-premises. > >msExchRecipientTypeDetails = 8589934592 -2. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online. +3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online. 4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365. @@ -62,8 +62,8 @@ Use this procedure if you use Exchange on-premises. The next steps will be run on your Office 365 tenant. - ```ps1 - Set-ExecutionPolicy Unrestricted + ```PowerShell + Set-ExecutionPolicy RemoteSigned $cred=Get-Credential -Message "Please use your Office 365 admin credentials" $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection Import-PSSession $sess @@ -77,13 +77,13 @@ Use this procedure if you use Exchange on-premises. If you haven’t created a compatible policy yet, use the following cmdlet—-this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - ```ps1 + ```PowerShell $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false ``` Once you have a compatible policy, then you will need to apply the policy to the device account. - ```ps1 + ```PowerShell Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id ``` @@ -91,31 +91,44 @@ Use this procedure if you use Exchange on-premises. Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - ```ps1 + ```PowerShell Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!' ``` 7. Connect to Azure AD. + You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : + ```PowerShell + Install-Module -Name AzureAD + ``` + You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - ```ps1 - Connect-MsolService -Credential $cred + ```PowerShell + Import-Module AzureAD + Connect-AzureAD -Credential $cred ``` - 8. Assign an Office 365 license. The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. + + You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant. + Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - Once you list out the SKUs, you can add a license using the `Set-MsolUserLicense` cmdlet. In this case, `$strLicense` is the SKU code that you see (for example, *contoso:STANDARDPACK*). - - ```ps1 - Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -UsageLocation 'US' - Get-MsolAccountSku - Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense + ```PowerShell + Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" + + Get-AzureADSubscribedSku | Select Sku*,*Units + $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense + $License.SkuId = SkuId You selected + + $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses + $AssignedLicenses.AddLicenses = $License + $AssignedLicenses.RemoveLicenses = @() + + Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses ``` Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid). @@ -144,25 +157,25 @@ The following table lists the Office 365 plans and Skype for Business options. 1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment. - ```ps1 - Import-Module LyncOnlineConnector + ```PowerShell + Import-Module SkypeOnlineConnector $cssess=New-CsOnlineSession -Credential $cred Import-PSSession $cssess -AllowClobber ``` 2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - ```ps1 + ```PowerShell Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName ``` If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - ```ps1 + ```PowerShell Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool* ``` -2. Assign Skype for Business license to your Surface Hub account. +3. Assign Skype for Business license to your Surface Hub account. Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device. @@ -215,10 +228,10 @@ Use this procedure if you use Exchange online. Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets. - ```ps1 - Set-ExecutionPolicy Unrestricted + ```PowerShell + Set-ExecutionPolicy RemoteSigned $cred=Get-Credential -Message "Please use your Office 365 admin credentials" - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/ps1-liveid/ -Credential $cred -Authentication Basic -AllowRedirection + $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection Import-PSSession $sess ``` @@ -228,13 +241,13 @@ Use this procedure if you use Exchange online. If you're changing an existing resource mailbox: - ```ps1 + ```PowerShell Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) ``` If you’re creating a new resource mailbox: - ```ps1 + ```PowerShell New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) ``` @@ -246,13 +259,13 @@ Use this procedure if you use Exchange online. If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - ```ps1 + ```PowerShell $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false ``` Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. - ```ps1 + ```PowerShell Set-Mailbox 'HUB01@contoso.com' -Type Regular Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id Set-Mailbox 'HUB01@contoso.com' -Type Room @@ -264,7 +277,7 @@ Use this procedure if you use Exchange online. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - ```ps1 + ```PowerShell Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" ``` @@ -294,24 +307,38 @@ Use this procedure if you use Exchange online. 7. Connect to Azure AD. + You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : + + ```PowerShell + Install-Module -Name AzureAD + ``` You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - ```ps1 - Connect-MsolService -Credential $cred + ```PowerShell + Import-Module AzureAD + Connect-AzureAD -Credential $cred ``` 8. Assign an Office 365 license. The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. - Next, you can use `Get-MsolAccountSku` to retrieve a list of available SKUs for your O365 tenant. + Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - Once you list out the SKUs, you can add a license using the `Set-MsolUserLicense` cmdlet. In this case, `$strLicense` is the SKU code that you see (for example, *contoso:STANDARDPACK*). + Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - ```ps1 - Set-MsolUser -UserPrincipalName 'HUB01@contoso.com' -UsageLocation 'US' - Get-MsolAccountSku - Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense + ```PowerShell + Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" + + Get-AzureADSubscribedSku | Select Sku*,*Units + $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense + $License.SkuId = SkuId You selected + + $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses + $AssignedLicenses.AddLicenses = $License + $AssignedLicenses.RemoveLicenses = @() + + Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses ``` Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-premises](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid). @@ -323,22 +350,22 @@ In order to enable Skype for Business, your environment will need to meet the [p 1. Start by creating a remote PowerShell session to the Skype for Business online environment from a PC. - ``` - Import-Module LyncOnlineConnector + ```PowerShell + Import-Module SkypeOnlineConnector $cssess=New-CsOnlineSession -Credential $cred Import-PSSession $cssess -AllowClobber ``` 2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - ``` + ```PowerShell Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName ``` If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - ``` + ```PowerShell Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool* ``` @@ -368,7 +395,7 @@ For validation, you should be able to use any Skype for Business client (PC, And To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: -``` +```PowerShell Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName ``` @@ -383,7 +410,7 @@ In a hybrid Skype environment, you have to create the user on-premises first, th In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-premises](#exchange-on-premises) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-premises Skype server: -``` +```PowerShell Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName ``` From 4922fc4dfe824d5f398c913e1806d94aa3e8d858 Mon Sep 17 00:00:00 2001 From: Zach Dvorak Date: Tue, 20 Feb 2018 14:19:35 -0800 Subject: [PATCH 008/119] Update upgrade-readiness-additional-insights.md Removed a line due to policy change. --- .../deployment/upgrade/upgrade-readiness-additional-insights.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md index 5c45338c1d..858aed34fc 100644 --- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md +++ b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md @@ -18,7 +18,7 @@ This topic provides information on additional features that are available in Upg The site discovery feature in Upgrade Readiness provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. > [!NOTE] -> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. In addition, data will be collected on all sites visited by Microsoft Edge on computers running Windows 10 version 1803 (including Insider Preview builds) or newer. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. +> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. ### Install prerequisite security update for Internet Explorer From ea8569bf2862cd826e5823c10727c70845336c66 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 20 Feb 2018 22:26:50 +0000 Subject: [PATCH 009/119] Merge endpoints-typo to master --- windows/configuration/manage-windows-endpoints-version-1709.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/configuration/manage-windows-endpoints-version-1709.md b/windows/configuration/manage-windows-endpoints-version-1709.md index 1c52da910b..1ce981a341 100644 --- a/windows/configuration/manage-windows-endpoints-version-1709.md +++ b/windows/configuration/manage-windows-endpoints-version-1709.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high author: brianlic-msft -ms.author: brianlic-msft +ms.author: brianlic ms.date: 11/21/2017 --- # Manage Windows 10 connection endpoints @@ -318,7 +318,6 @@ If you turn off traffic for these endpoints, users won't be able to save documen | system32\Auth.Host.exe | HTTPS | outlook.office365.com | The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. -ently used documents. | Source process | Protocol | Destination | |----------------|----------|------------| From 5df2df1d76162ced61274a4d771d14e528bdbe3b Mon Sep 17 00:00:00 2001 From: Ryan Bijkerk Date: Wed, 21 Feb 2018 12:43:03 +0100 Subject: [PATCH 010/119] Update mandatory-user-profile.md The package also needs to be removed for all users otherwise the error will remain during the sysprep. --- windows/client-management/mandatory-user-profile.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index e77a3132db..675af55231 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -89,7 +89,7 @@ First, you create a default user profile with the customizations that you want, >![Microsoft Bing Translator package](images/sysprep-error.png) - >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/en-us/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. 5. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. From a58bfa63afd8b14dbfb378490db586926957f40f Mon Sep 17 00:00:00 2001 From: Michael Gruben-Trejo Date: Wed, 21 Feb 2018 06:53:25 -0800 Subject: [PATCH 011/119] Use Full Path for Security Options Previously, the path to "Security Options" was defined as `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options`. However, there is no such path. There is a path `Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options`, at which interactive logon settings may be found. Accordingly, add `Policies` to the path to complete the path. --- ...ve-logon-prompt-user-to-change-password-before-expiration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md index 86e3a1b15f..b32948c986 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -34,7 +34,7 @@ The **Interactive logon: Prompt user to change password before expiration** poli ### Location -Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options +Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options ### Default values From e8864b39a9690847886651ec8d97fab174112c61 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 21 Feb 2018 17:05:24 +0000 Subject: [PATCH 012/119] Merged PR 5953: Update link, ms.date, change history Surface Hub --- devices/surface-hub/change-history-surface-hub.md | 2 ++ .../hybrid-deployment-surface-hub-device-accounts.md | 2 +- .../online-deployment-surface-hub-device-accounts.md | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index efa2e4ddcf..b82d427482 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -21,6 +21,8 @@ This topic lists new and updated topics in the [Surface Hub Admin Guide]( surfac New or changed topic | Description --- | --- [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Updated instructions for custom settings using Microsoft Intune. +[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. +| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. ## January 2018 diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index 7eb0a87af9..de3ffd59ee 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 10/20/2017 +ms.date: 02/21/2018 ms.localizationpriority: medium --- diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index f8dd53e34e..6a314c317a 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 08/29/2017 +ms.date: 02/21/2018 ms.localizationpriority: medium --- @@ -110,7 +110,7 @@ If you have a pure, online (O365) deployment, then you can [use the provided Pow ``` 8. Enable the device account with Skype for Business. - If you do not have the Skype for Business Powershell module installed, you can download it [here](http://go.microsoft.com/fwlink/?LinkId=294688). + If the Skype for Business PowerShell module is not installed, [download the Skype for Business Online Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). - Start by creating a remote PowerShell session from a PC. From aff295986489ef8325cedafb8b67054ce6fe7e15 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Feb 2018 20:28:44 +0000 Subject: [PATCH 013/119] Merged PR 5958: New Display policies added to Policy CSP --- ...ew-in-windows-mdm-enrollment-management.md | 9 + .../policy-configuration-service-provider.md | 9 + .../mdm/policy-csp-display.md | 187 +++++++++++++++++- 3 files changed, 204 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 8fdf97effb..05aa518a5f 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1403,6 +1403,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware + +[Policy CSP](policy-configuration-service-provider.md) +

Added the following new policies for Windows 10, next major update:

+
    +
  • Display/DisablePerProcessDpiForApps
    • +
  • Display/EnablePerProcessDpi
    • +
  • Display/EnablePerProcessDpiForApps
    • +
      + [VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md)

      Updated the XSD and Plug-in profile example for VPNv2 CSP.

      diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 07dec60956..3791a903e5 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -943,6 +943,15 @@ The following diagram shows the Policy configuration service provider in tree fo ### Display policies
      +
      + Display/DisablePerProcessDpiForApps +
      +
      + Display/EnablePerProcessDpi +
      +
      + Display/EnablePerProcessDpiForApps +
      Display/TurnOffGdiDPIScalingForApps
      diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index fbfc7878d5..481bc438d3 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -6,12 +6,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 02/05/2018 --- # Policy CSP - Display +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
      @@ -19,6 +21,15 @@ ms.date: 01/30/2018 ## Display policies
      +
      + Display/DisablePerProcessDpiForApps +
      +
      + Display/EnablePerProcessDpi +
      +
      + Display/EnablePerProcessDpiForApps +
      Display/TurnOffGdiDPIScalingForApps
      @@ -28,6 +39,180 @@ ms.date: 01/30/2018
      +
      + + +**Display/DisablePerProcessDpiForApps** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      check mark4check mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + + + + + + + + + + + + + +
      + + +**Display/EnablePerProcessDpi** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      check mark4check mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
      + + + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until you log out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display (or any other display that has the same scale factor as that of the primary display). Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some unexpected behavior in some desktop applications that have Per-Process System DPI applied. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. + + + +The following list shows the supported values: + +- 0 - Disable. +- 1 - Enable. + + + + + + + + + + + +
      + + +**Display/EnablePerProcessDpiForApps** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      check mark4check mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + + + + + + + + + + + + +
      From 667bdfe3ed40c3655ede4cde1cae30f2d1d57a60 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 21 Feb 2018 13:56:23 -0800 Subject: [PATCH 014/119] added Failure audit recommendation for security group management --- .../auditing/audit-security-group-management.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 6f5966a3e8..20caac1504 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -31,9 +31,9 @@ This subcategory allows you to audit events generated by changes to security gro | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      We recommend Failure auditing, to collect information about failed attempts to create, change, or delete new security groups.| +| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      We recommend Failure auditing, to collect information about failed attempts to create, change, or delete new security groups.| +| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
      We recommend Failure auditing, to collect information about failed attempts to create, change, or delete new security groups.| **Events List:** From 68c0ed8af8ebefc736d8a48eb7d9c5757afea3e5 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 21 Feb 2018 14:04:05 -0800 Subject: [PATCH 015/119] added change history --- .../threat-protection/change-history-for-threat-protection.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md index 4fd99aa471..3355ac2827 100644 --- a/windows/security/threat-protection/change-history-for-threat-protection.md +++ b/windows/security/threat-protection/change-history-for-threat-protection.md @@ -17,6 +17,7 @@ This topic lists new and updated topics in the [Threat protection](index.md) doc New or changed topic | Description ---------------------|------------ [Security Compliance Toolkit](security-compliance-toolkit-10.md) | Added Office 2016 Security Baseline. +[Audi security group management](auditing/audit-security-group-management.md)| Added recommendation to audit Failure events. ## January 2018 |New or changed topic |Description | From 4d52270ef7bf28272a70dbc31d23344ff55500c1 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 21 Feb 2018 14:25:00 -0800 Subject: [PATCH 016/119] added change history --- .../threat-protection/change-history-for-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md index 3355ac2827..4c10382574 100644 --- a/windows/security/threat-protection/change-history-for-threat-protection.md +++ b/windows/security/threat-protection/change-history-for-threat-protection.md @@ -17,7 +17,7 @@ This topic lists new and updated topics in the [Threat protection](index.md) doc New or changed topic | Description ---------------------|------------ [Security Compliance Toolkit](security-compliance-toolkit-10.md) | Added Office 2016 Security Baseline. -[Audi security group management](auditing/audit-security-group-management.md)| Added recommendation to audit Failure events. +[Audit security group management](auditing/audit-security-group-management.md)| Added recommendation to audit Failure events. ## January 2018 |New or changed topic |Description | From b707e38276386b86d6d8d830c29609298df85bbd Mon Sep 17 00:00:00 2001 From: ashley-kim <35980531+ashley-kim@users.noreply.github.com> Date: Wed, 21 Feb 2018 15:45:20 -0800 Subject: [PATCH 017/119] Add Reporting and Insights added the third pillar of WUfB - reporting in Windows Analytics using telemetry --- windows/deployment/update/waas-manage-updates-wufb.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index e26cc352fc..231b414598 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -25,7 +25,7 @@ ms.date: 10/13/2017 > >In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. -Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines. +Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines. Windows Update for Business leverages Windows telemetry to provide reporting and insights into an organization's Windows 10 devices. Specifically, Windows Update for Business allows for: @@ -33,6 +33,7 @@ Specifically, Windows Update for Business allows for: - Selectively including or excluding drivers as part of Microsoft-provided updates - Integration with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. - Peer-to-peer delivery for Microsoft updates, which optimizes bandwidth efficiency and reduces the need for an on-site server caching solution. +- Control over telemetry level to provide reporting and insights in Windows Analytics. Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro Education, and Education. From 718eb8f492976ee7607443f51b2634521e348437 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 21 Feb 2018 17:03:32 -0800 Subject: [PATCH 018/119] added new bypass xml --- ...oy-windows-defender-application-control.md | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md index 1475541a41..be8ccb2590 100644 --- a/windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md +++ b/windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md @@ -147,6 +147,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -437,7 +438,18 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + + + + + @@ -480,6 +492,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -754,6 +767,14 @@ Microsoft recommends that you block the following Microsoft-signed applications + + + + + + + + From 494057030a7a36b49225852e27922765954e9e3a Mon Sep 17 00:00:00 2001 From: Zach Dvorak Date: Thu, 22 Feb 2018 11:40:26 -0800 Subject: [PATCH 019/119] Update upgrade-readiness-requirements.md Updating to indicate that UR works in all OMS regions. --- windows/deployment/upgrade/upgrade-readiness-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index aaea599116..023c8405c5 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -82,7 +82,7 @@ Before you get started configuring Upgrade Anatlyics, review the following tips **Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises. -**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in the Microsoft Operations Management Suite (OMS) portal. At the time this topic is being published, only OMS workspaces created in the East US and West Europe are supported. We’re adding support for additional regions and we’ll update this information when new international regions are supported. +**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in the Microsoft Operations Management Suite (OMS) portal. Upgrade Readiness is supported in all OMS regions; however, selecting an international OMS region does not prevent diagnostic data from being sent to and processed in Microsoft's secure data centers in the US. ### Tips From 0eef4033d6ee995f3c0e49281696a891d729e51e Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 22 Feb 2018 19:59:00 +0000 Subject: [PATCH 020/119] Merged PR 5975: Added another three codes to known fixes Added another three codes to known fixes, from a customer report. --- .../resolve-windows-10-upgrade-errors.md | 37 ++++++++++++++++++- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index 16de770ebb..d3d5edf9a2 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 01/26/2018 +ms.date: 02/22/2018 ms.localizationpriority: high --- @@ -657,7 +657,7 @@ For more information, see [How to perform a clean boot in Windows](https://suppo
      Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. -
      See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: +
      See the following general troubleshooting procedures associated with a result code of 0x800xxxxx:

      @@ -694,6 +694,39 @@ This error has more than one possible cause. Attempt [quick fixes](#quick-fixes) + + + + + - - - - - -
      + +
      Code +
      + +0x80073BC3 - 0x20009
      +0x8007002 - 0x20009
      +0x80073B92 - 0x20009 + +
      + +
      +
      Cause +
      + +The requested system device cannot be found, there is a sharing violation, or there are multiple devices matching the identification criteria. + +
      +      		 + + +
      Mitigation +
      + +These errors occur during partition analysis and validation, and can be caused by the presence of multiple system partitions. For example, if you installed a new system drive but left the previous system drive connected, this can cause a conflict. To resolve the errors, disconnect or temporarily disable drives that contain the unused system partition. You can reconnect the drive after the upgrade has completed. Alternatively, you can delete the unused system partition. + +
      +
      + + + +
      Code
      From 210971689632c35179eb65e24f6c5d9907da87fd Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 22 Feb 2018 23:57:57 +0000 Subject: [PATCH 021/119] Merged PR 5981: AssignedAccess CSP - added new settings and examples --- .../mdm/assignedaccess-csp.md | 607 +++++++++++++++++- .../mdm/assignedaccess-ddf.md | 87 ++- .../provisioning-csp-assignedaccess.png | Bin 16260 -> 9869 bytes ...ew-in-windows-mdm-enrollment-management.md | 22 +- 4 files changed, 687 insertions(+), 29 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index fb0f0a1d5b..99f4d3a1a1 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/03/2017 +ms.date: 02/22/2018 --- # AssignedAccess CSP @@ -70,6 +70,53 @@ Supported operations are Add, Get, Delete, and Replace. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies back (e.g. Start Layout). +**./Device/Vendor/MSFT/AssignedAccess/Status** +Added in Windows 10, version 1803. This read only polling node allows MDM server to query the current KioskModeAppRuntimeStatus as long as the StatusConfiguration node is set to “On” or “OnWithAlerts”. If the StatusConfiguration is “Off”, a node not found error will be reported to the MDM server. Click [link](#status-example) to see an example SyncML. [Here](#assignedaccessalert-xsd) is the schema for the Status payload. + +In Windows 10, version 1803, Assigned Access runtime status only supports monitoring single app kiosk mode. Here are the possible status available for single app kiosk mode. + +|Status |Description | +|---------|---------|---------| +| KioskModeAppRunning | This means the kiosk app is running normally. | +| KioskModeAppNotFound | This occurs when the kiosk app is not deployed to the machine. | +| KioskModeAppActivationFailure | This happens when the assigned access controller detects the process terminated unexpectedly after exceeding the max retry. | + +Note that status codes available in the Status payload correspond to a specific KioskModeAppRuntimeStatus. + + +|Status code | KioskModeAppRuntimeStatus | +|---------|---------| +| 1 | KioskModeAppRunning | +| 2 | KioskModeAppNotFound | +| 3 | KioskModeAppActivationFailure | + + +Additionally, the status payload includes a profileId, which can be used by the MDM server to correlate which kiosk app caused the error. + +Supported operation is Get. + +**./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** +Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. + +**./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration** +Added in Windows 10, version 1803. This node accepts a StatusConfiguration xml as input to configure the Kiosk App Health monitoring. There are three possible values for StatusEnabled node inside StatusConfiguration xml: On, OnWithAlerts, and Off. Click [link](#statusconfiguration-xsd) to see the StatusConfiguration schema. + +By default the StatusConfiguration node does not exist, and it implies this feature is off. Once enabled via CSP, Assigned Access will check kiosk app status and wait for MDM server to query the latest status from the Status node. + +Optionally, the MDM server can opt-in to the MDM alert so a MDM alert will be generated and sent immediately to the MDM server when the assigned access runtime status is changed. This MDM alert will contain the status payload that is available via the Status node. + +This MDM alert header is defined as follows: + +- MDMAlertMark: Critical +- MDMAlertType: "com.microsoft.mdm.assignedaccess.status" +- MDMAlertDataType: String +- Source: "./Vendor/MSFT/AssignedAccess" +- Target: N/A + +> [!Note] +> MDM alert will only be sent for errors. + + ## KioskModeApp examples KioskModeApp Add @@ -160,32 +207,29 @@ KioskModeApp Replace elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" + xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - - - - - - + + + + + - - - - - - - - - - - + + + + + + + + @@ -193,6 +237,10 @@ KioskModeApp Replace + + + + @@ -235,22 +283,64 @@ KioskModeApp Replace - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + ``` ## Example AssignedAccessConfiguration XML @@ -560,3 +650,480 @@ Example of the Delete command. ``` + +## StatusConfiguration XSD + +``` syntax + + + + + + + + + + + + + + + + + + + + +``` + +## StatusConfiguration example + +StatusConfiguration Add OnWithAlerts + +``` syntax + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + chr + + + + + OnWithAlerts + + ]]> + + + + + + +``` + + +StatusConfiguration Delete +``` syntax + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + + + + +``` + +StatusConfiguration Get + +``` syntax + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + + + + +``` + +StatusConfiguration Replace On + +```syntax + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + chr + + + + + On + + ]]> + + + + + + +``` + +## Status example + +Status Get +``` syntax + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/Status + + + + + + +``` + +## ShellLauncherConfiguration XSD + +``` syntax + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## ShellLauncherConfiguration examples + +ShellLauncherConfiguration Add +``` + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + +``` + +ShellLauncherConfiguration Add AutoLogon +``` + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + +``` + +ShellLauncherConfiguration Get +``` + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + + + + +``` + +## AssignedAccessAlert XSD + +```syntax + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 564378ac63..4d6da38792 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -7,12 +7,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/01/2017 +ms.date: 02/22/2018 --- # AssignedAccess DDF +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic shows the OMA DM device description framework (DDF) for the **AssignedAccess** configuration service provider. DDF files are used only with OMA DM provisioning XML. You can download the DDF files from the links below: @@ -20,7 +23,7 @@ You can download the DDF files from the links below: - [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, version 1803. ``` syntax @@ -48,7 +51,7 @@ The XML below is for Windows 10, version 1709. - com.microsoft/1.1/MDM/AssignedAccess + com.microsoft/2.0/MDM/AssignedAccess @@ -111,6 +114,84 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu + + Status + + + + + This read only node contains kiosk health event xml + + + + + + + + + + + + + + text/plain + + + + + ShellLauncher + + + + + + + + This node accepts a ShellLauncherConfiguration xml as input. Please check out samples and required xsd on MSDN. + + + + + + + + + + + + + + text/plain + + + + + StatusConfiguration + + + + + + + + This node accepts a StatusConfiguration xml as input. Please check out samples and required xsd on MSDN. + + + + + + + + + + + + + + text/plain + + + ``` diff --git a/windows/client-management/mdm/images/provisioning-csp-assignedaccess.png b/windows/client-management/mdm/images/provisioning-csp-assignedaccess.png index c8db9ee05950a8433af51bb4d0fd7e7375900567..b1ebee57d9d6b1070bfd6fee0dcf84691277910e 100644 GIT binary patch literal 9869 zcmb_?cU+Urwr&s=MWjiQt^uTj^bUfF^xmW+C`i}PJBmmLL+>a>YCxohs?tK2-UL1& z^d+k2niJ->U;Is5!Ucr%$XqQaFdXh5Cj6F}w}nAD)Z0f;_0SkA4OCa@j^sO%4PqkGXO3;BwtFCcII(RwVY^1%}m#r?V36G=u;RO=!R%i%`ji<#&cD>E0RCIEqk-_pZp z8@ybcnsDttd@`cAeGP`m>iLl~$UUi5frE{KEcGm}g&)BcfP4{ZK=Lri9Iax|BtDRO zx&Uw9b6R*)aB|ekl;xClu+}B)f&_scJg0{TU>CmGZ{b!t#~AmVX5X-AC3V2}NqkR7 z@)xu5K!NXb!DsG=Ye^coul4q~V(AuO*aZ;C?Mvv%D8e|viNT6b-8-^Qclb&UZ`$$^ zFhKJ*yg$PkHy5=r)9d}c(nca91!wkTJkml5UtOz($w~mR{9YYxpV~XRKvvaUsWB-zMlLLP?bU+W&s~F)E#>$zMH9on0M&H1APO7&(IYy0Y1C=Gt%CFtv8GtO1PUuOUv1P zO)ioVe2*GpwVn31*Q|=Z#$|m6Zp@{swjOnFt-;-jgX)uvsi(X_VV1_^_;L9ZN8u`$ z&+KWIIj=t%f*b^TeFyBEk#RV&CcC>ifd9xnYFnSL_$CL91@mJbY^=%I3ej2$7BpYW z73uHvISM=GHUH%_H_xGCXO=SR0a`Wy=WOJ%x_1fm;C}TFq|1`(n)KFH=@(De(wEs3 z=%W31Wu`1BmeXXab0p(O_-nqC6;-fMI){IQ56R{JvNWE-d(Q3mk)$Rmnr9r$XB0W( zRg+`Z*Zk_Tjhh zKr%%vUrLBXb>--kzvqt|xyR78RiGngv`JgSvA*;(PeoZ4qEY9$5eM^8RXT~qS;egr z&d0iD%sEfDlOdzyudPH5PJhef-OAVE52Xj);Wi#NeLNk}SifVj&6AK51@VXdb!$(} z@!zm*hn;fp|7Z#Frw){i3@z7&Nx-KhJ zc3sV-u0Be|!4YL^Co^3$E;^QILn!0qAyEX|Xge8rO7Efcvhr~7EP;!s$2c~ADb&Px zG?Gu-Aa?;vh%oepFO`1xEH|2e*_c^!Aezh~4!VT)(E)eJr5g21X zR@&&h>b1o$$uZil+kFDSxZ2E~70$BMx(R2dBCb3CJW%os!J*|9>Pl%Y_;e*~lA*BGuR55Qc{n{MHbxc=` zg8y`r9kMY)`s2J^aRB_VN1`aH`FhVb5g!7yxM=zte)Uyk`5`TM834mo;KW2lMPUz9 zOr3G9_0Mk2K^uQc?hhC;7U6@2U+JR5>piyo54Mp3J|3b0$?51vrnmXBj#}DOb{^A% z-ro}g#~i@6F~=LSXV_(p0dXbF@CV1{fa4UwjiFiI07qU55U2o89BfchRu%xjEMOG7 zDF$X@SniZx4bm=w;0wsb_^?@in(EGms zW*27C!;Pt$vC+{|(|YSBQp$UgBO`ilc)ti1K<{aRS<=`rk{+ABdwbLyB-R==v(hp? z=mnjApMat_s){q2;<>zm`aW0yc-O|t($?@n??p+ys6~{}5wpHti|Z@Y(Xz)RApvOI zS51NP!`|KK6~VIf`WIO2#?+!b9%%V0c=vG>NRte*Ueq6F{9ae(9tM=FNxm zLmRgOOp(^5w?Tp0fY`TO|9W&Dw=9={=pv0deYH@mvRH=)V!sOacv1^C@OjCt?%lIJ z!EA4Dzc>iAgMju>@L9KcB1z_{!Irg}qLx4Qh@`(Kqse6{8W{)zVIH7OZzrNgHV%3w zhJ1Nvq&HI3ZLFIO#0n2vw$05>Vad%v*qSE*miq~EIx=S7@Z!X9ON2pSuKPT=n9oRS z(AR4rteiV3z4k^#BsH3_%PAshFc3RFF!y7ybHIJ$;UtX|Dl} z$ZU_DtKFk3Vk#X}zHsW&QAQq~ekv-}$*G8&nE_%aIaq=UYrPBMG-a8_T3{xrW{HEJ zui}my=v-?d*&`j6-yc_EU&cFxsdK}$_Ns!}a=+Wsgbk%DTQNgT8R-m4(sdYDW~scs z+D#9jC+aIZ&!z7G(({QO?K7ZgkmfZo-@LiH>2|yc4;bTN&kW<&w^ZIvhnMqM$2o+x zhDzm(93X4_9Hcq-)e5hU<(qj8$|w)m;Rakk2SekqCze6yr|wuqCJv%_jZ%<9Fe183 zhnf8%xdnz;Fx`o}mCSsk$QYrWo{dbZ($O_aR^!J)g~Qlg%b*a2HIODTnCXh!(KFGP zdUl2h>%98V$Ym-c)@szP5`Lc_@Q&>+1{&%z5sylTCj+_e%H|HgPKMF~M9&7qcXY0T zP=P1~h`rO|QrTIQM+`BkLY!8~(uk6B)N@GbTjd&zJ0YaBJ1(Xe5sE-$G=j~ZOxR@% z>~{S8ILgDFI;<>=i{U)kvbk6Uned@}vZvq%#cIcx;Bi|j$6T93m}Kbw4@svxn?1LX zg`Y#aqnh2q=+iKtN4m=Q6z@1D^7N!tE>Y7-ZPjQX%F5E7;enn$Kr_oXWmowfT@bCI z-Y8aG28HpbVu!e?eqZmyTP`>8Kwc+OV_kK1yK_GN17T9}H*81qLisYr!b>2~cfnBlZ$SWl zat5L9N&(3FUf|zsct~;B)fIj?rxSRJge`Od!~mHLqP+wT`9-9KM(B4R$FaQG%^a%O zDn%etBCfx`dk1!{{{?gt=cp;~eZHwsdRhXY_Z^sa+#T3+@WpbJ)Lx@LgaJKCz-+?T z!6ElvpRYE3m?e}x_1bx7Oy*8&IbFsL$FdjWw*5cWde-*|*#J=&zebj$_W3+EdA1@o zJj|9M`Eypq4g2T_6Kj5E$puO3#N3niR~b%TNxQr-Tf>duVWB_cRNtbi8lrSW70^w7 z3w|vlbSi0VFyXD>h4RTJ=HE*bybewZ@()gpvxM_8Y3dnJXDW6l#5mKBmx(N-v0&y2 zN|h^4ScU(V7}<#0V|G%A3j51#_o`|2@Mfum_X~!$$u2tkaD^!3kRi8CvAo_IfE~Hn z3PTG3S~&J4wpc-KA%1?xKZCqj#Qq3Xhk;bS!27)ZDv`tH+g4Rs9Y+)Jq7#p zn`-|@ZNE5i1ymDa(6 zN%8GvEi#OBzqfO?i*ENQS;I34T#ScnXaF}kC zTub{=RGD3a%lY1rSws| zwjz%uin(E^=kRtQ06Q&|NZRmscH&1fhfhMK2906K*A#B_=t3STztPrxmNXTVK$Kv~ zp;8kgsp3_7Wr%oNca(JX{t5+k5|MGGe7#grsK%Ul@Jb;}r=T&Zto7EkF*Smc%M_nQ{)Z6nck)T9ikXPuXu2KbFYlA)GX(+=hs=%9|KTISdeP zh{*dhx#fx;X{iZB2vuL@`H~?oAt~t1MMrRP^l_>k!19^y8YpKpfrVI;{vO$gA<5LZc4^ieC1Xyj0~p(puU z+HG*Zr@T}yB90z1elwz|0rMvI19yq#%DZaz=VhT+GpmhkR4BGVZ7o!Y?^%=5qVsAR zP*c6UV{yOm-R|Q~_6ClI1kZdcybIX2o2VE^j%gXn`hG71j|g0bA7^W`tbRf>KMT)& zrj;PmX;fB4DSfejcoyS^1e3x{Q}!VzY|TLJC7)3%PoK z6zkSpUfG~=d225M7@(jnIOa-8MJ;*+n;OJrpdD;3(;)FhQ%~TCMgjg6nz%yOg{ zH(^VqpGTQm+wipDwmrX7gg_c}elj{zIUTzV%4>OqyX+i1*!S*bxnzou^`6dSL7E@l zPyz3WNGlMq3DsCs(xQnMSD|@Ib9y=!e#?Ge!rrH6g}stu(J;sh)RXYxu_E9b?aklr-Kz-tuPR&YvOAeSr5lzr%c8umbld*_S zm$IKtTBBUjapW_4Q%+r#?-*oss_y=CGy2D1QRt9VsfJBtx*e?zB(uudb$xtNxW;et zY;KMA4^E$sP0f1m4{fW4p%^NPLQSgFBCeRQV0!qzy3yqCihmv2S?lBu2A6$0r~{DY zV)nD0&A|Y#pMx4^r*j6*{?Zni-rLz8_N6-E35H*TS3Nx?VK#b$DjT`;cVL0u=ZF%w z*X@*eV@UVK2MJy(uk4?-&i&vqDh>4sIQ}pbg!pI5`!gK(4C!PWA?49d7*S?VDlSBJ-v16<1>)QpExv8OZjdpYgo}{!c6mp%U}*Tc zTEW5e4lMup=%<%`A{t(wiOMYBY8wME_<|y+CZj|}jam}<(%$zUJ&lEwHVg3_Z#>r< zn9Z=hndFZ!RzAtIbI)je&3|@U)q4T1hon{kMULuZUj1_D1jWlHQt3U`Xl{g+hH;1c z_Pg1qk$p7g?XL+V_P@wKzy7#n-0zL__XgPH5y+Q;kin}+3 zuRXcdw@BisJ14w0%{8o3%VtwdTTD1(x6usb#<~2rd&>yT=t!Jk0 zXSGz}wxJtz&#K&9g{oxqiPgEdW_NGM;rO{reoC!(W~98S1xg?-9w|ihfBZPNJ!X`L z?p}y~%A*NBiC$%4g-BcGW-l1;tz60pEk{E848jfj`jkD|+$TMwh)tCsfxid#Wx_n=*(?>_AYHAjbJx`$SThNxFu05xA_n|XRzoXVrYVj6d zJ0>3vyL=Hd`Qpaj5${+$Mz zY!siL_hAr;EI8L_QT7Pkmm#@mxf=H{gjo9YVE!1pVf^^#9z1GF8xe9^-4yVJ})I)5LK|jqCyIg>CF-02nKg;UnR~CQy}Y_lN^?EpG=%>}4@1=G8A0c)I{&1*p1A zh0xfFNlJ4`3?Gx3=~PblKDYZO53gY_X2`0dvu7E~_!5Ke3}N(s?(aX7j=zh4G3pdN zwY}FufP+C~JmteoKDeX179t`d7U|#H{GOa<0$wkme+=8nHI3DuSg@PVoKhtmTH0Y7 zb?rurIW^Q_Ty@1pud~D2267Yveg!cl-wFhH)PF!tvjC62CcYR)%eHosan=+>wbgQN zb%P-%=C$9MCtC?hBU9=S#T@hZ$P8z{`DqO$J}+;7)3t{DepFuhjNU#cY$@(Q>2G%K zqt09Gv-}TCJl$Tnf%Wq`$qDe29(0UGAx53r8T-Klb4PmA_vCJ!lSs4mNrtVpw7mHgbCnSqLv@!kKGzsqPW+!_RR5%%L8$+4 z`t_f723+6YU41$NU}7nwKhAU9HX#_Pxb8W6zGcVk?YULuTq=0VMMcMs~P6oXDdywAh-L%bDaq6_a^X_USh(!e@WP0{gF#*$+p* zkq;Qc49klvEY$W%s707>EYxi2)C~T>R#RDigv1ya!xilH#axtZPbAjo{m<>{Zn*E} zNifv|;mM8dvv7U>3|QD9TNZiEUU8%U)Y5#aNtR=8ysqnCFZ9Q+FxxuwI#1v?5CR?u z;K<1I$;D+746CjyJ#>(Hn1pi;7v0huhfx-=S`G1$civKP5Ai_iyp4>9{)`oOS z6sp(csv9iBL(}z*Gm+Rf;x$$uDy5|!Mw&!La!!b&-pwj7tVH?i#`S=s5OOzO3QLzQXv!hP(5+0mGE=IIoBGT`Wj29lXDtoYC}BDyKT7r$?14^ zn9HMo{^xKrCZ(l<1UuGySQci%Wz3pDPQ0 z{+DgBTQ!7?MDv_m;|ix;1ZQ@2hxPR8vWD^%n;WtszomUM4)d5KIcJw&!Ogy&Re~Ph zxYlE(BQksW2Np3pp_R@XNN#yQ(h}KYSmW5~S*zxdPZk3I&|W1Ub0! zVZ!VkV#)S#`Sxy2*KS zptgE8n>^o7>cPq%F-&JH3{y?qdzm41ALuJ0WC}j4v}~-a*VU3hd*RU zPG|6%n-+r;yCt*=HV!|EncH&9W@yM|g4-y(xZ-QsON)HUKPqP3K0})yRGhdLq5)yz zeLDMn7^v~k0+N2Q!_SsvO}sb9Yk(Ro&Hdx(%$?0X;qb>gyHv6k24U$ot@kX|pOqA2 zq^2uS%wwrTwdFd=lwLEI=?Mj}>Bju_(IW6dzO#beZ3ywr^JLJyX)nq{g<(E)N;{9z zek6dR%%d_)*oPb$S1Y$23Ds-#W!D@RGpr7kay0KAmP0S@XI}lQ>3GxFl;K+o&vR1X zj4Ss0G0*+jB{8#&{LZtf_O#`um3(~ENK9i~!80cC{?)>Juza;xa=5YJ>aulcgXH>e zs1oEjJ2s>(w;%!cZw9e8hMPzV(@1@fmbwn!0?^j(oEfo%nn=;A7})cDHl;>(d3>Y*XJC`i@@6e2?b+vQP^nS6^hikFWfvztUY zXQoptPJVc=_H*)0!QhT>-$n0plDST>l+cY=^b&XE=E53mq3S=Owx0jPCTu8v*(yYv zM>%g-neMPR&c&V=dRlNXp`K$(sy5Hi)kCY0^O6csZ3$cyxCb7qo{|uL<|U|YIU0~> z6iI0>9NUr`lzzK~3YfS+ZD4W`W)EJfmAQaO0?o)MRMn=Gq#fT!h#SqqBL*uBts#&0 z2VyV`+Bc~kbz^YSyZ>Ef5pdUaUY(_wXNKM8`Sbj5M#cYYxF7_0!JyfqNto_^!06~` zPXfiIKPGcG++;dpMDvaAwE!H^g@*z~*$|*W2$Zb;ob87Xe=r}Y!oK}O5AXhQ=R24? z|B~IO_WT(*bpIU6z^8FN8K_|=nC0;*H?LQfAH)or`>Q*|fPk(@`L*gKP(HetQAioB z;*!yqaM*qHc;dNZ3@>#v_I(~>8YSdob$#)`T*7YFdBQy~r|@&Q=Y|3rh(QHc0W1+x zLa#g;?Ysuz^)oQY?29*uBtIloSWA>MJ3s*x<9yi~^X_QzwC?ndX?Nu0@uEoFx7|bE zI+f_?`F2Z_l$ryjCQ$<;F%NmZ$FWUkq=-~`!!RquwIKYA-EE&4iIKm~0n9XZyRmIN ze+4p{i;NImK(5W^{@G^568dvpl#IvvltDj&C>el{GUqNPHjkyBZ2Bd*$C4HEu02V^ ziJ~f3Ql|H*rLKP;09RhIb-jIka5om_bE9-ITmzvOCfvIQv*vzmvs-JfhzNJ}Ku!av5 z-sIhr{dIn*1a)JQZo!e33Ym~f z8`m^um?_=HG%GI5gmrSg2x85nZ~fuMF*R~?YAgDOxt<0eJ$xzf0`}U&2TlXfmZ`pQ z`xI94)c^%2C?T}KkUEv3?o&4E7D2wB54BerpA;{LNdr&wraDEFzJcErZjAc zEy>Osk09@`nT!tWU$+(~@2%yWpiz)CRSDU)bnU49k(wOmk)TEIB-3Ea&j^s zBkO;L+n2?TTdj`AUm^l5yZjP7u4_UH&SeASfAg;h7&YsEHTvwEHF}Tef{5?|g<&jK3?9?X){XoHW{x@#UF3zm=-^^U>d^2)q#)^o{ zjQ2rgxV)?w3?wEb004lI5EoVi0Dk@Y*-!rc-?n%iRN^N9IVy??0&1qPPk#y^rUEho z06={#)Q3LkPZ`2aT*DCnfF1nr2Q+G1W&{B6VMquID7)!iZi4e8nPLHU#3J)XOwFkle zpv&E+dkRep$tA*JJxyMy3?~jDK(Utj2oA1r$-(qTPMK4@Cw;ZZb(AXr8-y#_3U59~x zC5)gE-ENsZ9v4T5UXwLAvtc2C005_Ta^gg(>8(xQ?pwFkPatKFnS?TDjZ>s=8@nt- zrfozBp~r!Xb9eBHMaZHJBH~)m{76j;IBdF}SLMJsc_qV``bv{))VJPQ--*Yp+WCz0 zI1;-8Aueg?T($W6vli%ZZk&?gIk;bwJ$#)l2oMi|_=}H`KD?JzrI;J*kdW?E5v%UR z=Esma3=J#ck|4QWXGe)`Qj1B;?$XjA?0a;xgO41-#uxr8J%2=a#?Jp2oTEs7;9UXc| z;SNqTmB}s?UDhm@imJw`WdtMtJcb=Iz#`4h#u=k6_?>IP$cH$UVv=JY5s7G!&w771 zIzHFHJ*CdT-FlD2i}0axvkJ_nt65SlAUmeHzeffgBZ7Rpk#m&L^vWz84xiYDqfZE~ z;$>i-LBwyr2PX+iDqf^v6cb9-j_dyNT0!DK^o0S3tjN!wQN|Mr-`t`LBqD#tzdi;J zZ1!$yK8|ndSYN6=$yAq*GWxvCvy&umQ&4PMXY^{O)+!ZcvrOfZa}zAPC^aTnl1w7@ z2;M3uvjPBLk+`zJn9-v6*2=s`s6gDFBY=<{40IJ14z{1Zq^@8 zL-CJ9a5XWnjDA)pjQH~2q(Qc?4hML-WZ3GscOgva`WqVnDTv$)aT==$<`ia<;ZYLk zUVmXj2wlm?NTd9F%tn}dkjfLE+$vmmx6iUbD)3qurbbrgg~Bi)p%&U_9A;*_!MAu{ zE9_>=hHkR@Pp#byIZeik=f^_Ws^~BBwBgH_hP0|1joI}cbay-NkMd{m+I!=A8T*>Y zb-a*isGE&C+OLfYAS4;Fa6?kq-LZMB@hB2tr=DNjl=3OkJ1kk6ukvm*sXd=;yx zhz1SHeP2g%OEX;F-pYEL>fb{~L;%etE*0?^i_6(g>M&3m3&H+aVbC4q)XcG(d}qiH znL9#MQlR6~BPAU50Kt$llUx5?LCaN}k0_`gxRDyQ*Mi#ycKzDz_}F%5?M{GjwPmy+?lMb4-&3@6iwGxqq?((8a+#91yJ|70ZQxGTnpw zW)aZo&p6r%cm9bHF+aR*8P!X*aK@y@%)^4Gdl;fVIO}pzhi(IP;Pubk}q<-O|e@sIW=7ld_oBK`X0nC)grZRFOhJ6(h-0 z2{x8EGWiT6Cq`&<1QssdJ{*q&gYVYO(eMo2qYn-ZmM4$uY`4`~#cS659cc2R1&*4W ztCatbn7Y0EwFY_gkO4z%AkJ{#57VqqvzB_#-gz(WjpR+ z{gG)T1v#nGm|bN#PSdGIcgz+wb({RFL=_9$Dq5MJzGK5%%~hodWjQ=^$8cb0;$z~{ zlJbeIti#Fc<{Xa2GH}2x1QRS3!zQ%0S3_mR7)IuPw^B+@z7A>1<0p7Rhbk{7Z9P7$2>KLG+@9dZx1q%bSCz8;ht_Bs5#{&F< zH@enb5ji9M1rzJVo%zXZ1svifsTn8v(IIoHW?7_=;hJL+Xw0mdTZHFwx^^Z?mny6@ zbj3BaH@Cq5^yLL{%!#y)N5(sF1y?=gTFjI-97S5e5czBQZMEG@xF~ zSn!Gc1tv0LKrfSUB{!PVl~3;DuvDm*p_`?fEKv&HahEcb7MV~PCt5A`Pi3;bU955j zT1(RtYpF4RpIv>Uaia(b(C0fgNXEg9E7vDKLq2al;JLPQ9ipL*Wg;=lpc({a{2X;_ zGec8wBqklIX|rXHGJw|kY~jcOEoaHS+LR=|*WR2vY>{D0j$s(W6)a)tdLSWF4;wwH zDC0LuKCd+M*N6&^vZJM1y41AYzMJz6*o_))@cZU!o`=Wb+y>Jydoh>luYElR>%=BW z;Zq1j(cKrJQ7^e6jfB>Qwm328ncf2j_}Z_Ue$F2N*4iWoGC+{a%rImop7wLHX0VZbDUDdVzsc&r&WWt!uQErQQQxH zCp+1uxfT^k&*NDiRbn;F_IZ4gA6(iJIuC#hc4)FAGK?yPh-e0$&lU@mJ46?I*LM;T z3BSlkAT_yF&{~RG=_S3L@bqs~NH_<#u|~9jo_vTntChWDsU61Ez-Tphf0%*;t8poT zmtJ3JMO~zzr^UXCZnzK&W!@rxX@=!H8jSDUirISbnGj_|RGm+`Q<`FNeV*pSsCRdN zXrV)d71mfAr0_Rf+D0LxGoKP_xe(U0uY){C42wr*Y1X?wPfCS)Wjp0 zxz6506nq`^^iY{Rj$Kk74e@UDnmLL!G%3%hfrv(dQrYj{6bbIv-L8$?P*ja>gSA!{ding2<654TqlHU ztlHyi6p{HmVCpBTkNvmDiBtRs1LJqJN47P~ysS@7QyFu>XH4YVvoQKpPFYzzEJwXr zbKToGaoQ(NVx-_K&r3GTQ`@RIuVG=z7$nj}u?dwQQc6^Isl-C_4=7NuIz@GeXqPTv z$@!8KhME+s-mF7!4x=OXM+p=SWSTD;_*ZFIZ$yYT6!(`(i&xH41SOa>>tdaC>O<~t zg)YaE<9$K=Aty~18!^iiVX2Unx^EYiqV>bIQxyM*j**}b96;Lo=% zNm7Ya2_y4Jj{Gmm!e6X#;VcC;I7BEPYUuF>0xx)gQGCfrXg)%;*aC@iP1?IgJ*%BV zK#h!H33{d~=qB1`E|AYi=WL-=c8|V|(mY$-(CpuU!74VS3UN&WMlTq3j-_lLtJL`d zC(p+r(?4uPu*d)>O&QC^rp1>@LkwlhF4-R}=}m6i7X|{ws=JPFRjYckT_45I)h==tEhmiq_NB5oEnYBZ!(&r?`1WJ;zJV24iYlbp zB=%1Qioa+k_fT1iHc!|jz@i2fMd<_Mhvi9C<0&(Ulf9e2uUc7@@ zU{%1GT2~|;;2ZCtj1FlKchKHD!|^w7JN&OR+9KNmliMf7TbFrGfOnMre`pgb&N#+p z!_4|3+`&&BxOXdSeiGh>o5cY{!`9~3XC+Utx;rX@L-N^XpM@8r9ULBoc z14x%EC#j+x-p)e`vw>D<#zE_%5JPW9qn?f3U0^VdFNOmtKMVB^Id#V(gKqw_HqaLn&7hq!Vo>s2?tc_|uT@9f^6raM{wp&hwi|IX=5F1Sv#2*5rWH?)q22LSl>e$k@; z^!JT94(#Ww|BGOUcI((1sa~!uS%jD_SfEU`W<-NoeH%T}*C>!L?}QlXN2CA)fHDzZ0RYGWhy!;+PXWCeYluPi zS}UraK5!C4cELkd9|%6y{?iyWa-cx`1=!j4W1bnOtQeO?wn8d<5yx<=-?8X#ej{2P zKDA&ui2(N_`!&aJoAA$gnNpUuvLgO2GGI6%XCIGviX{w9*4uex*X*I9sG|FE5+4b; z4++RTk1bghEhU^WUJwrSX}iJZz+b?sXa)GF)|>I7)9y^k>eVPr-|$Vwq!9N*rQYrn zlXszfiO$vlzT*5US$FY=ZDIiYMuE-qmdlhY8bUr;otYG`5UOm;nt6f>U++S8;%1PP zQnqV*bZZibhL2$k(a!gxh4zKGOA_N}q{M2MQ6lHh&n)8^0f1QWIsRI63v=q^jbJ$e z@piJ6C41Ggfusz@7!7EoSdiQ#@<+R;>kqVKFmh>IKEgAXVRIhG1}Yeco}iaILV?P< z*w|1oKQf>ztdr(=93WgC3gsc0) z%fNb0j-U!2`^$4HP~_9E5q{k~f?q0loo~)D(jW>*%c3H-QW~q|p;?!rvA5VlB9#;% zQrx0TD@jlL)z=r+x zwi~ptc6#BluO9w=?ys03Yijw{%Hr&bZ@N5XQ)cU9`PRyrtg%!{b+fWPWu_#+ctX}- zx`32|S9nIf-`UX$l`9FImE5;(cM}CuQ;!mN#I_QhF`HRc-aO&Cwl0(taIZS2Eo=M2 z%E6UCX1uMtchcTRGDQ7N2Xe%|MduJLwcu@foN~v2+@5xy`rWFYpjt5;QB&fbJ-5;* zo0`vB3-^R2gbyG0b00Q=%=_ZNE>?!b(ZCQrBs~%u_G-^m#LLObntUR`dt5Kavd#^3 zjQ;lcpXp#R(hk})H6ln6mXefGcTmme%ab>2PBCIN6C3QkCb3-;Af$tR?OVzL6ILxp zoUnjCZ*z{s84~!aqQpfrYbTxyI--l0xwGO6kjceLhHJ}f)(}sOY z>U2L&53Fm3?Vk5K|312CZFMad_qPPEwJh7JCwnFouFFO2oK;i0^Y+9{<2Z;THhi-8 zPdIM0#6904Q}bp1f-h^^u_j8B(NbhvI(>u|&C7n1?C{x14dkVs_raK-&X8pd{obi&|HOeX@)x!m zeRBA-9)@Kzmwv^}Je6@OIzoA^qMKA+%qX!{iw4Kjh7-v+38a)ps61d^TX7Hk$7q%?9|}?JQyQMM>-(cLpJK=K{)Ch%P87q1oo;X%2IE^ z?qCzjcCIZ}D6XJM<=5A>9d0LXOKj$lc~umVX-CGf35&8PDR;<#WVv}oyv8uRj#IT) zh%pGg50TJJj2LF5wd7}?W-Z(i?gnevfxa75%c`cO_e#sTIO4=!_h71Q&lrY=sK2$Z z!#=S^Gfb<>x``uiB!(FO4O@S-HO4n*WwA~8fOql7yY@veQ}=q^*V~sfLgd~LZZXwT zsPGLezB1t@nOxaToA3Ccv-B)V3q3#ETGYJ}i}qOi)JusD%o^{Cbz;^aFZWca+B=-w zTV*rYl4SHWMQOxCCZ++V%2M1yRfw~?PI6&s`@Va(=2pPU#AZ-O1nzpIk;v0y9dy^8 z=h6zuucx?{4f3&|U~eGzn(q2EaX-w2i8lsaN83}UfI+9#fQE)pW2{oE*4ms2bjA&; zvMqe8Rw82SySiWlzJG^?CRFAjXHm7yz}DDVtS}CF-FCOn7^GUa5Fwr+XlxG8HFYCc z?fFriFEji0DtbS}n&6y*hz)7HcRka0aL(hdAT9i*O#^?N0q?qzPn8<~-IGX3}PZsjnKl9r? zpZ@jfY1*>|&*&r?R$JSokS?A9Eb3C5zg zMhPcN7eVw=RN|!;Wjspdd5XW$wWiYKp=gU#7MH(Nii;GZX*6-#q5zK8kGqjjExPXC zl~R$nTa+x@5{tS%{3C=)4sa>#-|L`LevLO4pJ zAJPZNj@Kfxq&tGW#-GupVFu%8#Ge0FDvZ-r(IOuP=bXYgL_wQ~#M|YOrK6!lPC8GL zY37t|8%+Xo5h}>)s-#R%Kwkg2gQBH%ygU$-OHOr)3RaZNym8t0zO7!iY{V+IPC+#k z^B@7c4}m)nVZD_@Yf@eiTtc|o54{T!?U1_?Gd)-?iD1s)G*4`QZDQy_3Un7T+#J=& zD7>QbuRCOaWb5D> zqKz9T{>yN&K$yWE^U)LIrj))3<|5*+digUT&=R$Yl}XNOx8UzZ4_hvQQM;@YZ zm~q7doFq}Q_@e626YN9dbZb@2lQ@eMprS_;b~5~RYgNsdL8t|);|-z3NYu4j&7xku_saOcWdB&&77 zzmY+pajidui$#q!VGOllbfrp_`oT96d&|p!Opr!k(?BhN0XMb$m?tudLGVRqo zmIGHbTUX~~w@$ujrC}(L)Khbt<|Wx5FR`b+&rPO}e185+xqJ8ip@ndYV1S+5|1Q2s zP1j3k|<>|;yu1J51= z++6=$YphxQWb+k0Z_F3TvI!Fml*0rKiS>uoO8EPfdc@Il2^a9u>K8BA4ISA3(iuv^ zPD@(Q?`i)HN7#-O`kV>o003}v$YZ(D?r;hyh+IvMH5TtheMT$2b?sFl>Z{tUC##i3ix<0$?o!IbJH)O?!G@A@CcL}P5%FYu zwI8LFsU1JE18x!k<~y$ey}IerON3S_l*5wE()g8Ps9jZOLnpnF+1%_jz;1%X4-JHS z*OIIF0<4W5Sy250Y@xN^f%_VPb%y9* zy{0@s`9qMXKIjy^+S7Z~f51NIe#D3Bo)!QK$#!2D=E7+{iAldQU1K_~!pY-$!W2Ys!R6Ma}8?}Rht zAOOHj>HpH{{)f=jV7E|;u^ixtbHE!TL`*Pz406r0VhD{U#vcK=K?F7jxcx&Y4Cv9} zv%*+c7R(11$$BStA`Cj5h*Xb3Kx+y@zst(`hB| z0x^5sgXL<|l}&=^j_4LkzKmd^&aLRhP4#@en?3D%aXSqJ=msqU+FA4`4Sw}uO-lD> zCxe)ixK75A9Ft4IAJ0L_1Sw~>ZmDq;>QH5vz%dDBT3gWkF;#TX*U>#a(*<{~IFtQ@ z06QZ8wNxcR;Jd5Ozv54gQoWfddGK7{Sx`&kl&xGQEP|d_`>hB*n4qlGrke+ zJtUp&8*Q^p41-$l>Y<7MjEbNiNb*<#PK6C3KNiI;M(KDlW_FKj2ImdPm0Rzs{BWyj zMMS*3Df?BDpE0+=5?tz$m2^hq>yf>0tHvz0>u*Ak_DMV9n^qkUZ^Jn(OFC;?QC7cv z94oXK`vy+m$4|v{b+ZWGMiTqFe zXJN#VHfX_j_2=FUd;X#tb}a>y@vB%NBB(#w?-*uZSIz%ytJ?2)7QJr%goedztMEBy z7XGvKO5ye#zLe&xH5bU^1#n~iyze#(zmv(BGIQ-EDV8OSZ~x-vMynFlCbGh#6PU0Q z&tZVt8jBKa^>j8)t_Tuaad>6bKG!t_%AK=RH-r45+aU0pYi~rAIlcb6l9qd$O>(_< z;vB~MJ4K>KCA1L$qc;4K$Bz51Xxw8Sjxabr$H3(%*1jPx{}<}3jGV2|Bk>j;b~q<$ z-Y7XoZ2)QkhRg;V2}9MtjoKEATcd>F{oWwZEuYw)HuB(yb+b zFD!0@E@IW(NMSq&X^|v^tXupl+gx>>epCKZMrc_wW+@{FNa@|se}Z%aP2%cbpD#bj0hNTq8LEa zAVolVSS{3o0eHt6B@8}U^0=s=7+RB_!5?q7t-h^JI*eOuxZzDo=J!RCT%F*{L(Gnp z)w;?Sl*lPIUmpWax!1WD$BjPl30;1?MzO(d}nGtJ5 zzfcg_#%j@KFVsgY-GRF}k|`7*7d3-L$!1T@hr}qUFsp@YQ*qjvp9YmK=T}>$k{q~M z{sgf!N91a6Wa+FKWMMWoq3(BewCDPtSeXF(2H|=G@XuG@$|7wVICG0`X$&1Z7EOa=uY^#1KC+589|KE6yP>`*z{z(_{LeAQo&aAgQ~$sDXTZ zsuDQhc{>(YTgh96d8eKO+v1pWn_cq_*np~(NxO%B!{5|D2?<6z9~R$ns{FJhsLT5djj=Ptfay-s&we#OU+7TrTq$l|H%4$@h&Q;k8PA-ABAk$KJRBFsF?6 zsS*N$OHT9oWL56tae#*hz1l-p9ZW40W&~9{u#iJ7v}#9QOLhK zPB!BOxfr)aAp6EA!x8BT{xG0ZEU^7R7N^-rbAEDU=2jNMAJ`KjpkLj_N<8Q2LxFXp z_{$t{Qh+x9)0A3}8MdGBKcJic`Cwnaksu&w3h0v#eYzWzjg-Ka~vyJ(A%qg+>@&_ zP6hY#Qr_@&^F?P)jhCQ4;3?V3qjP5ev%%o^nk~wA z|GXv(9?6aTSFVfC^8@&;%fj$TE3dY?puXsL^~F_v?dJTk4p-;9wC<>7VJ=#A2j#nX z7*FT+o2B?rTp)A%KTpwDL<(ifNG1cp0IXqD zFE#UAiVR*aufxL`S<4(Z7=~V8we*55>d131|0^xYa&m4WzW!9{j zED2MhW~f-1d+Gn{ts+v)#?V`>2WvU4zC5qxUZqi$(5j}qqGFeAoF%(fa@Q@9VT*9t z#Xazs7sL9}L@i?((mxfP(Beh%3`-cTg;vSV-mb&8SZw4el0E$Fj&!|wQY8tkOz6&X zTLtb0e>HyMK*G*+1&g)bqm643D>2BLJtxT+27tN4_Y{%)$ZeFVI#ezKLq9Y#{6hik*H?RI@)6n{t!SsK4^`#U4VrCSDXng= zk+8Jz(8V)v`f1Fo`MJdH{jbZ$V|#yM{1`@`dWP0^VIufj~(a%QdWa=dbD<@!WaUd`p_h%Dx64r~Te#WlX|NApg{g*YuKD;Rr~AIUET!z~>M*HN@4oTgo0WM68h+(_j*{t+ze`8=TTv>5RAhDg zVO6KcmJuRAGN$Ucx)&M6eS^~N(+enHtA-tQkfy@T-Ga`(c}XDK+^N&eFske-v%Rp9 z{>IjY9AWhC$MOW2T`P%o7Pb-f80-Yrn?lBMawga1zmYy7eoR2e$uP6LqHg%b!*5Ge|*Ua#Me{w%3!zvWvy(D)GknQ0e}OCa|`^d7wd|Ucu`rG&M1$A-Q04 z9ubW+`MNEQabAMgNWLkkmGtz1u%y8GcqnLC?fe;Y-ml>Xt@rPBZ-)m(e;|~Av!0w? zFS6IuH5_4bDlaMAx8vyMLVM2=JfF8>uYlME>istZOcn!HnwPyVd!)LfUC4e$NP$)< z_Nq=!w%X@=(MU0T8*{VvRYz zVc*8YI3HKOLNZrqht>XHCfGi{s)HNlrHc%s)kU*5P5CTlc6tJu6D)QZGdSr6otcCr zPlgEaQ|1ViT9^&z5?_;fS2JFiYfd|L4LoH)^L_DZ!ir^)vUzgL0S6)0m(N3zf zxr4nBdnj_8E#IHV;*-Qm=a|1PbIWi$-b_M!&2)zsx^2 z`*YQbR2!f1_`7Rj5G@M06(OfSI`?9mv}Trjqu-Lvr9;JK7N@;|k)eLnVoJtbR^kJ+Y2^_oi;345t1)w7i(!R^QEXsu_hs>D<6-= zggm8iYy?!t>+zRNC?vAD<7{Go-t9_E1YG~zkzNnwe-phMtLEyhj#iVq#C-{7SLbe- zpz6osRivg{xN3<4Q&k(X(WHxJv~;DuW(MDycz%31i!}?2R?o-6ft?~stbnorX1Tf; zY5K0`oJ1s1VjL27@{+gXZ|8}=n-4wNmL#;}@_^&fHh2OH1EXHg^(pbI?d}><>M*GD zp4N1JVthyD4uWa)GT~}+(#^Q*j*4+@+F-s|?NG z44fM`)ExQskH4S5H;Algw)EuL&CUHG zh@?wz`gYQa3QcQ@HeqynCsxtj8Ih&5y4CMaVu!HkCAD-_LXz;kt&LG&Bb}QDjCgw_0dqgNWtzXX&FuktgjWA6^WKy|_uFhZspW0L6SUdN zkql04ss%=C>bjfvHj%MQpC~3dvl3~)w6;ZMfo%z`bW-}GXahZT+EZv`5EItcDUHYV)vHpflx61GITUTxmqn~OKA-*o)^+ja zMmt+^RZn?&599T`_pvo%t4If?&z}Ozi9Nf8AGv6J0?mVKpSs}KasEs9)6hY?Dt{Uy z;EFC%$B8VKZszPnm?LOeNXHVGGh21#m#@^XV#(5Ys2z@ceRM?6vCPKlnzs*e(BAxV z+WWPCNeM?JRL7q}*L>o@{JBSGed%b1_nP#X!9u%X=-7xp0%2|sm0wt82(8$ix+h$Q zJvyZ(X!rfLw65i=E+3e}jcYHTXadH3!l1#!uzLHvzK6<6$ACeb`4qbDyWVhU$jHd= zuJ1XPMD1w%v~4Vjbu?^EHg0-)LPCR!f>}J6jf90S(#AC&i+gGOdTUQ}v(*IS-iu(i zeU0w@#r~)Z&!jEBAAfoI=mQ!gTKmKa@*-1xi+=PlgN%97P|cT2LkQ09CJ_hn>MM`# zr`+qr3)GN*Z#LL!@&tQQkH;V#Fu>_za%x#-ZXYsr(_o>4b>e36>eck0Q>$8+k;NBl zdMRthVXxn#Ofks6bj^SCnJ$Ag?y0w3)~Jva95hQ-y$T+U5@@JDm|$5CSwyiBmP#KE zg*L~RZ)X`T)~V+n-n5Md^ zdiRSs{hN}v-ITY%8zs@ETGBkG=+tXbA*}{GG#GA}xaJ%qdv!-f%wUnbb1;!$iR^TnM-1%kYIv^?9AMeGh6u4A+BLWm|`#k_eadw zV1c`RnKN}EB_PZZqAb`Upg3})m`el+H`tJ1HDh&Aog{|%;x&|(su9lOnEZtb(v(vV z_R@QSdeV#trn17jx9V=Ts!rI|;6%nhD@pz=)#yY{`~rZeKqZ-@7~p22U)(gYCAACcTqYOaQl>~V>g5QZpl(blI810+gy5Mha zCG#vqPi#;#kNl( zzsLc51M{P~j)`Q_Ey+Wmzc8Xg@X%z7YS3P6s@f`>g>{7z{OMgmShFi> z5Y=a|w#77j+CPmbP_2$my~MPgcwB`H0dZ*k9q&Y1e z2|xAhCz}((2%FmG82Oi5>N=PFyLo_Sw9jE9p(rg@gpF5Um=;?<+^$|pCv$b$sluMv z_!5)oIF-nNZmb?Gr;1ezSN14~yqu1I$(2*vuweBvGz4RhdY<#`=xk7j5(!c$b-Vef`o`oA#X00xiig*;>hcUIBXvb z;*7g%2>!ty z1vl)cZCg!6N?&Odd^!093YX&M-?u~TbWixW!wWVKu`{!@$Ue>NLViY*REO1+IK$!V zU*{UzZcTG`%n7I>@w#wi=ESgo?jHi52gQhcKPjC0Xo#KbtqCt3AXoU;$1}7?qF`8G z;el4}H&eeB(_{1=xHXAnG;FL$;>`#P3+KU}My*+m;lkGw>2f*Uq>sASj<0tsXA zo}On63#Y#4FlOMeEat(BcYsb7nq?kVw8aJ1ix|2Vt7OrP6St`nFkTU^fx_BoZH2S= zeunDz4bl_PPWlfa=Z+E>;7m`<@op%1{@Sj|@MuR4jjr={8fq)3!mu7cb35Z4%kWn! zbGB;+`}sI$EFwZ-mp(Ccr50-tYUppwhK+fkYvE#~vj;cO{NcZ=&HAPyIETLMF6FP; z**Q45r6k_BsQpm$2&_jdcHmZDeQHG5=nzbiY0DEzfD_mc|D{xb2nvm0=>b}@^-!#e zA_}mwMz@V_IM{h)i&)Eg&xC6sNmH_4!X9%IQ&drLl#$!QT7k8;j7eOGaLuiL+p}6s zIiEz4{5w-uxR5mFoTBPP1{O0;N{2o2I?C(REg5N|aI*yq{r<#?9j*whrf|{b#>APk zR?J)2n?UwwWloGEzD+p`Bb$CAIls(O-1cI#0~v72jCqsI3;E-(pg4YdtUhs7w*ax` z#yY-PMeSF}o2V#cDg(15EnG?~#Y8%2X71eV+C`33jNrHm%RNH!TkB?zWR0dF8S?Or zy;ZA+vJ_s1XzuK|-9?Wu^4w;-jlzMYvu#=*5}or^^(Z)%sblbM*jon}1|ao_1~xtZ z22D8d7%oE}WihPw!o^G&v|V#*rXifs*9jQRsONS}KB<%n_+IDg`l@vBk(1WWqC9EV z!aTpu$)MLC$UXggKK8)*RSLDkZ<^SWJ;6*<-R@{G>?L$Cne6N0Fo2>P+t>x`0-rB$H;!lS0opOEV;h$ z{rSK%+VWnXF?cHBgLJz$|#aJAAQk=Sx5gM%^MShM*&kFgBVIrYI^ zo|#j74E;0y?(Qn{05CSTt$y&zE?rusG6K%X16!ev3{Crrr``=kIIyUvzt!2-JwEC; zhnD_^rqmjah!Vg$r;Tu4==8@Mryp2Cmov5_tJ}A4pKB%gMp-=^`_Ex@BKLAe)R7CM zAkePg9G95{N9^6Srq5#i*I6G_pSo4|kv*Qk%#c9*YMPI95{IQ{_Ii$cBU?}Ja4f5tWLhtysV!wrl;&q&wFMieRj84p=IGob7RR?R)nYw|-|};EwIsu`5qJ z1nVV3#N~YOsYOSsr#gL97OSFaM^s-&7`o4ijfA_)d=Xy{)It!zioYUwR9~b5lhGim z!P*s=v9!OsM-5Z$Vgu*|>^}w#>c%qJm=-IlG7uwo6^=&e*T@LrX(~Ij*Kfto(7=D> zM7JPi$5)TVj6`ERJgWCMuf=u~Yr1V{7;gVQ1SR3pr!D5@`le*>k9(DEg?np_m#p5N z>>KyDf$HPL#Kc~Yz(zv*q3y#FXZ*5@ozC?JU|4LvuT%Ea^IX{#kI3$0WyQN-Aw6pE zgGYwv=b>2N*vz(#x>QH9resernC~7;4KS2XPFvT=?Ni6&*ecBT{R4llnq@+$wa;^@ z%*9hJ*sap*Ep7~5x$$15&7s{@!XI7yaHr7P8mWLGMOk%fw(*h&6g?_cbbam3*US^- zKgN?9->udJe0b%*?|!4g*-OmSD$8r=@e8P$v&~s%<-#49$7*tNLQrh-_h9Q4N2ZCz znoT0i_iLobOG>*3y@L1fFrN1jH~ugqlI z<}F`77OeIQG)~&>PJ5fY-tVweq`jNHkBz$=mTb!+&mQf6IP@Om%j!uI$x9dD8i2hv zw=)z<&~VHIcI%tlRhut+`|#VI9^ll2Qv#jQNg_J<|BUahsIU~-`CnCZmtP&akSN+* z3g_+Avq-RP%!@*5tdrr47_67t(fqpGLCVW}g6rGn(lOr;JLtOlUfLTcr;)TM5%Kf| zw=NB93F~mnKEAloQv!zc?Z(OCtFy4~CN$AkL1(uT4NpfkaNh${nJk0KKYrcpYXGKF zKfkhCp#JPCe9A+=D|muju5PQ-=?17CE>H7nWSDEy^foPH3^D;WQ&K(RPf<3dmHL<&0$8 z$^rNy5_2R~g@L!mrfwO&%F2R*11GaY49U;eNNKb!I@{FufUTU8~kD^O^$OsB8{~RDV`fvJmQeX zXGF5>h!kDSdKjozo)7EGg72}@*Dz!Xq=#<+93HJ|9m}47>O3st}3@3s?x;A0Z(f8R{#QpH52~8nOphyo;7v zXjOex^deQmg2EX~?6t2yTziMbMY`VqGl}(ZY0X}i0%;1MTRSItYYg)$wo3yy z0gAD)!BVRTB*I%hhzu#z|6q~A^=tqP1i?Op$NV55>fIGHvk894>EZFFj){o}s-@<} zCS<_F$d^h8DB&=tv)~^3w%HUbGHfZM3rj=iEgI)t%x!fbG@rKD-e1l>_T)N%n!gNF z63PLx0)-rTe9_advYVh}`8M*}6dB6{hW#i;x5tKgF0%GF`hSMae+CMz!T;Zz`QM$I f|I-q5z!&(F#SXXuoQBO$?Enc8S>YPNKLP&_24g)z diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 05aa518a5f..6c82e08937 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1416,6 +1416,16 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md)

      Updated the XSD and Plug-in profile example for VPNv2 CSP.

      [AssignedAccess CSP](assignedaccess-csp.md)

      Added the following nodes in Windows 10, version 1803:

      +
        +
      • Status
        • +
      • ShellLauncher
        • +
      • StatusConfiguration
        • +
      +

      Updated the AssigneAccessConfiguration schema.

      +
      @@ -1435,7 +1445,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
      [Policy CSP](policy-configuration-service-provider.md)

      Added the following new policies for Windows 10, next major update:

      +

      Added the following new policies for Windows 10, version 1803:

      • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration
      • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold
        • @@ -1548,11 +1558,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
      [BitLocker CSP](bitlocker-csp.md)

      Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, next major update.

      +

      Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

      [DMClient CSP](dmclient-csp.md)

      Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, next major update:

      +

      Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

      • AADSendDeviceToken
      • BlockInStatusPage
        • @@ -1564,7 +1574,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
      [RemoteWipe CSP](remotewipe-csp.md)

      Added the following nodes in Windows 10, next major update:

      +

      Added the following nodes in Windows 10, version 1803:

      • AutomaticRedeployment
      • doAutomaticRedeployment
        • @@ -1574,11 +1584,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
      [Defender CSP](defender-csp.md)

      Added new node (OfflineScan) in Windows 10, next major update.

      +

      Added new node (OfflineScan) in Windows 10, version 1803.

      [UEFI CSP](uefi-csp.md)

      Added a new CSP in Windows 10, next major update.

      +

      Added a new CSP in Windows 10, version 1803.
      From df65cd750baab0c07cf301f4b44ed63b89a7a823 Mon Sep 17 00:00:00 2001 From: Dallin Hitchcock Date: Thu, 22 Feb 2018 18:26:59 -0700 Subject: [PATCH 022/119] Typo in Bootstrap.ini code Missing left bracket in Settings --- .../deploy-windows-mdt/create-a-windows-10-reference-image.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index 53297d9119..40c3fdf557 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -442,7 +442,7 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which 3. Click **Edit Bootstrap.ini** and modify using the following information: ``` syntax - Settings] + [Settings] Priority=Default [Default] DeployRoot=\\MDT01\MDTBuildLab$ From e22d5d6235b9ab2bdb4b89dfa64b0c705b77bcd8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 22 Feb 2018 20:29:07 -0800 Subject: [PATCH 023/119] update get client secret --- ...stom-ti-windows-defender-advanced-threat-protection.md | 4 ++-- ...ot-siem-windows-defender-advanced-threat-protection.md | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index 1e32ef16a7..85245a50ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -39,9 +39,9 @@ If your client secret expires or if you've misplaced the copy provided when you 3. Select your tenant. -4. Click **Application**, then select your custom threat intelligence application. The application name is **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). +4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). -5. Select **Keys** section, then provide a key description and specify the key validity duration. +5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index c384aeaa9e..f093a717e3 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -32,17 +32,17 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret -If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. +If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. 1. Login to the [Azure management portal](https://ms.portal.azure.com). -2. Select **Azure Active Directory**. +2. Select **Active Directory**. 3. Select your tenant. -4. Click **Application**, then select your SIEM tool application. The application name is `https://windowsdefenderatpsiemconnector`. +4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). -5. Select **Keys** section, then provide a key description and specify the key validity duration. +5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. From 5962c25a85417b59765e6e08fca345ec104d30ff Mon Sep 17 00:00:00 2001 From: modcaster Date: Fri, 23 Feb 2018 10:32:44 -0500 Subject: [PATCH 024/119] Updates for 20180223 --- devices/surface/change-history-for-surface.md | 1 + devices/surface/surface-dock-updater.md | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md index a12b0c33f7..a374627e4d 100644 --- a/devices/surface/change-history-for-surface.md +++ b/devices/surface/change-history-for-surface.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the Surface documentation library. |New or changed topic | Description | | --- | --- | +|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.12.136.0 information | |[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.46.0 information | ## January 2018 diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index eff1dae917..55d7b233dc 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -9,7 +9,7 @@ ms.mktglfcycl: manage ms.pagetype: surface, devices ms.sitesec: library author: brecords -ms.date: 11/03/2017 +ms.date: 02/23/2018 ms.author: jdecker --- @@ -116,6 +116,22 @@ Microsoft periodically updates Surface Dock Updater. To learn more about the app >[!Note] >Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater. +### Version 2.12.136.0 +*Release Date: 29 January 2018* + +This version of Surface Dock Updater adds support for the following: +* Update for Surface Dock Main Chipset Firmware +* Update for Surface Dock DisplayPort Firmware +* Improved display stability for external displays when used with Surface Book or Surface Book 2 + +Additionally, installation of this version of Surface Dock Updater on Surface Book devices includes the following: +* Update for Surface Book Base Firmware +* Added support for Surface Dock firmware updates with improvements targeted to Surface Book devices + +>[!Note] +>Before the Surface Dock firmware update applied by Surface Dock Updater v2.12.136.0 will take effect on a Surface Book device, a firmware update for the Surface Book Base is required. If you install Surface Dock Updater v2.12.136.0 on a Surface Book and update an attached Surface Dock from that same device, the firmware of the Surface Book Base will automatically be updated when installing the Surface Dock Updater. However, if you update a Surface Dock using Surface Dock Updater v2.12.136.0 on different device, and then connect that Surface Dock to a Surface Book where Surface Dock Updater v2.12.136.0 has not been installed, the benefits of the updated Surface Dock will not be enabled. To enable the benefits of the updated Surface Dock on a Surface Book device, Surface Book Base firmware must also be updated by installing Surface Dock Updater v2.12.136.0 on the Surface Book device. Surface Book Base firmware update is not required on a Surface Book 2 device. + + ### Version 2.9.136.0 *Release date: November 3, 2017* From 59cc347566df8911e125d34dd8e5f3e43a773905 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 23 Feb 2018 10:28:04 -0800 Subject: [PATCH 025/119] revert siem. keep custom ti --- ...t-siem-windows-defender-advanced-threat-protection.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index f093a717e3..22c3aaa87e 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -32,22 +32,23 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret -If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. +If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. 1. Login to the [Azure management portal](https://ms.portal.azure.com). -2. Select **Active Directory**. +2. Select **Azure Active Directory**. 3. Select your tenant. -4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). +4. Click **App registrations** > **All apps**, then select your SIEM tool application. The application name is `https://windowsdefenderatpsiemconnector`. -5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. +5. Select **Keys** section, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. 7. Copy the value and save it in a safe place. + ## Error when getting a refresh access token If you encounter an error when trying to get a refresh token when using the threat intelligence API or SIEM tools, you'll need to add reply URL for relevant application in Azure Active Directory. From 91a73879399523bda835067ce4153e082e330f1e Mon Sep 17 00:00:00 2001 From: ashley-kim <35980531+ashley-kim@users.noreply.github.com> Date: Fri, 23 Feb 2018 10:33:11 -0800 Subject: [PATCH 026/119] Update waas-manage-updates-wufb.md --- windows/deployment/update/waas-manage-updates-wufb.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 231b414598..88a40b5473 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -25,7 +25,7 @@ ms.date: 10/13/2017 > >In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. -Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines. Windows Update for Business leverages Windows telemetry to provide reporting and insights into an organization's Windows 10 devices. +Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines. Windows Update for Business leverages diagnostic data to provide reporting and insights into an organization's Windows 10 devices. Specifically, Windows Update for Business allows for: @@ -33,7 +33,7 @@ Specifically, Windows Update for Business allows for: - Selectively including or excluding drivers as part of Microsoft-provided updates - Integration with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. - Peer-to-peer delivery for Microsoft updates, which optimizes bandwidth efficiency and reduces the need for an on-site server caching solution. -- Control over telemetry level to provide reporting and insights in Windows Analytics. +- Control over diagnostic data level to provide reporting and insights in Windows Analytics. Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro Education, and Education. From 5f2bf4e7568d05699742507f62da20acf6979336 Mon Sep 17 00:00:00 2001 From: shortpatti Date: Fri, 23 Feb 2018 14:09:39 -0800 Subject: [PATCH 027/119] fixed a typo and verified that Edge is preceeded with Microsoft --- browsers/edge/available-policies.md | 179 ++++++++++++---------------- 1 file changed, 74 insertions(+), 105 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 70d288c5d8..4a826a8f59 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -38,9 +38,8 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. | If you... | Then... | | --- | --- | -| Enable setting (default) | Employees can see the Address bar drop-down functionality in Microsoft Edge. | -| Disable setting | Employees do not see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type."

      Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting. | -| +| Enable (default) | Employees can see the Address bar drop-down functionality in Microsoft Edge. | +| Disable | Employees do not see the Address bar drop-down functionality in Microsoft Edge. This setting also disables the user-defined setting, "Show search and site suggestions as I type."

      Disabling this setting turns off the Address bar drop-down functionality. Therefore, because search suggestions are shown in the drop-down, this setting takes precedence over the "Configure search suggestions in Address bar" setting. | ### Allow Adobe Flash >*Supporteded version: Windows 10* @@ -48,9 +47,8 @@ This policy setting lets you decide whether the Address bar drop-down functional This policy setting lets you decide whether employees can run Adobe Flash on Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable or don’t configure this setting (default) | Employees can use Adobe Flash. | -| Disable setting | Employees cannot use Adobe Flash. | -| +| Enable or don’t configure (default) | Employees can use Adobe Flash. | +| Disable | Employees cannot use Adobe Flash. | ### Allow clearing browsing data on exit >*Supporteded versions: Windows 10, version 1703* @@ -58,9 +56,8 @@ This policy setting lets you decide whether employees can run Adobe Flash on Mic This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes. | If you… | Then… | | --- | --- | -| Enable setting | Clear browsing history on exit is turned on. | -| Disable or don’t configure this setting (default) | Employees can turn on and configure the Clear browsing data option under Settings. | -| +| Enable | Clear browsing history on exit is turned on. | +| Disable or don’t configure (default) | Employees can turn on and configure the Clear browsing data option under Settings. | ### Allow Developer Tools >*Supporteded versions: Windows 10, version 1511 or later* @@ -68,19 +65,17 @@ This policy setting allows the automatic clearing of browsing data when Microsof This policy setting lets you decide whether F12 Developer Tools are available on Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable setting (default) | F12 Developer Tools are available. | -| Disable setting | F12 Developer Tools are not available. | -| +| Enable (default) | F12 Developer Tools are available. | +| Disable | F12 Developer Tools are not available. | ### Allow Extensions >*Supporteded versions: Windows 10, version 1607 or later* -This policy setting lets you decide whether employees can use Edge Extensions. +This policy setting lets you decide whether employees can use Microsft Edge Extensions. | If you… | Then… | | --- | --- | -| Enable setting | Employees can use Edge Extensions. | -| Disable setting | Employees cannot use Edge Extensions. | -| +| Enable | Employees can use Microsoft Edge Extensions. | +| Disable | Employees cannot use Microsoft Edge Extensions. | ### Allow InPrivate browsing >*Supporteded versions: Windows 10, version 1511 or later* @@ -88,9 +83,8 @@ This policy setting lets you decide whether employees can use Edge Extensions. This policy setting lets you decide whether employees can browse using InPrivate website browsing. | If you… | Then… | | --- | --- | -| Enable setting (default) | Employees can use InPrivate website browsing. | -| Disable setting | Employees cannot use InPrivate website browsing. | -| +| Enable (default) | Employees can use InPrivate website browsing. | +| Disable | Employees cannot use InPrivate website browsing. | ### Allow Microsoft Compatibility List >*Supporteded versions: Windows 10, version 1607 or later* @@ -98,9 +92,8 @@ This policy setting lets you decide whether employees can browse using InPrivate This policy setting lets you decide whether to use the Microsoft Compatibility List (a Microsoft-provided list that helps sites with known compatibility issues to display properly) in Microsoft Edge. By default, the Microsoft Compatibility List is enabled and can be viewed by visiting about:compat. | If you… | Then… | | --- | --- | -| Enable setting (default) | Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation . Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site renders as though it’s in whatever version of IE is necessary for it to appear properly. | -| Disable setting | Browser navigation does not use the Microsoft Compatibility List. | -| +| Enable (default) | Microsoft Edge periodically downloads the latest version of the list from Microsoft, applying the updates during browser navigation . Visiting any site on the Microsoft Compatibility List prompts the employee to use Internet Explorer 11, where the site renders as though it’s in whatever version of IE is necessary for it to appear properly. | +| Disable | Browser navigation does not use the Microsoft Compatibility List. | ### Allow search engine customization >*Supported versions: Windows 10, version 1703* @@ -111,9 +104,8 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | -| Enable or don’t configure this setting (default) | Employees can add new search engines and change the default used in the Address bar from within Microsoft Edge Settings. | -| Disable setting | Employees cannot add search engines or change the default used in the Address bar. | -| +| Enable or don’t configure (default) | Employees can add new search engines and change the default used in the Address bar from within Microsoft Edge Settings. | +| Disable | Employees cannot add search engines or change the default used in the Address bar. | ### Allow web content on New Tab page >*Supported versions: Windows 10* @@ -121,10 +113,9 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it. | If you… | Then… | | --- | --- | -| Enable setting | Microsoft Edge opens a new tab with the New Tab page. | -| Disable setting | Microsoft Edge opens a new tab with a blank page. | -| Do not configure setting (default) | Employees can choose how new tabs appear. | -| +| Enable | Microsoft Edge opens a new tab with the New Tab page. | +| Disable | Microsoft Edge opens a new tab with a blank page. | +| Do not configure (default) | Employees can choose how new tabs appear. | ### Configure additional search engines >*Supported versions: Windows 10, version 1703* @@ -132,9 +123,8 @@ This policy setting lets you configure what appears when Microsoft Edge opens a This policy setting lets you add up to 5 additional search engines, which cannot be removed by your employees but can make a personal default engine. This setting does not set the default search engine. For that, you must use the "Set default search engine" setting. | If you… | Then… | | --- | --- | -| Enable setting | You can add up to 5 additional search engines. For each additional search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

      ``

      For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable setting (default) | Any added search engines are removed from the employee’s device. | -| Do not configure setting | The search engine list is set to what is specified in App settings. | -| +| Enable | You can add up to 5 additional search engines. For each additional search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

      ``

      For more info about creating the OpenSearch XML file, see the [Understanding OpenSearch Standards](https://msdn.microsoft.com/en-us/library/dd163546.aspx) topic. | Disable setting (default) | Any added search engines are removed from the employee’s device. | +| Do not configure | The search engine list is set to what is specified in App settings. | ### Configure Autofill >*Supported versions: Windows 10* @@ -142,10 +132,9 @@ This policy setting lets you add up to 5 additional search engines, which cannot This policy setting lets you decide whether employees can use Autofill the form fields automatically while using Microsoft Edge. By default, employees can choose whether to use Autofill. | If you… | Then… | | --- | --- | -| Enable setting | Employees can use Autofill to populate form fields automatically. | -| Disable setting | Employees cannot use Autofill to populate form fields automatically. | -| Do not configure setting (default) | Employees can choose whether to use Autofill to populate the form fields automatically. | -| +| Enable | Employees can use Autofill to populate form fields automatically. | +| Disable | Employees cannot use Autofill to populate form fields automatically. | +| Do not configure (default) | Employees can choose whether to use Autofill to populate the form fields automatically. | ### Configure cookies >*Supported versions: Windows 10* @@ -153,9 +142,8 @@ This policy setting lets you decide whether employees can use Autofill the form This setting lets you configure how to work with cookies. | If you… | Then… | | --- | --- | -| Enable setting (default) | You must also decide whether to:

      • **Allow all cookies (default)** from all websites.
      • **Block all cookies** from all websites.
      • **Block only 3rd-party cookies** from 3rd-party websites.
      | -| Disable or do not configure setting | All cookies are allowed from all sites. | -| +| Enable (default) | You must also decide whether to:
      • **Allow all cookies (default)** from all websites.
      • **Block all cookies** from all websites.
      • **Block only 3rd-party cookies** from 3rd-party websites.
      | +| Disable or do not configure | All cookies are allowed from all sites. | ### Configure Do Not Track >*Supported versions: Windows 10* @@ -163,10 +151,9 @@ This setting lets you configure how to work with cookies. This policy setting lets you decide whether employees can send Do Not Track requests to websites that ask for tracking info. By default, Do Not Track requests are never sent, but employees can choose to turn on and send requests. | If you… | Then… | | --- | --- | -| Enable setting | Do Not Track requests are always sent to websites asking for tracking information. | -| Disable setting | Do Not Track requests are never sent to websites asking for tracking information. | -| Do not configure setting (default) | Employees can choose whether to send Do Not Track requests to websites asking for tracking information. | -| +| Enable | Do Not Track requests are always sent to websites asking for tracking information. | +| Disable | Do Not Track requests are never sent to websites asking for tracking information. | +| Do not configure (default) | Employees can choose whether to send Do Not Track requests to websites asking for tracking information. | ### Configure Favorites >*Supported versions: Windows 10, version 1511 or later* @@ -174,9 +161,8 @@ This policy setting lets you decide whether employees can send Do Not Track requ This policy setting lets you configure the default list of Favorites that appear for your employees. Employees can change their Favorites by adding or removing items at any time. | If you… | Then… | | --- | --- | -| Enable setting | You must provide a list of Favorites in the Options section. The list imports automatically after you deploy this policy. | -| Disable or do not configure setting | Employees will see the Favorites that they set in the Favorites hub. | -| +| Enable | You must provide a list of Favorites in the Options section. The list imports automatically after you deploy this policy. | +| Disable or do not configure | Employees will see the Favorites that they set in the Favorites hub. | ### Configure Password Manager >*Supported versions: Windows 10* @@ -184,10 +170,9 @@ This policy setting lets you configure the default list of Favorites that appear This policy setting lets you decide whether employees can save their passwords locally, using Password Manager. By default, Password Manager is turned on. | If you… | Then… | | --- | --- | -| Enable setting (default) | Employees can use Password Manager to save their passwords locally. | -| Disable setting | Employees can’t use Password Manager to save their passwords locally. | -| Do not configure setting | Employees can choose whether to use Password Manager to save their passwords locally. | -| +| Enable (default) | Employees can use Password Manager to save their passwords locally. | +| Disable | Employees can’t use Password Manager to save their passwords locally. | +| Do not configure | Employees can choose whether to use Password Manager to save their passwords locally. | ### Configure Pop-up Blocker >*Supported versions: Windows 10* @@ -195,10 +180,9 @@ This policy setting lets you decide whether employees can save their passwords l This policy setting lets you decide whether to turn on Pop-up Blocker. By default, Pop-up Blocker is turned on. | If you… | Then… | | --- | --- | -| Enable setting (default) | Pop-up Blocker is turned on, stopping pop-up windows from appearing. | -| Disable setting | Pop-up Blocker is turned off, letting pop-up windows appear. | -| Do not configure setting | Employees can choose whether to use Pop-up Blocker. | -| +| Enable (default) | Pop-up Blocker is turned on, stopping pop-up windows from appearing. | +| Disable | Pop-up Blocker is turned off, letting pop-up windows appear. | +| Do not configure | Employees can choose whether to use Pop-up Blocker. | ### Configure search suggestions in Address bar >*Supported versions: Windows 10* @@ -206,10 +190,9 @@ This policy setting lets you decide whether to turn on Pop-up Blocker. By defaul This policy setting lets you decide whether search suggestions appear in the Address bar of Microsoft Edge. By default, employees can choose whether search suggestions appear in the Address bar of Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable setting | Employees can see search suggestions in the Address bar. | -| Disable setting | Employees cannot see search suggestions in the Address bar. | -| Do not configure setting (default) | Employees can choose whether search suggestions appear in the Address bar. | -| +| Enable | Employees can see search suggestions in the Address bar. | +| Disable | Employees cannot see search suggestions in the Address bar. | +| Do not configure (default) | Employees can choose whether search suggestions appear in the Address bar. | ### Configure Start pages >*Supported versions: Windows 10, version 1511 or later* @@ -217,9 +200,8 @@ This policy setting lets you decide whether search suggestions appear in the Add This policy setting lets you configure one or more Start pages, for domain-joined devices. Your employees will not be able to change this after you set it. | If you… | Then… | | --- | --- | -| Enable setting | You must include URLs to the pages, separating multiple pages by using angle brackets in this format:

      `` | -| Disable or do not configure setting (default) | The default Start page is the webpage specified in App settings. | -| +| Enable | You must include URLs to the pages, separating multiple pages by using angle brackets in this format:

      `` | +| Disable or do not configure (default) | The default Start page is the webpage specified in App settings. | ### Configure the Adobe Flash Click-to-Run setting >*Supported versions: Windows 10, version 1703* @@ -227,9 +209,8 @@ This policy setting lets you configure one or more Start pages, for domain-joine This policy setting lets you decide whether employees must take action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | If you… | Then… | | --- | --- | -| Enable or don’t configure this setting< | Employees must click the content, click a Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content. | -| Disable setting | Adobe Flash loads automatically and runs in Microsoft Edge. | -| +| Enable or don’t configure | Employees must click the content, click the Click-to-Run button, or have the site appear on an auto-allow list before Microsoft Edge loads and runs Adobe Flash content. | +| Disable | Adobe Flash loads automatically and runs in Microsoft Edge. | ### Configure the Enterprise Mode Site List >*Supported versions: Windows 10* @@ -237,9 +218,8 @@ This policy setting lets you decide whether employees must take action, such as This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps. | If you… | Then… | | --- | --- | -| Enable setting | You must add the location to your site list in the **{URI}** box. When configured, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. | -Disable or do not configure setting (default) | Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. | -| +| Enable | You must add the location to your site list in the **{URI}** box. When configured, Microsoft Edge looks for the Enterprise Mode Site List XML file, which includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. | +Disable or do not configure (default) | Microsoft Edge won’t use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. | >[!Note] >If there is a .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server has a different version number than the version in the cache container, the server file is used and stored in the cache container.

      @@ -251,10 +231,9 @@ Disable or do not configure setting (default) | Microsoft Edge won’t use the E This policy setting lets you configure whether to turn on Windows Defender SmartScreen. Windows Defender SmartScreen provides warning messages to help protect your employees from potential phishing scams and malicious software. By default, Windows Defender SmartScreen is turned on. | If you… | Then… | | --- | --- | -| Enable setting | Windows Defender SmartScreen is turned on, and employees cannot turn it off. | -| Disable setting | Windows Defender SmartScreen is turned off, and employees cannot turn it on. | -| Do not configure setting | Employees can choose whether to use Windows Defender SmartScreen. | -| +| Enable | Windows Defender SmartScreen is turned on, and employees cannot turn it off. | +| Disable | Windows Defender SmartScreen is turned off, and employees cannot turn it on. | +| Do not configure | Employees can choose whether to use Windows Defender SmartScreen. | ### Disable lockdown of Start pages >*Supported versions: Windows 10, version 1703* @@ -265,9 +244,8 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | -| Enable setting | You cannot lock down Start pages that are configured using the “Configure Start pages” setting. Employees can, therefore, modify the pages. | -| Disable or do not configure setting (default) | Employees cannot change Start pages configured using the “Configure Start pages” setting. | -| +| Enable | You cannot lock down Start pages that are configured using the “Configure Start pages” setting. Employees can, therefore, modify the pages. | +| Disable or do not configure (default) | Employees cannot change Start pages configured using the “Configure Start pages” setting. | ### Keep favorites in sync between Internet Explorer and Microsoft Edge >*Supported versions: Windows 10, version 1703* @@ -278,9 +256,8 @@ This policy setting lets you decide whether people can sync their favorites betw [@Reviewer: what is the default: enable or disable?] --> | If you… | Then… | | --- | --- | -| Enable setting | Employees can sync their favorites between Internet Explorer and Microsoft Edge.

      Enabling this setting stops Edge favorites from syncing between connected Windows 10 devices. | -| Disable or do not configure setting | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. | -| +| Enable | Employees can sync their favorites between Internet Explorer and Microsoft Edge.

      Enabling this setting stops Microsoft Edge favorites from syncing between connected Windows 10 devices. | +| Disable or do not configure | Employees cannot sync their favorites between Internet Explorer and Microsoft Edge. | ### Prevent access to the about:flags page >*Supported versions: Windows 10, version 1607 or later* @@ -288,9 +265,8 @@ This policy setting lets you decide whether people can sync their favorites betw This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. | If you… | Then… | | --- | --- | -| Enable setting | Employees cannot access the about:flags page. | -| Disable or do not configure setting (default) | Employees can access the about:flags page. | -| +| Enable | Employees cannot access the about:flags page. | +| Disable or do not configure (default) | Employees can access the about:flags page. | ### Prevent bypassing Windows Defender SmartScreen prompts for files >*Supported versions: Windows 10, version 1511 or later* @@ -298,18 +274,16 @@ This policy setting lets you decide whether employees can access the about:flags This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about downloading unverified files. | If you… | Then… | | --- | --- | -| Enable setting | Employees cannot ignore Windows Defender SmartScreen warnings when downloading files. | -| Disable or do not configure setting (default) | Employees can ignore Windows Defender SmartScreen warnings and can continue the download process. | -| +| Enable | Employees cannot ignore Windows Defender SmartScreen warnings when downloading files. | +| Disable or do not configure (default) | Employees can ignore Windows Defender SmartScreen warnings and can continue the download process. | ### Prevent bypassing Windows Defender SmartScreen prompts for sites >*Supported versions: Windows 10, version 1511 or later* This policy setting lets you decide whether employees can override the Windows Defender SmartScreen warnings about potentially malicious websites. | If you… | Then… | | --- | --- | -| Enable setting | Employees cannot ignore Windows Defender SmartScreen warnings and prevents them from continuing to the site. | -| Disable or do not configure setting (default) | Employees can ignore Windows Defender SmartScreen warnings, allowing them to continue to the site. | -| +| Enable | Employees cannot ignore Windows Defender SmartScreen warnings and prevents them from continuing to the site. | +| Disable or do not configure (default) | Employees can ignore Windows Defender SmartScreen warnings, allowing them to continue to the site. | ### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start >*Supported versions: Windows 10, version 1703* @@ -317,9 +291,8 @@ This policy setting lets you decide whether employees can override the Windows D This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. | If you… | Then… | | --- | --- | -| Enable setting | Microsoft Edge does not gather the Live Tile metadata, providing a minimal experience. | -| Disable or do not configure setting (default) | Microsoft Edge gathers the Live Tile metadata, providing a fuller and complete experience. | -| +| Enable | Microsoft Edge does not gather the Live Tile metadata, providing a minimal experience. | +| Disable or do not configure (default) | Microsoft Edge gathers the Live Tile metadata, providing a fuller and complete experience. | ### Prevent the First Run webpage from opening on Microsoft Edge @@ -328,9 +301,8 @@ This policy lets you decide whether Microsoft Edge can gather Live Tile metadata This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time. | If you… | Then… | | --- | --- | -| Enable this settin | Employees do not see the First Run page. | -| Disable or do not configure setting (default) | Employees see the First Run page. | -| +| Enable | Employees do not see the First Run page. | +| Disable or do not configure (default) | Employees see the First Run page. | ### Prevent using Localhost IP address for WebRTC >*Supported versions: Windows 10, version 1511 or later* @@ -338,9 +310,8 @@ This policy setting lets you decide whether employees see Microsoft's First Run This policy setting lets you decide whether localhost IP addresses are visible or hidden while making calls to the WebRTC protocol. | If you… | Then… | | --- | --- | -| Enable setting | Localhost IP addresses are hidden. | -| Disable or do not configure setting (default) | Localhost IP addresses are visible. | -| +| Enable | Localhost IP addresses are hidden. | +| Disable or do not configure (default) | Localhost IP addresses are visible. | ### Send all intranet sites to Internet Explorer 11 >*Supported versions: Windows 10* @@ -348,9 +319,8 @@ This policy setting lets you decide whether localhost IP addresses are visible o This policy setting lets you decide whether your intranet sites should all open using Internet Explorer 11. This setting should only be used if there are known compatibility problems with Microsoft Edge. | If you… | Then… | | --- | --- | -| Enable setting | All intranet sites are opened in Internet Explorer 11 automatically. | -| Disable or do not configure setting (default) | All websites, including intranet sites, open in Microsoft Edge. | -| +| Enable | All intranet sites are opened in Internet Explorer 11 automatically. | +| Disable or do not configure (default) | All websites, including intranet sites, open in Microsoft Edge. | ### Set default search engine >*Supported versions: Windows 10, version 1703* @@ -361,10 +331,10 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse | If you… | Then… | | --- | --- | -| Enable setting | To set a default search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

      `https://fabrikam.com/opensearch.xml` | -| Disable setting | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market . | -| Do not configure setting | The default search engine is set to the one specified in App settings. | -| +| Enable | To set a default search engine, you must add a link to your OpenSearch XML file, including at least the short name and https URL of the search engine, using this format:

      `https://fabrikam.com/opensearch.xml` | +| Disable | The policy-set default search engine is removed. If this is also the current in-use default, the search engine changes to the Microsoft Edge specified engine for the market . | +| Do not configure | The default search engine is set to the one specified in App settings. | + >[!Important] >If you'd like your employees to use the default Microsoft Edge settings for each market , you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING. @@ -374,9 +344,8 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. | If you… | Then… | | --- | --- | -| Enable setting | Employees see an additional page. | -| Disable or do not configure setting (default) | No additional pages display. | -| +| Enable | Employees see an additional page. | +| Disable or do not configure (default) | No additional pages display. | ## Using Microsoft Intune to manage your Mobile Device Management (MDM) settings for Microsoft Edge If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=722885) page. From d2bbd9c583786a07366356b35bbc4e4b0528f289 Mon Sep 17 00:00:00 2001 From: shortpatti Date: Fri, 23 Feb 2018 14:14:48 -0800 Subject: [PATCH 028/119] fixed a typo and verified that Edge is preceded with Microsoft --- browsers/edge/available-policies.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 4a826a8f59..b7a048689a 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -388,7 +388,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Employees can’t use Autofill to complete form fields. + - **0.** Employees cannot use Autofill to complete form fields. - **1 (default).** Employees can use Autofill to complete form fields. @@ -405,7 +405,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Employees can’t use Microsoft Edge. + - **0.** Employees cannot use Microsoft Edge. - **1 (default).** Employees can use Microsoft Edge. @@ -475,7 +475,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Employees can’t use Edge Extensions. + - **0.** Employees cannot use Edge Extensions. - **1 (default).** Employees can use Edge Extensions. @@ -492,7 +492,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Not allowed. Employees can’t use Adobe Flash. + - **0.** Not allowed. Employees cannot use Adobe Flash. - **1 (default).** Allowed. Employees can use Adobe Flash. @@ -526,7 +526,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Employees can’t use InPrivate browsing. + - **0.** Employees cannot use InPrivate browsing. - **1 (default).** Employees can use InPrivate browsing. @@ -543,7 +543,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Additional search engines are not allowed and the default can’t be changed in the Address bar. + - **0.** Additional search engines are not allowed and the default cannot be changed in the Address bar. - **1 (default).** Additional search engines are allowed and the default can be changed in the Address bar. @@ -594,7 +594,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0.** Additional search engines are not allowed and the default can’t be changed in the Address bar. + - **0.** Additional search engines are not allowed and the default cannot be changed in the Address bar. - **1 (default).** Additional search engines are allowed and the default can be changed in the Address bar. @@ -612,7 +612,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **Allowed values:** - - **0 (default).** Employees can’t see search suggestions in the Address bar of Microsoft Edge. + - **0 (default).** Employees cannot see search suggestions in the Address bar of Microsoft Edge. - **1.** Employees can see search suggestions in the Address bar of Microsoft Edge. From 1c219d0b56d988b5e208fad3761869a84fa26a95 Mon Sep 17 00:00:00 2001 From: shortpatti Date: Fri, 23 Feb 2018 14:18:35 -0800 Subject: [PATCH 029/119] fixed a typo and verified that Edge is preceded with Microsoft --- browsers/edge/available-policies.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index b7a048689a..8f9901dcb2 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -110,7 +110,7 @@ For more info, see the [Microsoft browser extension policy](http://aka.ms/browse ### Allow web content on New Tab page >*Supported versions: Windows 10* -This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees can’t change it. +This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. If you use this setting, employees cannot change it. | If you… | Then… | | --- | --- | | Enable | Microsoft Edge opens a new tab with the New Tab page. | @@ -171,7 +171,7 @@ This policy setting lets you decide whether employees can save their passwords l | If you… | Then… | | --- | --- | | Enable (default) | Employees can use Password Manager to save their passwords locally. | -| Disable | Employees can’t use Password Manager to save their passwords locally. | +| Disable | Employees cannot use Password Manager to save their passwords locally. | | Do not configure | Employees can choose whether to use Password Manager to save their passwords locally. | ### Configure Pop-up Blocker @@ -987,7 +987,7 @@ These are additional Windows 10-specific MDM policy settings that work with Mic - **Allowed values:** - - **0.** Employees can’t use Cortana on their devices. + - **0.** Employees cannot use Cortana on their devices. - **1 (default).** Employees can use Cortana on their devices. @@ -1002,7 +1002,7 @@ These are additional Windows 10-specific MDM policy settings that work with Mic - **Allowed values:** - - **0.** Employees can’t sync settings between PCs. + - **0.** Employees cannot sync settings between PCs. - **1 (default).** Employees can sync between PCs. From b018422a97ea8db9a8bdace85ea9aa5ea5fd9dcf Mon Sep 17 00:00:00 2001 From: mflemingwa <33759581+mflemingwa@users.noreply.github.com> Date: Sat, 24 Feb 2018 13:30:59 -0800 Subject: [PATCH 030/119] Update waas-windows-insider-for-business.md Updated section on how to install - there is an image that is new - so I've sent that in email to Jamie. --- .../waas-windows-insider-for-business.md | 56 ++++++++++++------- 1 file changed, 37 insertions(+), 19 deletions(-) diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index b105a54d56..77f43264a8 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -50,32 +50,50 @@ Below are additional details to accomplish the steps described above. ## Register to the Windows Insider Program for Business -Registration in the Windows Insider Program for Business can be done individually per user or for an entire organization: +The first step to installing a Windows 10 Insider Preview build is to register as a Windows Insider. You and your users have two registration options. -### Individual registration - ->[!IMPORTANT] ->This step is a prerequisite to register your organization's Azure AD domain. - -Navigate to the [**Getting Started**](https://insider.windows.com/en-us/getting-started/) page on [Windows Insider](https://insider.windows.com), go to **Register your organization account** and follow the instructions. +### Register using your work account (recommended) +• Registering with your work account in Azure Active Directory (AAD) is required to submit feedback on behalf of your organization and manage Insider Preview builds on other PCs in your domain. >[!NOTE] ->Make sure your device is [connected to your company's Azure AD subscription](waas-windows-insider-for-business-faq.md#connected-to-aad). +>Requires Windows 10 Version 1703 or later. Confirm by going to Settings>System>About. If you do not have an AAD account, [find out how to get an Azure Active Directory tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant). -### Organizational registration +### Register your personal account +Use the same account that you use for other Microsoft services. If you don’t have a Microsoft account, it is easy to get one. [Get a Microsoft account](https://account.microsoft.com/account). -This method enables to your register your entire organization to the Windows Insider Program for Business, to avoid having to register each individual user. +## Install Windows Insider Preview Builds +You can install Windows 10 Insider Preview builds directly on individual PCs, manage installation across multiple PCs in an organization, or install on a virtual machine. ->[!IMPORTANT] ->The account performing these steps has to first be registered to the program individually. Additionally, Global Administrator privileges on the Azure AD domain are required. +### Install on an individual PC -1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). -2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +1. Open [Windows Insider Program settings](ms-settings:windowsinsider) (On your Windows 10 PC, go to Start > Settings > Update & security > Windows Insider Program). Note: To see this setting, you need to have administrator rights to your PC. +2. Link your Microsoft or work account that you used to register as a Windows Insider. +3. Follow the prompts. ->[!NOTE] ->At this point, the Windows Insider Program for Business only supports [Azure Active Directory (Azure AD)](/azure/active-directory/active-directory-whatis) (and not Active Directory on premises) as a corporate authentication method. -> ->If your company is currently not using Azure AD – but has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. +(images/WIP4Biz_Prompts.png) + +### Install across multiple PCs + +Administrators can install and manage Insider Preview builds centrally across multiple PCs within their domain. Here’s how: + +1. **Register your domain with the Windows Insider Program** +To register a domain, you must be registered in the Windows Insider Program with your work account in Azure Active Directory and you must be assigned a **Global Administrator** role on that Azure AD domain. Also requires Windows 10 Version 1703 or later. + +**Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. + +>[!Notes] +>• At this point, the Windows Insider Program for Business only supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis) (and not Active Directory on premises) as a corporate authentication method. +>• If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. +>• If you do not have an AAD account, install Insider Preview builds on individual PCs with a registered Microsoft account. + +2. **Apply Policies** +Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). + +### Install on a virtual machine. +This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a PC. +• For guidance on setting up virtual machines on your PC see: [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). +• To download the latest Insider Preview build to run on your virtual machine see: +[Windows Insider Preview downloads](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewadvanced) ## Manage Windows Insider Preview builds @@ -287,4 +305,4 @@ Your individual registration with the Insider program will not be impacted. If y - [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) - [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) - [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) \ No newline at end of file +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) From 797e7725c631ec1f5961cfb017f88b7ab3689cf7 Mon Sep 17 00:00:00 2001 From: mflemingwa <33759581+mflemingwa@users.noreply.github.com> Date: Sat, 24 Feb 2018 13:51:07 -0800 Subject: [PATCH 031/119] Update waas-windows-insider-for-business.md --- .../waas-windows-insider-for-business.md | 66 ++++++++++++++++++- 1 file changed, 63 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index b105a54d56..bc07edbda8 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -19,7 +19,7 @@ ms.date: 10/27/2017 > **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -For many IT pros, gaining visibility into feature updates early, before they’re available to the Semi-Annual Channel, can be both intriguing and valuable for future end user communications as well as provide additional prestaging for Semi-Annual Channel devices. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test devices, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to the Semi-Annual Channel, organizations can test their deployment on test devices for compatibility validation. +For many IT Pros, gaining visibility into feature updates early, before they’re available to the Semi-Annual Channel, can be both intriguing and valuable for future end user communications as well as provide additional prestaging for Semi-Annual Channel devices. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test devices, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to the Semi-Annual Channel, organizations can test their deployment on test devices for compatibility validation. The Windows Insider Program for Business gives you the opportunity to: * Get early access to Windows Insider Preview Builds. @@ -161,6 +161,58 @@ To switch flights prior to Windows 10, version 1709, follow these steps: * [Windows Insider Slow](#slow) * [Release Preview](#release-preview) +## Explore new Insider Preview features +Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: + +**Objective: Release Channel** +Feature Exploration: Fast Ring +Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration. + +**Objective: Users** +Feature Exploration: Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary machines. + +**Objective: Tasks** +Feature Exploration: +• Install and manage Insider Preview builds on PCs (per machine or centrally across multiple machines) +• Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications +• Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary current features. + +**Objective: Feedback** +Feature Exploration: +• Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible. +• Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.) +• [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) + +## Validate Insider Preview builds +Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: +• Get a head start on your Windows validation process +• Identify issues sooner to accelerate your Windows deployment +• Engage Microsoft earlier for help with potential compatibility issues +• Deploy Windows 10 Semi-Annual releases faster and more confidently +• Maximize the 18-month support Window that comes with each Semi-Annual release. + +(images/WIP4Biz_deployment.png) +Windows 10 Insider Preview builds enable organization to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. + +**Objective: Release Channel** +Application and infrastructure validation: SLOW RING +Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production machines by skilled users. + +**Objective: Recommended Users** +Application and infrastructure validation: In addition to Insiders who may have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample. + +**Objective: Recommended Tasks** +Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. + +**Objective: Feedback** +Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. + +**Objective: Guidance** +Application and infrastructure validation: +• [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps) +• [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/en-us/windows/deployment/update/device-health-monitor) +• [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793) + ## How to switch between your MSA and your Corporate AAD account If you were using your Microsoft Account (MSA) to enroll to the Windows Insider Program, switch to your organizational account by going to **Settings > Updates & Security > Windows Insider Program**, and under **Windows Insider account** select **Change**. @@ -271,6 +323,15 @@ Your individual registration with the Insider program will not be impacted. If y >[!IMPORTANT] >Once your domain is unregistered, setting the **Branch Readiness Level** to preview builds will have no effect. Return this setting to its unconfigured state in order to enable users to control it from their devices. +## Community + +Windows Insiders are a part of a global community focused on innovation, creativity, and growth in their world. + +The Windows Insider program enables you to deepen connections to learn from peers and to connect to subject matter experts (inside Microsoft, Insiders in your local community and in another country) who understand your unique challenges, and who can provide strategic advice on how to maximize your impact. + +Collaborate and learn from experts in the [WINDOWS INSIDER TECH COMMUNITY](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) + + ## Additional help resources * [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders may encounter while using the build. @@ -281,10 +342,9 @@ Your individual registration with the Insider program will not be impacted. If y - [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) - [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) - ## Related Topics - [Overview of Windows as a service](waas-overview.md) - [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) - [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) - [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) \ No newline at end of file +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) From 0af08cc07007575a14f1112f6e008219b127adcf Mon Sep 17 00:00:00 2001 From: mflemingwa <33759581+mflemingwa@users.noreply.github.com> Date: Sat, 24 Feb 2018 14:05:40 -0800 Subject: [PATCH 032/119] Update waas-windows-insider-for-business.md --- .../deployment/update/waas-windows-insider-for-business.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index b105a54d56..d21f608bb7 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -189,7 +189,7 @@ When providing feedback, please consider the following: ### User consent requirement -With the current version of the Feedback Hub app, we need the user's consent to access their AAD account profile data (We read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: +Feedback Hub needs the user’s consent to access their AAD account profile data (we read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: ![Feedback Hub consent to AAD pop-up](images/waas-wipfb-aad-consent.png) @@ -287,4 +287,4 @@ Your individual registration with the Insider program will not be impacted. If y - [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) - [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) - [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) \ No newline at end of file +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) From 072b247cd5880fd9c85aa817634e8d88ab7b7f3f Mon Sep 17 00:00:00 2001 From: jkulbe <32675112+jkulbe@users.noreply.github.com> Date: Mon, 26 Feb 2018 12:39:51 +0100 Subject: [PATCH 033/119] typo correction --- .../hello-for-business/hello-deployment-cert-trust.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index 5fb663bb6a..be893d7fb9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -20,7 +20,7 @@ ms.date: 07/27/2017 Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. -Below, you can find all the infromation you will need to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment: +Below, you can find all the information you will need to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment: 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) From a3acf76f961ebe0f369b68cf554ca971237028fa Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 26 Feb 2018 16:30:00 +0000 Subject: [PATCH 034/119] Merged PR 6017: Remove AD join restriction --- devices/surface-hub/surface-hub-authenticator-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md index c00bb03bbb..b303d0354c 100644 --- a/devices/surface-hub/surface-hub-authenticator-app.md +++ b/devices/surface-hub/surface-hub-authenticator-app.md @@ -34,7 +34,7 @@ To let people in your organization sign in to Surface Hub with their phones and - Surface Hub is set up with either a local or domain-joined account. -Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to an Active Directory domain or to Azure AD. +Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to Azure AD. ## Individual prerequisites From 46cfabfdaeb30e9aef12de6fee7dfed5b9ebb87e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 26 Feb 2018 11:02:26 -0800 Subject: [PATCH 035/119] udpate urls --- ...t-custom-ti-windows-defender-advanced-threat-protection.md | 4 ++-- ...eshoot-siem-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index 85245a50ee..d6dbef14e6 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/16/2017 +ms.date: 02/26/2018 --- # Troubleshoot custom threat intelligence issues @@ -33,7 +33,7 @@ This page provides detailed steps to troubleshoot issues you might encounter whi ## Learn how to get a new client secret If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. -1. Login to the [Azure management portal](https://ms.portal.azure.com). +1. Login to the [Azure management portal](https://portal.azure.com). 2. Select **Active Directory**. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index 22c3aaa87e..4d77042ae0 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -34,7 +34,7 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. -1. Login to the [Azure management portal](https://ms.portal.azure.com). +1. Login to the [Azure management portal](https://portal.azure.com). 2. Select **Azure Active Directory**. From 45bb57bb283383e9b8a091d1cdff8ecb6f2e2974 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 26 Feb 2018 20:26:20 +0000 Subject: [PATCH 036/119] Merged PR 6024: CSP files updated with version information --- .../client-management/mdm/bitlocker-csp.md | 4 ++-- .../mdm/cm-cellularentries-csp.md | 3 --- ...onfiguration-service-provider-reference.md | 2 +- windows/client-management/mdm/defender-csp.md | 2 +- .../mdm/developersetup-csp.md | 2 +- windows/client-management/mdm/dmclient-csp.md | 12 ++++++------ .../mdm/dmclient-ddf-file.md | 2 +- .../images/Provisioning_CSP_DMClient_TH2.png | Bin 0 -> 97691 bytes .../mdm/images/Provisioning_CSP_Defender.png | Bin 0 -> 1210 bytes .../Provisioning_CSP_RemoteWipe_DMandCP.png | Bin 0 -> 1227 bytes .../provisioning-csp-assignedaccess.png | Bin 9869 -> 9935 bytes .../mdm/images/provisioning-csp-defender.png | Bin 29644 -> 29717 bytes .../images/provisioning-csp-dmclient-th2.png | Bin 97563 -> 97691 bytes .../provisioning-csp-remotewipe-dmandcp.png | Bin 14550 -> 14617 bytes ...ew-in-windows-mdm-enrollment-management.md | 2 +- .../mdm/policy-csp-controlpolicyconflict.md | 4 ++-- .../mdm/policy-csp-deliveryoptimization.md | 16 ++++++++-------- .../mdm/policy-csp-kioskbrowser.md | 12 ++++++------ .../mdm/policy-csp-search.md | 4 ++-- .../mdm/policy-csp-security.md | 2 +- .../mdm/policy-csp-system.md | 2 +- .../mdm/policy-csp-systemservices.md | 12 ++++++------ .../mdm/policy-csp-taskscheduler.md | 2 +- .../mdm/policy-csp-textinput.md | 2 +- .../mdm/policy-csp-update.md | 2 +- ...olicy-csp-windowsdefendersecuritycenter.md | 6 +++--- .../client-management/mdm/remotewipe-csp.md | 8 ++++---- .../mdm/remotewipe-ddf-file.md | 2 +- windows/client-management/mdm/uefi-csp.md | 2 +- windows/client-management/mdm/update-csp.md | 6 +++--- 30 files changed, 54 insertions(+), 57 deletions(-) create mode 100644 windows/client-management/mdm/images/Provisioning_CSP_DMClient_TH2.png create mode 100644 windows/client-management/mdm/images/Provisioning_CSP_Defender.png create mode 100644 windows/client-management/mdm/images/Provisioning_CSP_RemoteWipe_DMandCP.png diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index c432bac103..556cb49468 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -798,7 +798,7 @@ The following diagram shows the BitLocker configuration service provider in tree

      Allows the Admin to disable the warning prompt for other disk encryption on the user machines.

      > [!Important] -> Starting in Windows 10, next major update, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable [BitLocker](https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-overview) for value 0. +> Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable [BitLocker](https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-overview) for value 0. > [!Warning] > When you enable BitLocker on a device with third party encryption, it may render the device unusable and will require reinstallation of Windows. @@ -826,7 +826,7 @@ The following diagram shows the BitLocker configuration service provider in tree

      The following list shows the supported values:

      -- 0 – Disables the warning prompt. Starting in Windows 10, next major update, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. +- 0 – Disables the warning prompt. Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. - 1 (default) – Warning prompt allowed. ``` syntax diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index e81ff53e92..22bb311265 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -14,9 +14,6 @@ ms.date: 08/02/2017 The CM\_CellularEntries configuration service provider is used to configure the General Packet Radio Service (GPRS) entries on the device. It defines each GSM data access point. -> [!Note] -> Starting in the next major update to Windows 10, the CM\_CellularEntries CSP is supported in Windows 10 Home, Pro, Enterprise, and Education editions. - This configuration service provider requires the ID\_CAP\_NETWORKING\_ADMIN capability to be accessed from a network configuration application. The following diagram shows the CM\_CellularEntries configuration service provider management object in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 5a601e0ca8..16f80bc1f1 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2453,7 +2453,7 @@ Footnotes:  Footnotes: - 1 - Added in Windows 10, version 1607 - 2 - Added in Windows 10, version 1703 -- 3 - Added in the next major update to Windows 10 +- 3 - Added in Windows 10, version 1803 ## CSP DDF files download diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index bcab5ce598..b2c82ca8e5 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -314,7 +314,7 @@ Node that can be used to perform signature updates for Windows Defender. Supported operations are Get and Execute. **OfflineScan** -Added in Windows 10, next major update. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. This command causes the computer reboot and start in Windows Defender offline mode to begin the scan. +Added in Windows 10, version 1803. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. This command causes the computer reboot and start in Windows Defender offline mode to begin the scan. Supported operations are Get and Execute. diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 4057384f64..de3145a84f 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -1,6 +1,6 @@ --- title: DeveloperSetup CSP -description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the next major update of Windows 10. +description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the Windows 10, version 1703. ms.assetid: ms.author: maricia ms.topic: article diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index e69e71e093..4de7bc9cc1 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -261,7 +261,7 @@ Optional. Number of days after last sucessful sync to unenroll. Supported operations are Add, Delete, Get, and Replace. Value type is integer. **Provider/*ProviderID*/AADSendDeviceToken** -Device. Added in Windows 10 next major update. For AZure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained. +Device. Added in Windows 10 version 1803. For AZure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained. Supported operations are Add, Delete, Get, and Replace. Value type is bool. @@ -713,27 +713,27 @@ Required. Added in Windows 10, version 1709. Integer node determining if a devic Supported operations are Get and Replace. Value type is integer. **Provider/*ProviderID*/FirstSyncStatus/BlockInStatusPage** -Required. Device Only. Added in Windows 10, next major update. This node determines whether or not the MDM progress page is blocking in the Azure AD joined or DJ++ case, as well as which remediation options are available. +Required. Device Only. Added in Windows 10, version 1803. This node determines whether or not the MDM progress page is blocking in the Azure AD joined or DJ++ case, as well as which remediation options are available. Supported operations are Get and Replace. Value type is integer. **Provider/*ProviderID*/FirstSyncStatus/AllowCollectLogsButton** -Required. Added in Windows 10, next major update. This node decides whether or not the MDM progress page displays the Collect Logs button. +Required. Added in Windows 10, version 1803. This node decides whether or not the MDM progress page displays the Collect Logs button. Supported operations are Get and Replace. Value type is bool. **Provider/*ProviderID*/FirstSyncStatus/CustomErrorText** -Required. Added in Windows 10, next major update. This node allows the MDM to set custom error text, detailing what the user needs to do in case of error. +Required. Added in Windows 10, version 1803. This node allows the MDM to set custom error text, detailing what the user needs to do in case of error. Supported operations are Add, Get, Delete, and Replace. Value type is string. **Provider/*ProviderID*/FirstSyncStatus/SkipDeviceStatusPage** -Required. Device only. Added in Windows 10, next major update. This node decides wheter or not the MDM device progress page skips after Azure AD joined or Hybrid Azure AD joined in OOBE. +Required. Device only. Added in Windows 10, version 1803. This node decides wheter or not the MDM device progress page skips after Azure AD joined or Hybrid Azure AD joined in OOBE. Supported operations are Get and Replace. Value type is bool. **Provider/*ProviderID*/FirstSyncStatus/SkipUserStatusPage** -Required. Device only. Added in Windows 10, next major update. This node decides wheter or not the MDM user progress page skips after Azure AD joined or DJ++ after user login. +Required. Device only. Added in Windows 10, version 1803. This node decides wheter or not the MDM user progress page skips after Azure AD joined or DJ++ after user login. Supported operations are Get and Replace. Value type is bool. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 51a46a8897..fda5ae3f82 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -20,7 +20,7 @@ This topic shows the OMA DM device description framework (DDF) for the **DMClien Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, next major update. +The XML below is for Windows 10, version 1803. ``` syntax diff --git a/windows/client-management/mdm/images/Provisioning_CSP_DMClient_TH2.png b/windows/client-management/mdm/images/Provisioning_CSP_DMClient_TH2.png new file mode 100644 index 0000000000000000000000000000000000000000..28ae086ef78a0791bfcad361bab42e87059afd84 GIT binary patch literal 97691 zcmd43c|4T;|1Yk+w75%_2u1cSDZ-$I>}20ZA^VbqnX#o(*^@ntvS!~2gKWt0?xSP4=y57rcdA^>{*ZcCht1NSpoQ|A~jO?VG ztdtrV*#RXoGIGkJ`@tvX?tJ{<&pt;rnOkI8t>-7fKMtDTRJutT zbsfpbPSue9+gES@!IX?_J4sIJrUnc;vo+wzP#=}zH>L7D!o4S=V)4PttaatUc>|7k z_V|tGCd07mwonmF$2h)OwQr;&b9R8d!E5qdQ<=;Va`~kNf+yG3y)9nu_+?hVGdG`{ zJ$5tnsBS1--ac|h|Cd)e{63q#HeeUz=ALfJXx1xyQeCa5i>9o+tUXpAt$XOglmit9 zMi2~eUJwcMuFF6E^~;*y@u^$omFt+UuJH1w zq^mdNYYCx4yoRL@5%?r_BahAC5sD9PlRYX-h;fPb*Ogm%^G@&eaX(K%mt}8n0--z0 zFkhPz{P14fQSrI0PVUC}3g^w^UiGh+*QN-bh~eg-Q0~DB_dci=xadi)Ivf)#=7NDu zSFac$cyg%o@;S66HrB2C`udjFNz3ma(MZ6!xlUG=uXf(h`eL`xiQQgoUemT4D1E>$ z0514Mn~PjYU!w3>ZInFp_Lg&;OrYe$`)dXc!TZ3spM925I2^8<+Eb#}s7NQKQY=#P z%vI-TLq35Q3`I?CaoZ!E>C<&%hrzY9^u0Teno~JXK9eXS({;q9+k9~wb6u2j`VFsG z^Q=^h?QKt5siLd-dC7faL~Nkl2kMY9={}2;vI)^6=Ju-r(pC}iUn1hRL-Mh${Uwem zABVwx$wr2deZ}^1hA|Z1Om)n{k67nBdizFEK($%r${MpE+5Puft!{FbqXX!zZ?!5m zHQprXM#V4;W@NUM^P!OvsFD&(ei3k=PdXoE)?Vhl{-p3WA?~@Z_!~RZ_MyIZ!_YHg zJQ_0-GXcF4_UFZ!Uqroxd*x3(9)^2*4u6fd=kHNC1%7>*dbVWKueictf&T!%rN4*u zWQ?3&Ak1jeHOQ@U(qBoKkKgL%Ra}LhroD2vnRX&pS|RGCvtQj=-ISu5rE``Z(g}1w zgx~UZCT8}GzI8RM*xZcciHRJQ{5l>D099dFdhPxDYO$WL+>83vxlyI5!{&gO5P{}Km(`hgswLKMYA!o0l?xi;+V zT(vk&I9mMCrq>O5IyFIh{Jdg?<VNq%`tFAyV~NZh|vwC1yH`@j-*lLHdl~Gq_N-E>xJCrV&%la zz0kO?gzC@obvCh92UO7=0@3`fNj;;zu9)g!U1B3I_^E%$X-`Rh4L-_^^UBAR{ z^YEm8u^pB6&dx$C&>O2GK}Ncf$7d3$w?+CdncZ?(eHO7j^vo!eI)a|G`!*J6_08d} zF#GM9wi|c9%o4QgCGuhSk(HLm!Pg`82;^|}LP;C(S%aw#quVU8yLBsO+lCQ*H*-7; zJ5b@ivDx0UEwSNwDDReYI4P=xjk<5*>-S>7S(n-VlFiv98f@G~x=Gxz4DSN;GxWeV z7{`75Fhpg6Gz=y@B>Ttu(zIW8oMzDq1$*VX3%?uR>qvJrP28IHk+}6BBe!+pJNH2X zDT-7gS1EvdK|E(WDLe`r=SG3qeIlO0qxL^=ovT=BT}!I-J~r}F(sfI45V27yQE3{) z{*pk5&Lyo` zSDw7{KrbwOE*mN$vfWIIs5cD0oQgMC1IY?H0usX~4^=qw4T`B^LB%WM^}wigedR-s z$r+GLW>|NEIZGFT*ljPQ(ke-5LEhs|?DI2n--s3V^E&}@!}P*kZs?AHo2da|&kW(v9CT|9i#Yfxt>g;F_Fd{TFgfkijSxG|L#>O9 znjXpinRNNrvk#xw#Y0qD-%K{5OVdIcg_Vh8V@9Y4yZHe-u!3288Dex2m6$HIX*oM_ zXH7PHqSM~eJxRS6D?IfQ-sI=}#6N>yBHG+_`DC`M&IkGknij{K3@bXSr!d@o8z4)U zKJ>sqAAylP$$f|h`D1I#=eAeGF&qyU-#{oyO>jXqYlIF?t0 z4$RNVx%Yb@z~4b8{!3O)+hwmz_ zsiEag)8XY);Gtx$=xJNp@== zv)Ob*zEpl7?y&;r!}#vVe#98G0?R6{Sk#AZc7*{&|h-;H#xU0ohaTM-qf z!QvjlKvgfff+-} zSJi&78rJnj`^~AfxBJ61$!QVDz|+^Y8x{TGP}{_%5;k-?X8F#++-DpiS`xOumgMU; z<7WV{JU2$rhpldj`jY~19Th1`&{FggmKP<%6p6snvQXQ04kbGo@WnEujHTqSm_3OlR)rnn;4ESm&uKfzKVDh|_KnFIxM&-n#O4jB+z{X@4A!;&!~ zE^paMfh#8nhD`bBh;2PmsizsZFxnKPGLv8Kxm~lZ{q@R460louq1he}^Da@~ZrW7d ziR=9Du~Zx~J>S1yuPpeOlQZ8t%>YF}FdZ1^mxJq7mdHFTD&BXwUFzi-wocp~X_Gdv7>tCRxVLxfO_Ytc^m%TY$ zx`5gyHfp+({F+Q)9zyyO@^`FD384U=UQqe(_!5DG7uyXWM%wE@ls!7BLd1?|<4D69 zRn8W-x3-=h^QK`EA(CAbZ=iJCUR&VD_c#-Sm;DM2?K=vvgtc$=U!;`Lmq6YB>iN{%_|~q{;qhmCw4kGm@VADyJp5eeRl-|_*7Ju@Wxf$lW?eqq#D)xD9=dRa)U(Rs%_?jtScW9G56?RMfSxQFm^e7ZkK zbe}w)V3ne=nM|5$YQBL!X`Uk!!C@XSq(@}2kQnylckBdjYIb&b-6%nN_x|x(0-1pk(Zps9i3-Wgw1aI}m}QMyGaZ{A1ij7#ry3@ekUz9`h;t`HZ=`*_{#$+k3SNN;EFjIjf=HNDjnlzfuOnvsPnd#?^v zcbhimgd>y9o52IAeD>)|5qkDzHjh&%Z8LTk(hj0BppM)6zWE}iEI67^EaR_;c!lCJ z8HqettzhGA&WFyCMbFz0G@>i8(liS~8T2pxyTytrPL26C;2H#ZCHmej6&iPh^l`5w zNKS{|8WI0yQkUVCJ#j)Wk%zi+~f1h*&>!=P`I|fN%8U84n}zt6Va@vWD~2AQRaw$LO}uVj?L?-GB7K)QgLHZv4T* zlQ-U1yQ16njeCfJ|8qUbX#C&YL>(y43w zDPL8NOv0gV?+dVX^z926Z$EVaC^h8v3RuB{wfp}2}VL?pzTHHE#Hoj*`QDLZ3( zjJ7D9Iqk>ibrfun%VoM#6=!A_|Ir01y(mja>Ylz+apbX@;ZkO@a+*I9s$Obga*pKu z+CSg{$Q0wbTIo?G!@*}Ep6-QjuX##&7EuPA3LnvaE?a_c7n+f!5-Vp@>5NBW>u9)y zY>pfZJTnk!@$EGEnE_-9XJO`xh%6!Ta`ElqiAHDRdxAAC4-))biKDnK#a!vM&$14l z;Q=KUW|OrmPn1#IMV;%Vb>mIn@ok@Veg&PA1eB>8e*<4w_Ss{G0g68tiWH0R7U<(l ze+|RcnSKox2IUGC4l5KeZ6x8|MRJIJJyPb&;xF%FM9Lt}?q2!7h-uQ<;&TZ>5~5|- zvo(TVBS*33Sd9A|!v?APDe16At8;Yr?Vq45wjV4S-1-?XcVfT6|2wfCtk^$KM$al9 z4Sy0}Ie+~=g&SRIyuYZ&rXumwKC*ihp9mM!3wo}Wwjfc2Kqbj+l2kxcRw$>ot ztQjbB5WBBNhUXP)J{V9JD!R_1J2>d4gU(F&O9B3>#qw!QFCczq7+{P@;cJ#SxcBQ%4G=g65%+8KaI zmj8lKprhXwEJ9eQCA_r``m#`{8wTqoC%g~6aaBz7%B9cTHbLtN8W%U(;+O-^gl*v) zoVPz_BoV)Pevok0IN3IG(o*wyxP`%Ka4+C3qNGV9B#M#vx+%hXe;9`8}v#R)hVCnNKRAUb~(tsi25F;dQjn@*fEk-@mCS% zQK@p==;PvdhMI4E^s!U_7@W%Ic(*tvS&hn=A942@b6&$4eWl0U`g)qmxVyz=$BgfK zr8?h0<#bjivrmaF-mo|G{vK1s!>_HF1sEoVXINYcR=h&=V_7M+?OJ2|@<3JB$j$Dh zmh6MPW;w*mukmbwXG@Y!H95Z#Lehx7cz@<3q2aEpa@b6o=!plew^PsLp7WG?91$L$ z^(`*Gj(#xhk$?*2%w3ASZ&#a)nkCN=&UVJLdQ?_x24#QH#{&#heh?jf7roKk5v_fs zuO8`aXpJqj^ybB?OrmcxjF>+fJsO-O%F`#;OB6p5c`9`LK0vds$C1LR$dyd)`Yehp zKEqtYI~!SDdgRl--FPNqp+8UO{T}6~*s)sRX?1{ASf+#68;heuxVGqAoHADj%H{OJ#)!^pBvlDRa$-WY8ZnH$=#m>M{1!rRL~XM&E74B;|*(t_M0%>x3!T8 z(v4FQuhi4q%hSwVHT{s&NSyTZ3`Dy1rRBd zPP;$$K2TkF>!O>f&a1bsMG=TY{TfxYO;!aFmz+}>#azF1N` z$UpSFIC}FL<&vkaaZ048%dJpuqWJN+g-Sj4jWg=26#e_i6h(I2yox~QuwA568Ut-9 zjouWluQk6`-4J^o5CQ7P0QOZy3A?f-(@scJzUcP$M^0icEg6~OzMWt9xPZ*` za1Em|+$`%fxbfX5J|!kOB{WiKFe%>Y@rW0tote}ZuFXe`$wj#1FYA&U@PHzS1yCFF z&2&2sYsv8FZIbwx^RQc^dVXz4P9KSvmwB=SqYTbRI_qA|xcJxD{?TEKJYAb^hS@8c z{bWxj_n~VD$!wJK7@_%#1l59bp;lBcov^;Lde=D4&jv2-*OVzwyVNu7L>m!OQ|)+p zg7c&Tz{{f@F6d|@Qo2)=hKdr_8_T@>{G(qDoUEvc@`4)L^cV@@0s(ns_8Li5stcwBfxZHUurIb6d73xHOPzuKBEbXco4D zOwljrJ?yF+dyAk4W{F=MAduaWZa|kGIdycYJ^XCP`#TC;o$@EznFbEJ-|MvQMzULl z!CbT0Qpc_CO`(8ESb<{Vj+C|Pg&TK#xO^+#I#N+87(c5$I#|4U5!$)GvZ%U6Wm4}k zZ>6#+X;_s1Efg5^4Q~zIi4i~sPTd0hVjuK6NX3yS=23qo@c;&oh8o=(>wa^rFF)wb zIO_U#OzB-f)rS+LqB!_;FGS&t^|g9AveB%PSAm<0Qs)O}lcNztRm2H3C^FL$Z z8U{Fldoy6W01=u$zaEt>v7O?T@Ol6X>Ul}W*~Lu#;+aB_{GZ_4UC?C+r>zO}w!mMZ zldZpML5H}7LFndG-yF&^`xa zo_P=LFu!ipfrZyccqTxyLt-FXQ-j3Se9|~MP1p0oczNAUUrZ1BW{mau@wxG)*r!wB zl+W^@N?TpuxlG)b#G9+DpKc9H6XGg*$$_aN66ld~pfY^&XtPGUu9UkFheovz@J~X@R!|GMF&;VC zB8;oTh=k6;)-!oOWJ=EC1Iz2iaqkmhS~(Urut>KR%h+<%5JhTR^m zTf<_E%8j!D=p>t=1b$o3En40=EtTE{^*TH38B$42T>paSGKPkUIS^fd`ym)6G}i^WLYxW%N-QxT#B(jl zT+*FH`+JO$C{{lL+E7QLJ|EEE-&si)(;!_omT|(E()q0j#+rFH_Mr2gKLA_Lpuy8slYa&w;L3WOAhq*<{5E;#XAj_%wKXFBi2Ze zAbQ&MjTjPu8nL~ivVG<9i7OXX(^h)dB8rQPaoWJT?wy@SagKa#a|y%RVkX9gi%Ddi z5e#SXgW5EHp>V`Vr}S}^M-^C-JNv+rh%TbUTxMg$UBIzPz>DULi~)udjTtSi-Upl`>(*d}B?h(46AgG0f7M;pph8S`v&Ld*DTY|%BBVD%uQ4W zB11w2`FpqT=--;X>rwP_<2?fG!kA<}fJg~X!4F9W6NYu4j~)bTkdp&*mL%ThBE@+j zty8@p;klY-w z%iC<4=5L8RWopcW_t4LJlLMw89LUHCeIv@-L9J79xsalB)2PUC&I)*5XHyrwjCprb z_~c|(Q`Q+i-iY}K!DGnz0Cu1wJ+`%N@gQ{#6dVA{N*w0g!W4yU_RSfr`=x9<{h)N+ ziQk1B)@IdliVE(DD^D`j_*mVNiW_{Sb-AsKMReH>MEmd0e^gaDUy0qSX~?eFz#zBF zJ_B0d955%mO18n)=87jC$bs|oc*8OKpz`hQjUjJ-2}1V%xbM?CsazwBVU{M26yF~| zJz^Oa?o)5sNo%Neb)90K+>$W(i5z=8yeld33IcFykRkfpq^yRjTt{xPfl*r=L3XPH z(B%XI$qly8uWJ=lc<&=2-j&5z?pO!@i}$OC`lI`e%`lIT(hbAQ8!W&%Tv+vbEAElYyK^9I^yXH z>$*7w{rBCA5%0efS0J10i@CF4=qXij4)liKZ?YX;K$7HCP_Kd236cU1{l<{#2MG?BPdB8YHZJP zNs(>Y`eAaeTfLs=2e$en9mmTB^UX%ZbalUO_|ZKAw;Fl7#5sZT&1u~A<0raz~q%h&T<;R)WK(Wj)MhlNZ zVpV?+4RPwb`Toue8*hLVzdfJ2{pkK$Kduk>H_#RCJ)Vc;*x1_gR(LG;biAx2b*4DK z&XrDGF2*v70}M6AKUi!8>V_w=PqAM04DS;kplPbXlZul=WRRX4RqTVCW1qK+>eUZb`hxEVo?>rmoflo7 zC5a#7Cy_5f5c>gtO+!KoPr%eNNEAKUc^ISVAyTaW0q(}V!yg?%9?{(i=GW&TU&u*C z*(Wb>s~tu86oevgCrLa6x1#!wZUt15XkmM(fyWk5P;Y&yHCu|9>x_>( z9UUzR$H{;&`{b`HQEQ;1CqV;EtlfWOKX^p^ZM5t1;?Qk$zs%97W{%Dp0@(}Fbbi2} zFJ6K%-k{$Z86fFEac6O0XS}D|L%;}af6n3-;tYi1-N~J~2_K8n)h!dFebvmA8erKP z>?GpOPStomrd;4-nS{DE(;MRh^xQ|v!`r4`mjf33>*1X#MnAVempMF6?n25NzJE$> zVhE(v&L>?xVOY7!S^^vI??Kp~X)nR{gsWQ3UNJi$6UI_1gMeWY0p<8>TuQgjAXAt! zdHGv;`m}TF2qFYjOOXaMRd5=JUcsEpaD59eKLRv@mz7Pcj-@kA7cZKsyZ){ASemmi z4~+JlQK&zlVSdl$n1`f2JlBGM^fO)1RY9Zo!@Nn-QOpmtSwr={#3)P(6k;D@q&h8} z!#+?)vlb=NH-)^xc@I%x%xtr1lj}9;-WvSuB2YupsX8jmtiu_5?$1M>2=Udj~-s;v$E5_XAJq%xMXBi0M%Tu zZ^xaEPRjj$9OFfC&~)+3m{=0o0Y}_RviyH(!EIq!fUR+b-W@=-yzpGn3<`ze0~Ba* zDm-MDNLF3C0I8ETb^rk5Gf7g$twUI7_@fN?PY$F{B z;Dg^Yhzsr;l*h@A0nhWzg4jDc64^mzi*HE(Hj6h;uQ89Ut#hk;mS1o4!o3`a8hveQOAgs(*578x9|SO6QQfzz zhB7~)iPiyXtmfQlPea|r_wQ^jne2sxCYEDpu@9p*a8*f|AjPO}y=7@GBKB=p-ff^_ zHiyP@>)g7=g-aJM;+(kl#$hi4jGe~mD-RrQ#Q84Ynyj7fZf}@6L)~_TV5Sw8XV~7} zh)#e*b-&tQG9mwEFvG_sSG^Zdl^z~T007OfQHZ;YwPB4;%yOIB?D#8RYuR9KpAR<5 zsxDo>Jm#D~RtYGyKOJRz*{7+IP}*n&*~)&VfBc-vaxGzVrKq${>qBGUI2=_x(7kKQ zB-{hBCzcOFiSsUH4Vz<2bFIY7AG2TQKH!I_6i2>|Z-Ttm&z|xhg=hV_6i)}yO)O$~ zh^O1T2kUo<#&HG0_+sH+S0vBhSJq4k@U$6N)axeV!t;XZ%c zu>T{+@xuO#&`+{qTyNnavPc_@UWuuv@xBZDNDdQ5au`#x|0`MUe@>XdIY=s!o({x% z+kurVQq}`c^xg6~^yDD$P%xz8l9Dx0u~bz?D<6%Dfq-^HAk)w6I{Ey6BDzegpK8U> z^6(!HNCX`FZkXu^iwY|&d*=0JGq^YM@p20xFoOaxEE;hx9^|IjKdz&~!9i!yx8A-7 z#*pky8wygl=<@3s!(D@dVIH$eqVsvhBstrKe*2Am>6sN&9UL!fV+Q|Ws_Yl*E}qtz zHV+a1boH=GTkVf2Ln}mMf7{7Ej4$IhDB4b<~@Bipn znI4qqQZrpx^zdQVPSfBoXKg(|QeKK|Y)4Tgz43jD!Cq-sYJl!Jm6CS*oNWMX;4Za} zgtQ;z62Y_;a>#$1;b^YBv9C7jJZ090qDu!)qx2TYrF#xJb5z_YS(KC@o2(Ra<;nui%1%B=APf^f{3Gx2*Wys zRl?Sdjucb3+rB}XpSOk^!gV+mPs8P1p#tSIbVLXm2EE{Tvb1XkUdnngJF#YW82{4g zT0`a`wkF(A zxedZ;3#rjs=>=GL7-*%9`OKPfP>i#lwllpK_v0%eZ6Bn8-sty+GWOhb%RdnotZ4S< zM+I0P?8EoV!9FK`?-Glc{N@%<)adTm|9$I>=SG91*1MlfQOG{iAWt%v>@^w4l@pC5 z?0JRszyGx;^tXQkuLrEG>q#=UXzT8*y-c+OL>|#h%3Us~xPlp60H>sy^ zvDy9k>jqL80LJ^DhoX3q>#im_DB7!2=XII-4daf{naF8fDBlhI`_c4{1u-WLy3DZE z`w9#25OFq~8v_hkX&bi2QYe6HM|GMeeseC4^4N2P0FicWGp#PY513jQ@`Jr%dO%`V zM=;hY|L+%7B!CXU7j!!GXlvyaq`AJ``PkFEu5=|{?t{&tp!eYyS`84XNVtwBXxcbH zQGPt7pgSNi5Al#nn@PNwcJdp$?)wR@`ZB7{FNHmI3G~Jf4Kq)*r0$cpPn6|=4*N@S z3gmJz4yX;A8m6_pHr+L@?O9J$0%R^b&d7ar^+;KR%eWSCZH)ct26-y`B31eoZ{M&Q zDOALBQTx~Tj{T+ATa`jQ}`n>%8g?Vq@a>T1t;iQ6kbVPLgIThfP znhAt~@8PJEiNY-Uvb4W2avkUX#F3Cz0`nFKH_o4~O=!K4(jo zDD6I{86}0kOWxT(e0f+=u24^os?D!AcJ+9VnkuW39Va5sE>hkUed*|KLiSUcTqz>V zZ7nantn5?5z+7-q+Aw=Dh=7dhWFujQj3rn(k`97CmlAM}+9CN%(Q)?tY?o>2v=j%x zr~2}a#hOHohO4o2vv*|#ukOZPAc~nN*Q!3&b43cg*P2T3J3H0!1FkA;H3l!0?$LjC zuP5u1dXrk4&!klgyR|Tjo~-y@_-#%VlRw=Cg}f#}vT<|R9!|C}!K6#=8i6)uAF-3S zRUukZGAH|V;s!so)(O4ElWGDjMXeC}*KxS})u;aOaeBx7GN&Ep^szw}(jiE8qadwY zl&Va)hjo`@+dB&&br7_(52v(iH6iVORZYId=@4T{;+n5*nR>X%aA$Q$=HdBE*|xh| z4g0rY@4wF8FOkA7<0P^s6x4_CsU*+ZU!DhwM^bM#VrhzwOz|>kJzQp|CObna5)9#> zw!Lxqe^;9R4hsL-Di@^j6(Ga#@*oY#o*WyenalqE8~W}9ls)tt_49N{%q{{rg!~)2 z{b$Ihd{!ijzeF34?NH}&AoawW_3BZN-X za+h*_mMft7=(PeZ`DE{as$sXt_1|d=CUw&#xp;r|A0Wv0Se=_R#n)8z&cr}6%HE3L z={wu=WF2o_vHHEo7%3^q=01vNJqiF7AU`o^j_XZj`1F1XNRX-hpRP5PlI$Xnxl>2U zfH&?=oWHfzY!7c!%%<~;toJH1gh;1PWwd0SSVC#I>-O8_Wj$y&^26Mt>ikfkBGky- za;V|MuD5KKZQ}#~0L6n*`fJ#TxT63RKcA4X?u{B9;kzh0T$hCv^|n72kymZns~~rV znYHh@D)*~cwx|*ixyY0DV!>lPHSX= zL4Ty0hVJIu)h$$m!cwimtH5Ol`g`q<=h!+o4vRq(bO-NgFG2KZ*N8&X-xlcyJmfE4 zQDut)g*v2H-4@%}{ZjGQmqLD&yvzGM07piiv51m5tIX-Dr0w**o$&Oj>9^fS&7+R_ zXfnlqq_;emci^%7iq-t(1Vm?O-oR9>Wm}v#R`Z#Xz3!zkxF%=5oC7&q#Wh5G^0Y=u z&nSHIZ+A(36@2-kj+g!Ec0iH+;%V%;nB!nQw;@6PyHWZOQkYc^^_(@)>9H_Gh`Oi~V|51E+JOKxiKpQoPJjHhS?Fq6MzxXWB#qVl6 zvUd@{^VhRpr7q?jRSqPX(u&G0GTz>J8-PGnPGr~n;&%C%BAeu>kl}? z12f$Q-@8m>ZY&K^&Qbz~u1Fy+M+;L6NewjH_h`*erywdu1q&#RmNk~-@}l#TY`=Fm zJH+CegI-YrIN;%tj)rDtZ8_OG^V!rBmO1vW@teS^O?C$^9J0WFkqa$=J)G)eUe_WVMBzC z<&3M_l@wTMytLEFN&k(6@N>j^pt%s&*E(MYdFDjBncI!U8F?^&%wA;m!K$&{k&rjy z#HD==WQ$0vEanxzqL*XCU;IA3VR;=^f~{K%aH0}pvvpdchBJ31`MUd_{E)b8a6Jjh zIw;>A-q8_zXU=qTL2;>__+U9T0rE@c!N-3Zb!vUi{LSsl1X+@ne`MCZl2( z;Nk017G3++Ry!Vp0eXZgdQ-$93Ey393gq-kP`n?TW2nx;S$ZE0aCU2^F6vOUAK-a0$n^$ko zwmlsdFS~NCfsirw9gly?brMO#VDvauK(MLqmQ~}rBBv+j%X&{3FHW34_azr%+W{St zQrU!sXF9*xg8)!r0X}A&6oi+MDa}3vSDx9ACP3Kqz7}a;Tbq6+YGBa2JE!iCaC%rt{2i*ExM5@X9k}kjrD6ygtpZ_oZTp>(HfUoLe(1G zp53cy85=|^h|7R9+oh6C86eqvFq}pA2s(X_Q2Hmn2?7I&&z`z-3ozDhgt|)LTswsV zfGglY1nT2vX{jIJ%7lQ>{OLE(%}o+qzmWZ7R{cK;O<=LWabOaA4vH@Kjb(t2g#M0> zFhF4FkBW11T~-Bp&3I}A5x;-Cg7?#95~+7eeD3e@30V32pHS-G_c1A z{02N&V{!g(Pk$c-NI{pXas1Cm0aUx^QOBT~2!%YULramj&V%_6%T;4#ea)Cqd?gFj4NWx^`nA`PQKS_$%k}yw?HJ=|9R}6DS znd2Mu3fZuR|Yt2>G`PvCeKSX+{kC5_jy8UmF zEzBEx?f}O@=|N%u`Rc+@(#)AV@oEx{k7^8NR^JxZ+T4-uk#qQPt*&!rR52?o2H6h< zXJQc{?Y_M@d8nvJk{)x0$r~Q%W4IZ$;K*n0yH0ERN_=TA*8-!hVk&lBykhkme`r!m zgU-Ai`89 zUp4Gk=RQ*Pp!tah+P#F~kyzo0RpRMu$5hnm#Q8qL{@izsKDGr(!^BVTbn8%RDf3&kzO=>n6N`(>87F$4mgdFMes7*P?3oxw-h!81 zQ@06D6Hx1qdtk!%R=3wypJ56;HhHORNA&imK1e}2|W zs6O%>#@N&Md)_E_`NeA-7hU&2-ajdIfYcW)MhF3&9r7S>LYCSkhv8(mt9AqrQn!Oa zIl>9BHj$Z`ynmpn|5}VU4bSF})d!`W8GgwdoTMk|mLEtO=;LYl6yKvAU4t^Zo7xC; zrxXDQclW29dUTS63;?MHpl8tQ9kTN9FJb5(e34x&0y^T#Btop(;*RhE5|)@#brjW6Fl-po7=q=d%#e%Se}rC{mb& ztDX`QbxlAdf__z!KJas7*~LAv*p~BpF)l%ipvQug^Z?@r6yGHwoVbc-ASy}xx@%2f z>K{)X{;}fu9y0gdB%Ok3`(DJ_tThujbrD(`)7jse^af%d>5-V?X%BkEkaEUO z{KyV*TP};hqc|HMq7^Lz7n)3 z)JXHubO9LN)n{P+fyZvO09F|vSLL@^uiguT;$`i@p)aMq*>ww~36Dn1TOBL&Wd@xX zB!T$f*o1#~+kEZB=la*AlMrN=b9wmq`b#@o&|){jNlP$*AhkYgkcJIb@iOcm=WX3-q58ftFy;F`*MuRpF`+?y#@f(0Y&Wkre>+4+K zVKjYOto^cW?Dq_uBu{dIR4BM3C(6iXgT%D6^8djXlt@zP0SXV3GLovU0|os^+~;Dd zYf13(=h}Y`FU>7<_*i6em}J<}8`m$T>L5tAop)Ox^9Xuc;`bwki@qKDkXaLO#mwwM zrbam)jsfQiPxpX^qKCit*xn}f_}34oB77x5f9KtgZ66`_TOahkh__qk4|P=$N=Y)q zPm>Pdb=tR}U(gXc2Tcg7|MsM?MGe$1LX+({_#eNagnNF*pT-{tl1X>|(U>7uxz2^@V9x=CB$~ zMB-pM5F|&;8U&ImB3JTH7hXv}i^ISMpj{`ztpy%TET`>z;5W^;L1s-k|46lLn>UX#V&RytII59up<4RRKyma$tc2p9zXN47Amwv!+b7cAqh=T&ydZiYk0OO3e_Der51*V+ms2gR z_=WWdmFX}gU;Nm6tO{3_^6CoX8TA)-=vv4lg766STgiA=KOdYpdTUFUYV8DnDHFsV zwr4YlVFlWYVtdg}2^`LCzxl`aPqD$L{(-gc`G+(XxdO`gqZcWo1&^oTAx{pIU^EB_ znPCc`2lq6<`VoBmgC&mjB)ET);ol7h=di!tZt&e{ zSC=$>v>U*Gz}16yLcx0zAX?0x8V`C!Ek5?SE$UrT>K9pL%8|Kp#GB+@mGn z)NtMA($0RO^adFralD;WhVP_#&?dxnrI}EBTOy>opcf7m0g8^q(G!d_N!pfa2It>a zY4!Gp*J2dg&2N^H2;racQc3z2_Z!}!kQ^@KaC;MC=rHT#>7~lCGfUx%TuY4tk{yj7 zQiKuEO&-}|0HWWLP#QSXB^!c0*Flc(du}2hyx`%dT=ykvWitcw#vmy-Pa)L-iG^2s zML_--9K@cheFB^YvMJH<^ou{AaOBdqR>quFJnQA639d8;Tjw^!du=Jn8pmguSG4rG zG#^dqzP8&lp{-Y1AHGa$v{&w~JPa!N6npv)j3hG;G2Xj=&t*yM`~Nbfk$iba0i=vx zs{?y*;{a(Nib-mH$zjlN^ZE0OEr&x-Xn%eR+T|{H{w$6E3w!DQTYGSXseYnS%Bz7Q zVm&p#ig{JmPUU5A)?k;|ZBFe|qxZBD1j!mVd+$P?Yq02b*91M`yd#;`0rWKlHqJk; z?a}|)QCH!20uSlTLt!jzV3T)Oc?=;+_QW)j<5 zE}>ZQ$2NOiG3k4*(3oCTIV3oBB%-l^_G?zq5mTXeSa=;u>S%fpJ(yq6e$F%Cba#OX`m zZ88xRtBYGzncfH6iblWHCO!Jtn3Pz&hD=G;k?t^&r@RuE{&q~TsCwR4pljKe&oKWH zi(!{|xMP!CaY$S_UhhZDl}7c~3MswQFCQg-Jc{9BTcU2?Et912doY;PgOdU!-h60u zacQ+^wD|dO{J}4bzPiZQRBtrS%k!U2J^TTdo??V7ReOXI*0%2y%m?psc~Ex!P_a~+ zVSV5Ib>@lt&S7cX78jNNsB%pL%@uC?X`SCfDJB1PLBJXf;nyi|BRn;KY3HWX!I0eR zgklgfcn%6=2WB1niw(f9el}8~1nLDd-?6%dYDzaRh^r`q_Q!K&k7{0sqX{jFb+#-& zpPMoZ$NSxtR#~b4rZ4+PXJj*8k=q9EaZQQsyt-%rJj={GRSYdi(Eyav`~v3L&P*gX zW+*L_nnfK~q@ZK6z^sv4c8^|c=8vYm$dM?m#H6p+X}E72`!il35^Y$83tdvf?wwqL z*q5$tIf<^z3ZuE?q9Vzku z+A?SAOr_Q+|Ln(^h%y2S)C$?|X1cif7vBlQdYcC5Rj0hV7kHHTZd1!JVbJqWf(>*5 zRjk)&Ki!c34Bq9HliqOoM1Dv@BMdTU5TjitK0F7HOBjRMI%jn$FZ28gX1-_!s493z z1+k@=-yJ`>@l0PK%W@GyxYtk-d=}lA)*VWaS;S5q(^~6lKdLJt{VhgUOTIuy(Z%kp zQBtJlAhKPeQXp5Z+$(S3WZ>1$$$l$2Y%ThoXu{N^8N&wIs^LdbB}J^F!s0w74V$~h z$${x>-6hAODpAC5O_D(SJeNYm2(8nb8AsaiZzfzuR?9Bli%rCq;HA~lL-QBI<)3j% zvJ0{Fj`2juCKO{I#UVnLFUAYAmT0B~Ewq_D>?(Yktfy;0;oONTNxh${wESDO0|3Ij zt-_e;XzI}e$8k4(yhTp*a>o&3QmY7Q0$iz@X}YC07q24Hla+h1{g2<@)Qk_%w9(B@ zzMi_M>AC$SLm1SC zN~9?~ZE6Ea69>(BptoOyK>v)qG~?^dRCOimFaZGtbmMQ@U9kmzM$MGk#>-b%o~Q6uj^$ zICGF`_D9R8Gc}rE^+MGnyzRwB{!&o^1JeXDGCjIC4mRe+o;hxB%EM=w7(N@pxh7)N{>DkhD>u%*IQt1+b^X zj8_^eU-r$wx$v5a*tIh9<@3>5_1Xc>bvg-r5A?gtv@;++pRG(E@us{N?PMDxnjE6s zPt&S&O2Pih_Fh=t^5N$=SGyW=J;5;U9`=yta{Tz&y+n#r$y-Peu4*n%)2ozYy*=Cgr@eK}=0{cy28+L!~cVmY1 zOXLdZ%lsqM{hxF#=b?j_ss@&#zzdNs??E8!?~V{U}G8a)mpcOq`5!>A+ zMiOZ;ANvfQoUEcqv;gU71Ac9;60}eKBHx7J6D8b6TSMGc?yS?lyEn$p5oA!9Q}G8a z;D)IfJMK9Q!HufVTf@@PFgi9QVExK$?;AWyYu5_gX6JnuP|6GT74DOMDuYb@dU*jJ zku)3%DQ!z(Lzd5ak`CjDUb-~kIK8ZhP}_KSIdg~ws4R9m@$3GOBMA}Rafr1eq_J2$ zI5s1*@fyZ2lAou=NL^}{JRy7YDmvcRSyc&r?d9wHrAh`a6tBuX44$yS5n18U`s9#5^` zKqK$->BwcZyBe-*6Irj%5PDo6PIR`BPxR=N8`g`we*J!;)L7L%XQfB-#I)2(LSJkj zJS8Dh0h!0mdbZ>;cwK3{ikeGd5@z=aURd0fJ86)p96N1-V9MRjrpCy;i3w+OA@HuC zl!Zi%vOvdo@-Nh;eUEm$p&ny;VQ)yefq&uC5sVuO*GL`yDi)Ea@UgIAw&+{Lo}-?M zXQ+GovV&z(POd@r`<=-^<|2(otQt=AG+IG7P$alFegFY=dY}<2-~BX6N%7E}LF2?7 z!Ov+!e8t~>cbv|n_~IGjHNtQ4?8nQ?-q|eCYq3eY?-4tM6K(b4I_H~}PM^-~3R*-m zvkv=-OBE-om(g7*%|m))3-`_-^ywBH7Fpu7O}PH8^*z%yxd2(Y7j`aA-=xIZ;x8Z~ z@v?#y22GG$MuG*hi6Bap7E!qQavD<-Q4dAE3QhzAVG2 z{h5r<1&975%B(yM_mYuE@2 zrTQJVy5WnUJtx5QCBSm6yXo>1p)^n{tCzkZ3-CIzyT0_#fC)G{Io`TC3XbZZ0cRUj z$`^xvg#uDHn*2@RP0*k~AD{(v7$E-tMgRQ&0M=eL?S?edy_7*CRn~eT zUJP`cm2Q1*J6Bn*Nm6o4*qZzbF$3lf5~WyG7RcO>nScSBe$CV6QN5kB)ly<2g{i;s zm=_CoBSEww0vWSCEV#|}u~5-41AFrSBksH7n(VTzv3C@yihzPh2N3~<1QY@39YRMz zM7nfBRZx*G(p!)Y2}Qbe3mqX+LI>%gw@{S&od-nUnLG2{x%bZfzTa>Dc?Xj`<(z%i z-h1t}#seK^c^W-G)%X|CAW@N}*56#z-jb-yT{gisPD`!WYa!QAc;~J;KdHuPP#H37 zM_6|z01dc1K>XnmNZcI8k#Sqi(UAJ;V8;zR?i6d4^gG6nuQlAZxCGD5Wx%$bB^=b7 zyjfCl1D45EYJ2&6tNq)4#JM0hvxKH>XX!am9o!3dWkqL{B7EGW*+S%aS%;2aoDIIR zA=2@~YwdUg+@+OnYBiDaJg#B*WmY7MfYP~Y>x3xO6XO13q`c})vN&%CNomr!#AzS# zY2DoFfRG~w%4P<`E?=bE6Qa<0e5LATjQq(y{5@g~N{h;b)49foHmHiRmz+>mNj-Bp zj&NIrXDb|V4^tqOmy+sDgU4DQjK@R{e1@5oVjlN4dZ5d-HO;>420y_y9BU8bnzma& z78`{>7VYrTu0gE4X~O=B{q_ap>95D`|s%kHHa70bWTT`%pZmP-+KxP`H@d z0&%~0*9S3DyeUJog#F7>C7jPaWYp^WvdgM7S#PzJj0bS}e^|yx($gjF8qdPzdtWUT z-Y`TA+1QnT;|A)=Y|N}ory1feR%_}e*j>CTZYwD*U8fLPRor-T;Gudghd@3iXslo`gdykE0NWaaH8rSrghnyNv2l(FY}IDAmXvhlyG@iiB9 zNLDVr%vqA_9#zkge!3TD`#lLD7#^O$UPQ}FAwX?g(1WL!2+e65qv`a0yH zN~o`flT4NH^7WCR$1cTT1D=(l`D`$Ut=okbn|+NMbLWvqnyzc~5x1=v;HUMQnK!w5 z981qjI-?Z6SR>NG@AczU{_=YyCg)8efui!8lhRtzIxIV1*h0@e@n@#(pNz6ddIO^= zf1wg~^viW!r7FL*Ld}%r!i0cm`c7H54rmCMl`RZYhjaG)gi+*|Gr*FkTXv=DQ(1Tbi9oxwnWVJ8sMoas@&J@Hu9Y4WUoR(}a%K6V+{)13G5>#c3`+&T# z=U8>2&hyjV6p0Q%*H2vT!RR$=Ia$89VSm0qm^9N++_cY&Plv?0O(`wTnb!%WR#Ug} zZFu%6i6B4sjW=@eoQYTsH4N8Ot=I5kG_(HNIWCa<%(a(^x9$^ee2xWVFk`2$>N#0& z`(igSgB>E8_n#;~;W?wjeW5iaxz-t#$|S(S6QJ6RekI1swM!f%qcNQ zjgx8$IhOv@Kj|;LyuL`h>#Cro+irG#%9wgq9VMb#Dc$*vx1BI^h)1tXB#uXZa5)|| zu|=$BXepNTm=_6@4((iJEQqkZzlU`I$N$P=?AIihD%`i^^Fi^g2~{>X2%BG|Xfo(~l(R!cLAMQT(m20RlOzpDH(p zIm)s6RMbNjEFoMu4>ab2NqEb#tJfcTB|%N_U4#y*s#niN(U05BZd#XM-Uu5A(|`VQ z5Ste`k->DK4Sg-j#OV%By+m{9>9wJ}o1H+>(fMHm!7PzOU!JM(c?n+ikmK8;KfI3r z#z@*f8F+;_W?*VmqF(~y$XZtX;QtG-0z-2pze#eKN|*2dKj0OZE3jFa!toMCJP_Lc zVelI}?M=L;+c8&E=XLQHbHj$8iHzef*%Oop2JMV_C6FMtjKG=2}1cRAtm(XxrXGsSov6#ODNkUa^U>c>Gp^YJ_l5*tj3F+*F*-){r(b@*}}0 zU@o&@Mj@!Ad+6LUy@}^1%}<36HWVAOn}^#FMaC`}WaB`D}(0PgoQ@&McV$tsfx86QZf14vhpn4=G$*u z1WK$XDC>s9mD?}6DD~e<;e}X0qccdFzHx_1Wc+RNZ4!=KCLU*~MlNX3-|Oz7=2pVQ z=&7RdkxxD>FZf>YzCB$sGS%p|;>7fwNF$j6%Qn|Nmsn~PO=mNGj_K)WxVRS^Vzi552x}jeS6jw^I1!t zC&TB~G43ul2B|t_o~j048l>IV(czEzjR_CWJZDBIn0;1?Q>V6+EGXI=v%8qbhHW!2 zaemD=cX{Q^%)4B+R$LZ6(usgxeZL^pu~z9BK_87?!X>k*ZlrVAaRxdN&b(1AS%kSZ z+84=N^`1R_XTVTd=WglTb+0qYhZ8j9)5NdV_y$&k&2!OCI5ykolo6XDR$j+6Fq6F zn$c=Y;*nhd7@mlYqY^QSi*m&h+!X_FqcB__Oc5+{FmA_#tzf=dFjHRT#OOmbn^L3g zO`yg(UU>1Lb30u!TUX#VnN>*IOrU(>My(;oO6vB#mF`57*R+<$wZ+e|w|vkiD}To_ zFBBnvB}F1%^FzIff;G>8WDQ2()!I5G6K_Sa9K-KSWoLf=1;+-}2;!U$Tn9wEm1AwK<|srvb`5iP=&1vHhtf?onqvO_I~BtY z^g6AXEqw=e3x;{ji`$lta4YaZ0 zY{hd{msM{l!|*m->SI||M%*3-y$d97rcBa=1NKCQR^Fn8KV z6~W88T~m5(q$@N|@A&gX%$gsBg|l5lWGm=wH|Ubw{Sa}#Sdv@9-Ov2a+03b%YG<5r z@xnYYQRt2`DdEdeZttlU7 zZ%C_H2MZ*QMqbN)yUlu7S$`uuuAj1*pS4m#qcZ9V7SrRscIHi%!c0g0tt*&ORIfdBT{+)zL`#)( z+}ML=>TX!ncQJoCqBqZ!(q?N>U)_*uj#kf)Bxrq@cWQW6g}pdO zVlg*&y)Wy-OzZ4eNc#mwY`$Bl&%*(}O-@V10P!r9B2RHv%#)7u?wF!+tzA1K5jdFcv8*_@DN?XF(^#=k9g*>_6??4m!&+#}Iwy$zl8$Qs#ZP%p4@ZwK-5ZwWnbo=ISko#n{U*Ik51d`@q)Eclur@|==aYHy<=HN?9 zv;OsM%)K4z%Np@gIxRk+$X^wHCst>e+N@4wgA$f4tc{$}Ww!)|5O2tDJEKY%5$UIE zPP`!_;da~TdRzJuv$!f}St@mQ0aw-6KTAcyxkHP`1ZSY>ZjW(wBCZ1r-+Eyi=RxWVP* z-rx0n>lN6I8Zs2+&BwG%8HLr96ZL=cDuz-yJ-9rK>vVx7{U3~2m(_M38$G&~m;O5` z`Niu3OZ#oV%5+n6hX11E-IG_Y75*zE_kVB?@i=J;C2{1VD2H5FAebo27yN zVP-Wy-V{vUOg0NT)7ToXQDNwINt#`j=75gt} z1>JNWXl-qUFlTPAe&B)i-<2@%2jEjvxjDw=K1>?-*I)v zrH@8X;&TtrueN#3{Fr~3k&)r@vr%u`Q}~A`)@?NpHsCq4_wjlxBCPP#8Ed*8TijT^ zM7*0^$2UXbCS`#gaua6Vb;F#wC24Q(7V*VzigK3<=~`v&XOIC*D92&wa-h2+^g6%c z-i?C%izL`7kqrQB>)VPtn$Ir(c*Th^G|cX(6`9ZPLee|hP5P{}OM&5SXXS!;6k^uP zHVg!{=Wk)jPF=L4&|9z?tdn}m(`7~MHlO+KrR_P6r*quujOzDFz^}%0p;w0$+9?gt zO1v$8yd@@%142n`ShlByweCJgZa_5bAB6dG(!SI7F~Y)rcsshS(_br=*_DOPn@%Ws z*C`w8oY5Kg)XQ7uSi8x&t)Ar)Ybq3m*yR>^tMwDskO@@nm4|uSLkgZ_Ih<3e2?tK*E>FSI|vJ)1*76U&Tp}ET&w0ui?T!Dm80!XPe)G4VqLlX`(C91LH9Rf9!6U%BHpF!VWpkCF^349>I2BYN9Q z;dD+DSDcBizudi4KzgWmgvrOl&f+{Lq1doHn^-fB^a1<86-Wve9V1c()PlXjv0ocu z_l}o><3=q9Ki~YV(lxRS6IWScJeQS)6Aq@`trT z58EP?0Uh#29#$KWMGZ;ZfVh_CdtU%ap7l~6xR{3*3#ZD~d%G*(u=hi^d`Zm@u%9^iuh&^t6#GI3ji1E3+<4qD2hSGJvl<3tlKp@A#gBw*SK1a}*yKZ? zhJ0E2r(yq8z4@CU==6TRyFM+?=W1bjI8fM7T#|t|mIH>(&?WHn()NZ1X!lfOxTsgY z+~)6ON3h0LT)tO$SDYB|Gmq{r<}%6GEf+VGl)B`dv3dUXCD%D7)rW1UvC1rcjmb#F zwK-nQ^}IBEq<3yP^K`R_&=+3|Prpl0M`3R%J#s%^@n&TuXa*ua^X+_uHQ-toSZ}-4--}e5i{~L>ib&| za0U($9pC@2|J4n-yY(Y(Uepb#?}Lz&51jf6LGOo#XQ5~aZ43Wq^- zg2|1akjyc7G73cw8^+&T=#x~wY?Gwkbrmm2P^_(86vJNX*D~#nr?<=daz)+iRL9A} z^60!SNCpuqN`ukze^i>XXO{_pY9uK`Lh8#_pUMN_YMnt(5V#f#mzU>I`z4Zl}ubn1+&6Gczmk+=@!d9F*4mD`89LqT3F86^yt-N8w+Q78JQ$SIR_O`|jfz zYAns}Utw?NSJKJVp)h4uz2aBn$Hg?gns!x{v>{pa#7c{-3FKYTt!o={Y%D5@^w=Ey z9sR3xto5Bk`Zgym;j)daBl}ZSlIzn*&8so$$1%qb-R}A*PJQQ{-ZMvi)Dw|kRXc582mm&uQF#R}X$i-^ zekmVM{(QLZiwYtsY;rfpl?y%Xy?C-WahqAS&TTpMb)u-DyGw4rFsEs{@CqFoORIWs z+3}tx&V%tHBIfY!;R_@uld@5Ww&R&B;!=HH2X9};k>?9u{C#N%vX}C&TUIEl7aG!O zUP*7%7It|bs#d{G?gTt|iJ~mM;q$=z0n?|U!@ti&_)6I~1F~lJ7t#Bvs$HWotLl~2 zgk!1<^wI1&I8lf4WYw{DV!P7l%SXv0OpaBZ(%Le0N~pMZcKNZ|>!u4|m#nKtr#61; zU@o^2L~5_ABs>(lV1iA5tE1`_Z)VA?O3ybE_0e0`*+9tQa2&|TFXBG+;|iWM z0)#kETu6JiB+Jr`@d>x*iq~^LeygN94muT(@ev{!p!WRl|zD$e|xgr`@gwnM8}K{Au$+Cp}@xh=*=$-*!KX#zlJZ$ zT1({S3lFj{s?ko}vTLLJeE-$Uv|=OYbi_wlLqmq{jfDY<{ovh(Dv>zC@qe?>cvJ>; zXZB(^|E#xfh#5;#lrqC=q8p_XblakgWb%##iP^@>fi|zEUA+$j44eH=}&0- z9S2`TUm(dnS*g9%)%rN1Tl$fO{r;{8Uk%svig{e@^#FCQxI;hRNGbt)<#Z#);2Pzz z6dj5)rpHBZ`)e$Id@e=nn?4{FRo6@}8~Gc+Iu6iY9<6mf{Zb-b&5G()I6b}bZ!3%y z^xJm`d2+TXUDroZhCvILUU3A2NCO?6kRa&n5xLi_JU3d&9-L-DOO>=dC_wKQJQ*}` zB+F6d-Xpn!#bJyw;k@8e5cRALp|=AB-XW1OQYNlJWWT|d+=p;;?l|~Ge;J1<4cxmV zXYT?sf7L{>s_}-o2iPH&!+AG$V={o6MMdBc$ps?HQCr?Lr^**#40p#712J;O(mv^k z32oYBP4BzwiP4u;O!-kv({=t%&csahx8c8~*bX`kBgH)rM&IaBQCt>_#nAIf_@#+r zLh(Nf$So@RqGPCZq=#4@0P(Y3jo>bZkn3IYL~Vz5Ato(203B&%81^s%(fj*@$m{-l zuMixm&+(sbe%?hD$B3MPs{9^e2b7lo;fH|U!Zh9X`d+!>jnK|9 zDlA;IJQ!^GtJd+pu<)_F{u*F^@4@Vn6__1^B5t=8b*c0<7x9 zL_woExp${mwg92(I@w-gk<0bFC*lld1|Bf)JpfYL*?XQhlo`Yk0XlTKT9e2jBZmqB ztw3LmN8w<5zS?^j{GT)g=SyR)-(jQ?eM5(hK$kUcssGbzPU`HH-5?kL3wfL64{Lwl zl*)t$0#B#jxAS&XHXsD<|J7vqOBo^6L!6TEk=-RvLxvj|Fqcwaqw_Afl%k|3*3=_p zZ$d!xtDp9r(6q%cI1U)0)EXBhvZDc(zXxSO2@7TW;vzS&l|Fd8@N31~<5#QG-o78q z;}wIaI9=_qjwosX@n1GPhWbJZt4gwM;+$QfCST!}wm4Umn(hsd9PC{X5G!#b={sQ` zEbKlEa`&0*XHX6%jr<&`cTs1NpGRel`PuuPMI{rPHiUK=$#llBzdEE8*VsSlfp{f-u)cU%gl8Flpa1R zKp|&vjc|>RWQ6605Ej#`+C+$o!(XVk8F5$zYNjfd!4Ma0|GipTE5lBZwkEQc?JwVV%e*JnxPh7+HGU3zUC_Mjz@r{N<%}b5p36EiT7kZz%^&X&{PFsl(Y> zrBkR>dOqbg-r1BwhmEdQH8!jbPQ~$Ur}6%CfhbmS`%nBJmLW;_&v)Mc7gw9eI$&Mx zudx@)z~_1Io&h8au!?L81+9Dv~}#G3#OPJ_R0 z0x%gsL@ibhE#Y@OTSNH>iBA=hWej3$2>LdU6*e6EOZIe2l;lwb#2DI0l+AT^LGgy_I$U;7BkP8~uHA9MoJ-Y@2Y5g7ZtGMGwovr=T8CQ4qah zyG*N>G;`h~A;F*NIu*5G#Wim3VnxMVrAsEJ>GcV>Lv~F#DeXwgC0QhA?HRdrc#~(f zN#R{OMd}3!n4u6%mgZJX>N(gQ57oNzaJuNGL#uNo&FEZ zF(ukl_sq%y+|8M8Ga#XE173LNCn&xP|7Zu%sESm6b9=3_h=xc5s>d!bl+WH$o|GnG z(S6|uH;2uS)(3kL)2u`N2YI)pV6X`Jkh8ud3|IY|`U|)1(YH0!fHQ?#&j@9qZwco>P zmDv6S_2L+p6?$m4gYc7p$kr_Y<0t2!2L{eaUH6ezPx*>;G-xjIe7|LH1sq@?f)Vuj zzqv)I-nx6Z{>u0F;NP!u_wFIS+cbfRe2(cU5$tk;J^4yMLMQ_Tjbi-A6V8Ke-^dNy z7e|bi9F8YK&v|qf3DsqRO%Ie0p^{T5qwJ0C`B_>Z4+WRj2#EfWA?G)^ze> z?lf2A&I-C{2KmZyK(5(Tq%{(6oM&ts4PPr`3+xvZiCll8vocVd)x{wDA1hL4K23yU zf));s)rW@Y6;*jRKHib;+m-yFL{SdpbvB?!1+*3 z+^UcYUGZ5?AV!fmUoa(Sw(~l1{=Iket1RZkfIx=B@vxGjjvFQCsURXzM&4o5BfSGn z8Z-Qhq|507y|Io4Ie=ygPF$F!>>p?D?ZywowAotCajn=dG6oN%R~84TmE5Jw-XmMD zO=0Z$GpaQgXX}GrdPE$sqLiF9+2~3i7A?$1A6Q~lJ$Tb43-&VNtQec9xDN%dSm+tK zVwut5`)j0n2$}Cfg;(KR+yhBlNLdL1z=x6MU6b2q9p#h+h?b%Q>_^zDILf+STfA4+ zPe?3nMCpqxR;GN)4=K-Nokr#6R9~oH-`1^ivY>gX-f+)Mj`UJTz#-eB4DB<47FvJf z5b0hI(%M_gryeafA|rYVxh_#eU#krS9T1I{V^{)ePXTQ0@mi_rSX1eThrQkghpBh?TJPO_IDJ+k}caek3nLT~4rq|5Ea~o|u zUO6D`U7BWRw6k@@j71HvaN`#`rR3x-vaitzI0Y*?L4so?CQ`k{s-HPtQszaee=mEo zD6heZH?Kb8N&Z^=`nZ^M z58*3*f>8EU_|v#A&&kyh;$S0_w(YWOS4-DmHts9ltj}RGc48)x0nnZFsWCu?zc&y5 zbHiU=1FOT*H?ye3xSlkWo*h?y&2m1I!Xo!#NS~j>+r_`SeyTy{Jj2+^HMyruT~-0* zo9m-ax>mJ1nHFDA_{iSkQo3**W2|prr?jZqowKX72SXRHe&l)eG!wuQI9A3xA}u^B zsw+spc-5vcf9(pq)m6u~3gxN1T1ZmphNS8l$xkw(CUBVp6rS)@xp-veVGv8IA=+8& zgIeSep7L5303wVBARyw$?KcPkk&mQglsZh;bWw*LYX&DpOaPu#3SBmKGK?+A?@=XD zU6`8czzu0hnfN={3ydd(a#(+lkBXi&Fzn0 z5Tg8MItcU*vJRf)4*LBmPZ^YT#xGk_T7b>MCNcS`DL%FGdJtUxAVzSEMCoSR-H_sdmvP_3n7K)>KxK1Y=F3IL$+lAK(0Ft?FZQ@xA4w!H z=yT=LTVkn={O%k-aa_lLMyR64=jozWif5(Qfwt$lu_0rh&h4J+*_bD|b686e!eyGI z7Q%-g93J?U7i>$jjDBED8FYf|!c!<+l6BSq#X2_Qe;tiNYVRw<%jANY~cEc&+&vzItp!Q2nC5p*4tyJ&{6ROBw*Ia() ze)P9HA-ImvzOvh;0d()vqwt7wF}sUJEkdQh9ld1eh>Af{M-etaUW!qm$o12DUB6jM zaNQZdl1K}QIAcbELn&53cn zEOD6Fp7-YYGI&(y(B%A&B$Wi4UP`~XPC5QI$E_RU4~? z*VtebKGbW~O~bFfEi;{rU*h5QZU2t`i!b}?a$hERpZOqRr(AkopR9CbDk|l*gMj^` zbiWkEv+uFIBbAm+tcMRp6}HSh`l3r|S(2qK<2`#Fw)I0J?W##hmUY-1>zcA~`htGR zWP&w!O`NH+smvT&sNYg@wwsMP%iP3ei>=i}di(LKRKZ^)b?;aF53NdN?dt6{GU8QU zeu$4=9DCGHTb_sb*IK$w?^%a0RXxb|W46P^t(HI7WuMfQZVj=@nm#NX?Q1`%RV~%%jTrD)C3(Gb8ERF>S3;j8CNR* z2{n?+$B|1}+58u51mSF(a6b4)odev8$q%V@HA1WEqeNlY(iv6@wMSk6#9VtEb`qdMC@43q{>$a7QIrz~~`PjrV;=72TA7Keboo||9^55_GZ>jbntMB`l zX{DBU*!TbEt>-@0ziU0K-9P=5?u(>}|L`|G8Pe`Yf9JwJ;WKdEirDFa_l|YN?kb3L zpN}1U{5}u1xlHZl?sVme+3OEtlhJYOm-4GDyjTZlT1v61(39|~IB>SX;UQlN+lQ8p zxl*xFxpw?xY%u@E109~0+fq$A%Tte&VzZ8YC>HDc@ya|Ot`VyU!@BVunI$$&{XTqf zs_tPumy7$-oJ*GU+C*kF95m6R7POGbu`*=;j5SI-WH|T-y1+w#&_V zKd+_p--aY&=C=|MD;L0>0 z5A3VXELte8XBD~@I4R=N@sZJ4@b=z4L)*q>gFPGi0_wsJb*7;Zy1#WRR3H=aPNXkUrFWwa~5K23#Ls2fd$j-C( z$_-|F_$<@=T$X1pwg&w#V@xK1G1Gw*{-f&c$|79Ln($T^gY}^{hg()y!rW`!ps5aZ zl{|h;!u7AR{5nBe2D9R(E+PT#ruET9nw*U4pB~7|ew_>pFXe zd3%u}O`%XXurk!*NZkl+3=tun%+$G4UNxmwk}_akz;;Do;QeUzvYeVMOO0qzCUtq^ zTOsAV7*at(`PCzw1^D(*dH-y8vA0@pqqAe{-q?;HgL+d+KlupeSSWu8O6RmWSA2#) z1bxoA#S={uBpcRcl2AI(inccKD(RO!=Xp}5;Lz~P%xzw{;`jJtPCRT?N19)-5xxIwBxwGb~`q+)-Ifs zW627=m7i{F;E4ni0IShzYg+#RtZt(86xu`Aw*LmLwqN?9 z_f_~jfee?x=vMhzH849(OZlzx*M*L>=30g2Nvi>7cha1@`l1CT4$r4lPi^*`l^U3L>klv0L!d5yT;LGga1myx>*t^%j+d<=1cEr$Cb& z@R7K}ign7=Icw}M$5kr zvI1kB?t{?#w<%s0kjP;I4ak`xByHgp0^ep;U%Y^qBMZ#tWh`Fc zc{$*k`EJ$N5|+ndMF)aG1@OfEl0jst)Y?BJoR#Va-W(H1RPFF{5-+{OMV@8IXLg~D z?{K1CmbgCClOFb5Hml*>?w#}edtBar@yNEHxF3h|RKmkJ9!k`dgJHT%p=_vo1Ug2u z4VL!o58V!8eYxN!_TxxZkJuzn{48rMn0Q#Ez4eWm|I8F9TQcq!`zjT@-h*PFj_d^BAiWf`EdDqdN6q$&e7q7cquIiY)4R?hRY-T$qL+*k`6fX`$eE(?SsnY znKqH>A(%1 zRBIpBi31?S@dI4ViKxbd=Ntdg&)q{xLxsv_KJCWvNC3Z14*wwBO3y)b~VMs z&_wWrZ-{fpY{>(iCHiVv=TVPk{#a0u!P?XH!?gxfd<9ENzoe9uZMrbKxRTd1H6}yjA$V$I$H8^mHRX<{#{n*XRe5nf^ZKpBx&38|) zHoQK+)P6c=N&mhs4Nvi{>$AB})bCwx2qkOdwLlfU6`#qtNK0X|r}Qk~%XfBOQi%~z z#JSgGvPN}gyE+1`a;xR4M$@%E@2({8 z(#zwQ!c};!Qv9|2wcpUDO8>9d=h8tqM9*>)yk>dKt<@cgkLq9^rbBid!@e~@m4qj? zd99luMNP^QN6TxQF8TEU6RIaGprB)Vu+n%HR%B}(I`ur#(fXQ{m>sK5CQz|8 zO7WfMnL09Q1E%}76yp$ zP}PEriQX{gI0Ob1>P?P(~h_LXnY~M z(w701rU%$`jw zE{nQ)(M~jFoQvj(7#s7c$FZq|SLPx_&vA|`S}2`vr8A)Zb`K)}ZbaAJbUclD%1$L% z#m25BYJRZ^Ic?L7fykhB!a}la z0w!W&cmVkm@ljn9*e~dCxE&A+GBH@XBzt$ry6G>ch&! z?{yC-pheAU=vtCU#B|by#eDfIRLAsD*Sg|q9|cWQZB}nGaLX%lXb!KjX|Me7DJdvC zAkFZmsfZff8N8o{w(%GU5x*9(?Bp}DxlNx_l z$nHW_v|kOe^&0Y@tLJ;5cFw=t75ja@LY1(p`cr#;I53+j*q=(6>*iwZ6vaWJ;IF{F z9`d)Yf{xH#CdxBoXqEg%0{@_n_22dEs|J#eVBBkcCEMM6r=O9E5?JE^w3DL;40xVE zQ-?XJsG{<6*PoP@95K=ElQZ>n6-$|rEk#XaaUK^tJIa+X%gE@mDt(ZM$RB$5&Uobf zR%2;4$Mz;Q)6P;OcBekxXpUhcv{Kkg;>7otV>ZAc%$}C$!Ep%u13Ck^TdoS^cBydm z&(^#+;uy~v1nuqZkCB9I7w|+@eGe1uwNnAHXr%%vD*|3`_RIH@Tf5E^48k%9-5B>dz_nOyJW50a75jlb zhnCg`ZcT4p{2f^^-K@!>@Ph8*r+46Ob4WeG?U%{Ylr!OHh=`yfIz%&aGhUq6{hF+W?NF+@tB>mmhR>}SIGFAe)>?e(!8q4FO}mr0d_^6@k={s&CdqqM(oyRFm5wP>nbk8R1i z(b3UBbmkIs^(fP z)Qu~n%AXg0nU;c4ME zbIXvPq#hL!kpu*JXJYZ>o9msG74Kc@e3?d$GqG>ovi^hJ#ftPw&7N~`}#J43a1kghI>&(M9`o^@Oe_x2 zd-S;YEr+Vnw#04r&>mXbBi%|7+R1*t1czg)8vVf8RL1HFS)RtqD;;h?k-WM03@*Sd zPy1Ykz9ZJGi)~og%ryAH+4XNot$al!ifRz4>&tUd;6V?dNJi|YhGma^rg?S-EV8i;GWFX@h6&F*I4b{jUmU>qaiidgYYNxeU?IwjV4#(9Jqmfd8H z&iNU2H7m)1q^i^6pvRx<5OQ!7(~0ZH52b#0oJwZ$pzhjExpuC@+144Ex<(#G==fAr(e8RpZb37yz%A(u_h{!u|2ww=u- zQJ^}|SuNsq{N+cOK&w{|$BU*3j}D(!;vv|*tOQ}|bk+n@pRI_x0uMWbHl0#k`b&EG zhbxIFQ3c)unOPchSCK56lc8xpgW9H1h}h4s8@sc5cv+5K^%dp(JPKki_g)g)WNYVo zZDWlfz649X%=cJ-f}(i{?IqrFQV~nYFto*GrtxKL3@UXVRab@RKZ=uxu)pV=7uwg8p&2@LViw^3i(6e7j-~)S+Zf zvG@0!JFJsvFY5quCpxxBH)}HLs;`Rih{p(^J{#=iPEnJ^c#ZpuH>*F0w4^Ef`TY#e zBGr5uMkNRw5vteyyS&#ls?v0W3gt$U&9Z0nx*lEV9g8bKnI1cQkgS}n#rN83_HgXy zb66fh_73x6Z33@1xwq~MZxA;2f1tjLa6A&YD*kyafp50{asi(R$GgA(xBol|XjWRc z;0~)tMCv3Ig>Qj%1vtw9O`4`)ros6a%R$sdGF4le~x3jZdi1g&)!BHK(O4DGBv>_i=vy!e~tUPHM<)k{YmN>Qd&H*RGo}8Yd zOl~--IX;>-1Kf)+abo2n<}E#9t85W3sM&f`!Q}7naAxC$XkY2xHG@ypb)x_9T-H)* z=z8J9uM7%rz{Wr8i?vTeS(GPTr!wUmcf~~Oau}7)kZE*OT=jQEZN|b1Fi9_P)YB`C z0`zx-)}4E;rPK3{v;OdPI&_}=Jasf+knZoK$YTLdu+9@*Q(tO@yJRbPik7fkcsz3Z z-VIaQdoZjWQd9X1A+?buzBVmu_#4}_bm;3C-8C3Pte8)+zO$RFjrxwE;Jj@{d`Xl@ z=UXEZmE#n+oI@A0?@_uB8RY)ubO6}k_O_cY@W!?IrgTE87KQ&>Ut@bjitJKYkYKvA zE~ENNjnmzJeLjVsY6_yTG@kG}j&PXoJCRZLnP;{yCu&l_*4uwTN3p&&Jm+WSO{sCw zRdR6bEr0mwID_IBQe?~s+{7c(A{3$~#yKbXoy1bP`4YRw$tD!P%t+OL_zwQ_gfbI_ zg2S)!4`FQr^atEZCQ~q)oyjSpHJDL}@~~x87EGQwoR-VP358dcjulh5GK-u%soL{l z5ID5`J^%)hEyqo{Pn4s-2^u(-n5tlH+_CN9JiVY9z>*>g|2q3glsUZF0w!-+fYvUc zq`X`G^&|}Y)f#^u4&7iFD$5|6W7$#6j!#I2u$nm?BdS*TR*z!u0AW@%gUobgh#<$f9x7XiTkX70s#da zvi~h0`FAi>7qRa*BWFs1p9jWJhy9%?TqlpR0za3B2)e)Q0FWVGtIZmfld@vrnIgsm zYY3ZgO4D)!2~bZT2z0*-0A}^y0!+x3ZgSiI55!s@M2=W}`bMy?82)NK#xJE@v!Sq3zTP;|tV1VY>C1;Ms3O7=G_~t>bf)S7vuHnX|1A2hqu6P*XEg6L z={vad+238fa3Deg?eT;X!N8kqA1Z?m&jZSmLxeK>R0b^{7AK2Q)$EE0Cu7(6vc)q1 zRNux?X@4CwRpio7SW_-+bywC`?L?=Y^m{c~(<4aUS-QeO6O!(rX} zQ8#^6!uz62L;QN|hF*OBX^5E!%=L6{XjpNDmO{0s&M&>5&>~ zK@bSNg&rVphNA3!&-uN#-@W(z2du?fbImfwH@?vnKYvj?O!rA7hI|xrbPlQ_9@WjQ zSKzNL`yuIGizF^hRJ&Qn4}C&070=T*AB=tWsgOfisZA?x7cR%g4LuL<98mvEhu$&F zTFKMQD)mrto2rH4XjA3t4WKF!l2@{MneX~?yLmvuJ&I$SBdFYyXjCKWHUjKqvCGz0|6_KpC7PH3#HI_zH zSSsIo;wLD&zIU`RBOL8{toGmtJX<#OD)0C0?_-8yPS7I)g$q{V?UK#EjQ&CdX|Qqt z&&LzTwytj8{Z+F7JPY#WkTV^DfK-IAm{9Hhxu3?!SCDy-^16<~!50H&>Nc)xgH!-Q z-F_q88T7AvI%fBKXB|e#RILG{WXm%9FP97UiCl9xevdsR=p4rex_|Bp1+3tEE9Uh= z#mMsy&V!K3UxqbE*z!JalYVwqr_H>pmlvcogtF6<3PB0tY$@iB*T#41WSteL|()-N86{Juu+E%6t;Mkl_()##fLh(E8{@_ z>0c1e%boB%m-g+M(v((I%q6}k9~%&*hG4wg~m1UlzSrHs>wKU$EKJ?=YJQa2lQ=geTi(Tf*u8e(&J#+K*ka$3VT0Z^+ zB52!={TtUHad~GWfmCzbN}^I$3=}wKVb#1-N7fWB(P?mQ=gdx@O9rBp=xnLg zWF}vG%uZI#3NdckY4-Mg7Kqm7?K}H~lduNbb2VJZyMUP1SV8yxA*&wolp~6oV!L&) z{)GanPOZ2lem-aCThsVYB)xERj@HY_qL||&z9U>mO0q?#p|s;-4X;$Kq(ZAiW#|gx zW)t_1_+~mVNJ+N0gc+geV@ercrN2pboTe9_XZd|ZHwlGrS*<>S$oJ76=C%WI1}J45 zH}kO&NB%4jd!!dXi(^@eWs2D@3vyyR{>OtbzZ1|7#~`M(XmM$cm^n zSrk3yP96Ux)!oV4*&?7aGRoq#&RWW7cc#GhJC7iwmB!w#oy~jo&Dvw~*o%h97Kghy z0W=6k*5&S)h_sH#G`F=E0AEl6bv~nhDZao} zUND;|(t4TiO1ERPM#iYB0K+>OhXfe+R9aKw>~X?Xf5X%~tg}X2x|On;U|8kc4@=`) zgZ`ZJ8WvfdDMW-8XWoUvc=>Tlb*Uh_v|Rg7a(}VmtZ!lX32Gk#CeE~yx(w*&2I}Td zj!XG-9?LoAe)-s70vl9CYO>;GNUaoJ^;jrdG7r9q?l_7#t6W(u|A=^CPF>ErI<$%G zr}u|_sxjT{aSh{fd1c4nM_JKMEb!HVZ5+VgKryr}ZS@W*yWvR@b?7G7FBW>zNtlt7}zA-S<)YLT7)R<3&kE~RuPX-wH zCTGtW3=GrGagGX}0dhSbD9{=JEl;?@P5}(x4ulaWfY5+!20iL;nE}c&2~d`DkBHvj zdm=&G%LovteSQy$K1mAaPHA!{h9Ph4w>U9Pg{V;*&xy!yBN9s7MIo1u_x*ea4EPyJNaq|b|f}!&b zlk=Gd^9Owz1_BlqcuU9V!kQLs&SZ8jfsLdF)`B{1ian&kubE?!Rd{#JGYwP2d8OSR zR^wMNx6rSh^Lh^Zq^iZiF?Iv^<1HT$3)ll#zMq$@L5cRQg)$Qtv%AhaT>e?URs4Sh#a*cPwF)= z@y{1X?io#*u#}X7lV8H%E||0G6{ocnMTcme1PUp7V{da_Tv*$~@7L!^+M^+9 zr(rKV-7}-|6|WdkVudJwaD_CwO+LF<*I~<0%I7Snsiqf2lBQ{tySjw^w)QA}+f12^ z!l&uWN~TA90)wq2CIbf%4dVi3oJ9pqSTmSWH&&qh{Uk_6P069U{F5mpC>GH!}QLEiA#nfpoDQXU3_tkm|a1WQ1nz%D+6V z3m9SI62mdwt;jlh%ssusJ|}?d8I$c`!w}&Exy~a(C>?El+7H8nXc@|WS$0O-(k-*t z5<^RT=zGY5U_)A{B+E_pJb1lIe5aFIo_66902W)4q(dj}N@-kpTpBjd{IzgPjjq}7 z)pV;OF*G?#L~y~&{RC3-7>+3>YsH>1BiDz4`p)?eWZcF(9V_T7$Y}l<2pK6nQ`k} z7lQ}8aJef?vpMsQVl^{<`ap8QTeFGhww<^&0p?qQBO|`_4XmS8R`%?{k^XR&czCN} z_t0B(zVlIUgOhf_LWWL>Li9~3)QL`0qezb)Bs<0DVD^K?<-g8@ha1eRAm1*21QkVh zQh3I{^Zm%zGI9;M#5To?xw+s1F)vi{n)=xbGhgRCJ~y$wUNr~r$CR%LVD!rkNAAVe zUL#$3ax%&&E4PeyPUItFA8~|^&1QS53b)c8>);~AL6HAc8CGc8_b58~R7pXuWv`U~#2}Rve z_#~l(5pwFl^mHTOIjT3M%ss$FD+4B4^~V*%|K!hLLxT2o>98_~x#fLNUr8ThKKs{! zfg3*EpHi7b5-~k1ds!0hR_v4U@R;3q;65O|sLC?pq}XKfWQpV03klZ0eeFM+wct#m z*p?dT#MKHfOicRC_J|PUQG~OJhPM^AmL6_uK)5o3ioK~gzU3skBDQp>5Y;Mt$YeJ2aPiF%UfRm99dN-H+6{w zEaUm`FIAC`oC`g(va$C%Epb*I$y)VZhenFB@f-m?Z#CW~(V90(Z&O?zx*51igO&L& z7^H-9<|>x*We64CJv>m~RGiV4@+bDRR$8D&y^XE#v|U}Fy7Q3ZsDBh)F`}Imf=)e= zdAZ+Lh`ul3%Uw&nCFOcUSNip}nC=|b`NN~U-?;grT3k#AyFREyjugDfyyK5=-b&Fo}uIf}=A94ix)g4H@XZ z-A%^2V_hP?qWoOP5h!u>aAV~^gpKOGL!t^s5tc{j$cXvfjw3y-fHy;Hn45mmcr=XUpPX>fWdSC-Vn@4sbD-8+m2Ya6lR^Os;dudB*y6I~q=DCV!E zYzAi}+Ewu6okxbVRW_NnP0M#mGqKG0o}U?2x7Z#UT_bgLTQe9|j2y}$M^<>jdN1aG zP;V$)V@xf+fx$jF?g}S~2v4XbEni9*t;#-bc}RQN}rxXAB!*fb4%Ux#A7 zYEeYkV>8Oh-DIl1Y(5=;-GspQl-47Y4bp?KB zI;1M}yb6DdN!;5|4?WP({n3nqNOLiEAUuuDVJKqcpt$(8v{+U7nI6MxywnPpmh!(8u`j5N${$J6L*v7FYpXpaYmTW{IVN|a%PI3izhToUs2zKj zz7iMysDtKDsz$IiuMQirnOrvYyhjhU1KrAgLji)Ks&k%aeR>nAe>5ml&E>{7ak26QNn+Cw;aE{{tw7Y@y! zf3T~q!#Eo|B!XcZ#lO7uY@4J#iy2)=7(u)x=4(sXxT4&$CcT(Y!VbT6;j>9%{rO7>n3F{I9Z@|il({o=0Kva; z8k@E4!(GAT4x4wRSo`Ft*9qEpq{$RGYt2~K8@G8vF}9A4HJH?3+-@8L_wSSY1U&X7 zS|sZ#POq3>N!})Q^=g5}H`179QTa$?NlnsiC?<6K#*q1ZH^>~pa0c)Edu(7^^}4FK zdXBRhgRQvrty9o!gMMS}(ZWkX_-!BZU-sZXA`dd=mR3l(p0Zg&;Q;f|TW6#^9#(vn z0URnj;H9Y`!@}Ov8FK&ptjzxVT$}Vn8wg=gTmM<{)PL}2DxCqsMA3MRUdh^ye+32e z+srSYT4^TtER716-CXAfjxjTXII#%ea@pic$P?~-jP5@JH{<|VHxRKwl@k9k2D zA(jRStI;aq1~^2WI$IR{>oz>&imIamMi1^Z5;j{xsUgJ#XJmAJ)umyHuI5T`DvG$j zgia~@2s1eM#`=@ZR;%PP_tjxlMDTM_pTfTgan{dfnLQ`cT&7J6zC}oOj}`^x8!hn6 zJ=iZIpwy);=Bck6m6_z$3C=NdTjEI58PPEO0TgkYMw`MK0~8wcjHC6_JX5Fg2n-*Z zOIKh%Y*`*1DM1X<0RqFGOrwZO#- z;~PxXZFPm!)5#qY9$<9~@i>wv5C~EPx6~cUCQqCmIo-)nwzhh$(DmowFbU%({Qgvs z-($B+q47HQBQWv>TN*BTgPG;9J`>Bn11~U~YafbAo0Byr1ntc=1`w6Lk;cP~rsZAb z{>th1ykB5$CDf2cGG*t>^5!FWT-+PT>9GjO-(oR>jgN42v{}A%?XygeIQ)CDPrZAB z*eRvgO>Z(j=LHwx6OY#_WG@ofxJ-PqlSW~Q`Pw+Q2j&$~W-SnJy{l_nPUS!Aq;O#ms{caew>99%S|s#dVwrLNMDSMC_ecDk^L5)cvDV3-ZXu3cnDSmhED{~f~+G?a9 z4kFvnY}lC1EFg9zVlwr*a?jMQ+nwkk;0t zrAp2Wb}#fi6yva`&LLIP(mUX~vsO_>RJ2z6^HAIl&?|fc5h?jxTp(3>e7#n{>!KL9{R?9kvYQktxv*hp@#_w%&J+Emc$~csTGG^{N!C zqhk&m8ygE~jj683bs8{_g<%7ryXF``%r?jhJug*^D#&(A73isUAB*i7*Do8RlYT{6 z>_(ECYbQOIOly0pc0*)$QC}j3D|Q-f)0J3#X--Fq47Z!;?%BX*mnDtnpsy)j6PPw+ zbr=)m#vbZ}15gXSI5)~bhA~RD&O8BF-Phe$XLXS0TLZq6m?Yd6oA%W%+kh!NM1A-r zT(Qd}VP+s8Yef{1PXx+lc+{Qklx_uz!@+iG-^!=MkUy#1y_7DhptzX4HW25^f29CK zTWEFj8eq$SsMqHZtz({Bo0v;>GHrK$?o%dE3rKH^%cq8f!QunmFY7O3uq5e9@biAb z(X(P56SLBbqYQsu5Q~iH{EkX4MTalxl@MdyJ!^$UwA+Vb$0Tdw^bIpfpG8&X$eydW z!9D{~W9KX5N^;qub}P`e4xd93+EXS*w(q(cDy%#9%#->{y8(7v4pDqavYP;{93bEj z-BdNf+3>CP6$pE+lI>@vL6*jJA{?byXVXQ@XE$^rF*SY}M_^(l3iI+3k^3Q#b5w`J zgHbZVz-wthg-@UQ27w@A`@pTazIkkc*K(|Gf$i|Gk2*=w4-F*@lr4XXLx^9A15;8A z?JPm73a{#y_=-(ZcOneCB90t733)?3{f+U&)e!@6_v!9~h^X=w1ZwW#d|z!7(ZMPB zOn7MR#S*YQYs>X^053f9>IBDz>hpNeNa}yrSvy%dqcY?q0?pk6NdYDEsDIua9W6}V zw7uGUBGD_YG;7w0F4|>=5XcYer{|6$9s>(w5kQOH!ab3}P_OwZGV_Y7i;Gs7?$$jZ zN5pfkbtZIyGDDVumY)*{e1&xhr}#;@?1dZ!Si;Kgx_}1!aR9sOv%_69u zTSEC1_!wJDx`oyh+@6x)EbaFi$5m~Tx}9vBERNAAY|&G z6st)5rHg$51R1SxK7$o-W=p0T)F?fb6g<^~!tcEjUhvXy4|05^dV!ZRG!r@igq2>| z1qkFQK+y>iDMV8bAON0xdebvWS)q>uGj&sMX)Tb?V?l7W6vM2^VpRBPv;r-@p0IB_chdB>0=}PaGTz9Wso$RZ12DT1ldP7bF4_<8( zs&t~)jqRb+bptiQD?r5WhEFfbozVQ1*Ff+ue@2Wkiys>$l_BjmyagN$ znG$m)%x?TwC|Q@3N(nf^%*g-v0v^sk}gu)97)@%C@#JFB0U9!p7_W zlP1gdcLDRo+}vD-B67+1>8JZ|dZ3V@Pj3YT>(R8L$u9xnrbZrG+jOz+U%4K^vkWo{hJ&!*IctdEqjmZF;V-_NB3) zWc+ev?!r7Ev(f2ShqoP^ieW%S@O3Fmp9(sjBnzE%!AQi$USC)aOQddP#T^^VN&Ai{ z$IPGB5BTR!Om9D^K)$umv~P*k_1H6!wNRDu`D!Y+9#az+2J=9~Eh~}1PC9pH<8u`~ zP#kei9et)8!IwQXErYM7)pa@wDJ0*Tv#Lcuuh$eLI~69Zbmdzb(E=lN>jc&rV?4Ni z^Onjn`p6M?iCGgP)^;4pKclpke*BU!ZEfzz2tI^-Tf(#3`BSf$irqf{Yt7}LP1eE9 z&B?}>={IL_!2sF&&aP~F5*inAW8Tv?nz;j&?A&nh)0u8ky0UtGrIlMJ*?nCbic^c#@~F0J+ICd^+DKLR zw*CHzR0O<}Z*n#d2ow|jKXTE+%G0*H$mu}5k(HIg_U%l~8w1c5c%;}5{|A2t-mjdT zoOhI%lainBU;bvt1aUmDv1fs-*l)22v?l_|6IW*gb0wyFm0`9WQQ)`(i8X&VY_Wn^ zThMWA>jeFii`V-Rz#Q-BEXFvjIt*KX-F7^hPvhK|mk9&_yGG`WCs!u=YSUJz+Q&}Z zMg!gOs+Dz{zERYIs@M+Bfio2T69@{S&6ATnPtwz(!r$SqANVUdi&y$;TU$*Gr>7QX zq%@kb4crs}Dsw(BQTxMeYDYzLDCY9}mEjCUi+2sjuEDSBWlUkC^vgxIX;4KUsLBA) zZlL*UX&eVPTCC7e47YUhhu$_hGT5jEbk#4%Hc(Y@*GOzC?1O?M^mYOa=qczZ-oZ2q zf%0{`!6SfY07vJS%ty{QMQtMkQ7Uz&35go+s30iY!}+`l!FaImMRYQ*Y^1tkMe*iIwA#7=34MNzRr)_2!aPv3#g{e zH4|nWq>vF!bu}vL^=chmJ4t*~sg_psd4$k3ZJaq@DG!bd7rZx;uI2=T7m5DYn+cA- z0}GdBf#TXcEL7XE@AtA$ZA1G#+ukyT{qTE*fnf>TrZJWFLHR)9{1z?&_9{Kduie^X z&Ap)TbND$f&{c2tH?sNf8i+t#{g2t2Q&elrV2xz1mFaojVR&Xh0YZC@yaO}|7^ON7 zO57J_X_z55ZiB7q@8?FifB9Z1Hrv&3jsnkLShQmHU#ULC9MHSpLad$Ud$4(?Cs9Uh zT5SOrw_2-Z;F*X#x&!iz8h8`&is-pC5YC(qlUTK##Hp}2n{*tbxb)c(u=C9{nsz;< z8Aw)eFBQat?%CsGV_3?~Nj})>x6--e`~$v}!084RcVXlz!z%m$IAzG6tDD9qrgV8EnHyg^HzPA&687q}bPA!VvX!rN z@fPLzPRMR5UI8X)9L3>h8LwW>WOjFT^@|cR!|KeaI&Gs66WJ$_*PtX5DZOLEw7%p9 zo3CgiztFMR<&GGiObHGy7SPW0==}RQgW=L=RB&IQPo-pzGblK;{rLT!rx@AjR ztHIZggWOmK1_t0?X`(_{V5xW&PNRvXJvp|St91CQ72_T`1-3_g@UpjO|0HfGU@S?y{A z8c}qVIJdbeUXaafmuUu89p^k$=ywYw```Q$nlp1Tl$4HAEFo&(DL)0;MU7Npr^)h8 zrKEQRVjMCP3HxdcQrDM=aT2amKc3KtUxfMI_S^~SquQy9G|3Wl1s}D-kfblIpROTR zn+8V}+U)LEiDqRSa_(RK@R^hr^6;vU-SUa`p*25AD|&pXkss&3KJoUX2{COA6hV zc%1Y1LIgYoOXyfC?tX^mY*f$U&`WUr8RIoG-0EUG)AiZ1tOqZ#kimLb#T91e?%_mp z4tOPG{q0JZ{XXn@30hRTEe+=M6i}q-WZ1e|MikoQyT>l=dhea2sTb2bl3{8qhP(Ij zrKM0VF_ajY=#^jIU~>Rcv>6_d*!vdqHbQv`ZCf>=uGDFPcgh&XRG#e-#?sD~5@eO!CUVjfoK5 zXO$)uO#PfA+VzsD(Wg7ye)iXSMxrOX`e%zv0L(_hIKFgrbg%_N9r~+|G5y>r38b}L zA5RM+ z#ro6xhbmK9Z{kRq@osr8BW7Sp3vX46kBbbkJCPQo4{LIVi=vXl#75;6amCJ&9Sure zf|X_d_9HE+PxjI9^6`xtLwxs9IU*?>RZOa&rq@nMn;k%a=%gZ>+Oe3B0(jyPRX+ck z<-Kvk0kTq^$I>qdgklR7o#h*HYEoisL8*xKp^T-kcz2j;qzeUQr_Irr6xaW~Wt zq}LkKlOi^$>-Myc2j@vy<``vIPKG-J@x`{{&JDRsHMMgm5RVPK+6=JoYciQ45ioI= z)#Vp)qj9y7*?{N-2Yx0n15zgeKA1|fywAyj_s&=j0FBwIXXdw4tR6)<)k9f>iwlZTLmrikA8bOk8PJWm0FzI=6Ao30qnH-36dshH- zTTNadXe*w9JV|^evAApE9E5ZvPF2>w8UgzP5-hyt_<(Z582AU5xz3eKAbNkst*A49 zj>%d1)T)9<76NdJTpI+n-R`gTsvV>fw*ic8`*c7*t_b8}$gPdwtOv)ou0Q(v)X?({ zC`Rz-l8*}K`8`au&*mPT1kinuSv(QMMp3_nDdD^ZZIlSUijNt(1+&q3 zQ2y-WN_p~$-;VX>$$3ew^ZrnvX{aR3U+#E9+%WB_U$Y*$ykTcdae8kjV%9$mggI}5 zY7co9YNW3#>|IRP_u{g~g@eZHP;~RQq7ej8A%K&SZ)ZA-Q*Ny~i=qc$d~=2nhTn1A zsk*%gQ*=3%>Vc4Gzyg5Kx5Fsvjye@hZG6%B5F(piLked%go z3Vh+UL&VIQKm629D#ZJ|F@dCdEf5RZT;oNMz~)#Avc^9j zK@7glXsA)WYqPdaf~>D2Y=d)=%6|kLdjP?1O%OpGMf95Hm7rS|o{!%?@F~#do(^YD zI;d$%Ua*m3C5P&68{-!L_3x&AgMQh3^Oh~RHHjNcnm2X3QKx;wD%$*_rSaX( z!UHKPYTRj=J>R~VIO&dt@P*2&BjKZn_Lw~l_p$}cj*x}6*g^1|r-CtF1sp}Jcl!&y zTdB4wcK#^rjX|FG36{5KmL*zuwzE;r)Tc8+YI z@kV|o=k^>AuHXB%-s|o%QF<$=z{`(kYCc89REY90-sbsD8u(R^_~)+hy$HNm*2uwc zc%}5NOAT*<=pjdq`=?)|#R-QEga)Y#R{3NX9pzJc$KsY5{Z=0pTSYT-<$@if=VFSl zh7vZPd-r>Gj)z}@54RtxW87e3d(t0nuiBHwY$9Sb&*8`2~%;Y=Ws4`;U z*$u6enpxI&T2fN^s;+z0rs?w@8|#60A6|XiZQR|iE0dGdmq2Fxw6i_a(sVcBC_xc> zdmSr)*o5F9BID#Zp{J8OyK#YQEZ7rj=V{nE(q-cQunTkgCQzz9#=F1p@Cd&)-Kmx{ z5pw;au5t=`rxkCu>fLunK_W%MqmG3pDX3Aii?vF-(5lZy##81#YI-T*MtVRkrb~y? zt2tYy=6&Hs!whJDN=)g0+lwV%Z%B{BOd$ zNIRR|=X|qI-~y;fi28MzL?K}=sGW61w?WzCBP@b6wE+h<#7~5Y*ks*(xSgG8bxdAd zkq&=yTI%O+Z&)v)=?jnP+0WyKhzxq)g-%Gcpv$Qhph2q(YS(-1)&sRzkh%w7 z@I|p}yu9{=YMyTjyTPgetNC$cKQ%5>!OmdrU~-JVenDO5%D!yX;eO4yt~vpJqDD?v z16tErsO<4jPy3h7u9G{{+`j;JF@IA(c#v98E|4@|NY|Z55$OVLM*-4up;5B)DriN8 z+p!K_34Cq}9~Hh8w16cU!xtv>yBQ&hRKF;7p2ikPlJj#=JLb%ysIKn9E)T5R+S(jlAeVOlltqp9{*2;yAjsgEf!?Nx4kkU{s^+8zG1127v)+;xtS+V<8Jt2p$4bFSUuP@%H+v%pvy1!;! z8_VjUl5?wQ&m~IkX)g?doBjb$v2F|D>3`vc}S6bT_1h6c04(r&JmDl8xf*6 z0`|ZAh5_(;eW(1dLfOCLV31T08_T$AuEuhF?~_Mfq>f$N@Z-93F}Y{lFH`me!qzaa zXL3{+BlZhq|KCv07MK3-Fs_5L?O1oukh}Msw!wFTuJ+8q&gU^WR25)-C@odn4pd!? zJ50OqjQsbDS6Fio$o);SOKb6~Y47&9)O(6Um3u?I#1LX|TsmcKTHq|VAkuB}Be_=IyQN^SUD6IBNfDGzlJb@1;bf5=o?{r!Dq?Xsx zNMW@r>KJ2ioooLtC7Ga*`=pSb`62FaU1QsIr>$Ewb64`3GkADTsG)*T z=5nY^W1L99L>qIKm+csE9oGIEeBHa46^d48?Ur@dn65oo=rp|Cl#*V5^{01x>e#om zcSbZ(WzNM;r2@&ya|!*ePO4nfGU;&)z%zSk(}n>MT(=9SD|Dt&^KriVn7cN^eM21F z1wWg55~?z17NFxg7>d%W;|f@Jv7$GJQ9)jXhAKu_AAoz;5jaQ-b&5JuP?G9zIZtT-GZej!Li+X|IT*3vl{19A-{|N8j4LgF|x#V?uLB!PX~;`?=z zVvvs|_u?41w*R$@l+YT9%x(bHBFXDMj7>zIHA#HkxXxAo7N6U8uwtU#dJ)Zlx6iWBr_yT#k-iqdz zAx=%oEsB(L1@8En+caVcTdcvl87nMs04M4Sdfwxk0il8UrRbt9x=G3xXLmsAKtJa# zND2t$%F0R^CWIt2hM|Gns)GryC{J%-9h=TtCGTz+L7s*JT35eRwIyF7}c^j$8F{ z=)#ILSk9)~M4zrF zxs?#WVmbC#y#}N!;2*O#=VWa)Rfs$<;edj|#}f-MZr(qWd9G{vIkJyyG-dH0sLfEo zH?X*u6cpM7SX2%ageIXl4o^k%4Kb3scy>k&Y@R(*B>U#Xg2G9Dl)$P_~60F z66D}yVkC%J>3gwn`~-3^_b9d4$&4|dT& zr$BdCYisKvRfz0{H$3`?0NF(&!J+*^q?4SJ+8WUY#Tna_EXmJd1!KsijJfyh3* z%z#JwBx9PT7st<}F$C~)P)YByC1J{-l>xbf=&!7Dp!6d_%S#X^aYr%K4s$`XF zQ25a~6mku*)@c0aW^VZKWo}%K*Dkh0C}H(y6tTk)S-_+L;0%T`1GR9PkkIxa{sG|G zFV|f}J6xAvb(_m=2QC0a@^5)1L8xfu_S^sF>HAl~CI55Ywf|p79cVxRyjEzCGuew1 zFL4-urvM4=pJ^RMGp|_#p8^P0qpa+J2(AZz#SpszpBpDZ4v&NBhydprUm1LS8ZUlg z*D?OWv%r1zGOl#Z#m>OpZpnYK?4*HLHLnmvaLXq*T}e-`rAZmAx1##b=3^sX4NI;V z1RM&_Tv>Od$wL0@rLG)%FQRX-$kBc-tBg`rI=ShR`?5qxE?Ws*E8Gn^1dhsj%l*uL(ihM+GN5|yDb;$gAsXIYTfYG3+g6SmYf5+d`QP(c@;{+PDl$?nCA{5 zYMJ$3EW23iW-%wz77pYWKm3yVP1(}z3u!09Zs{P!iytyZ4GU=uBl?M^dVb(0thAHQ-^19+>jeoPNcE`Mpp0I zX`sDU&!DyMXaDR>J%tp<>h*w||0(f6cNVHd(8ikGecQq} zTsZQH0iCKeH(ve6Y!3&mKj`!#f;$6aq)^D5g2HNv_dApJv3o-xo=7>#o9YlUm8oAD zRuIN^8k)0>b98=Ct;T*;WgSL%A0D{y@}tJZkmp@l!JcPi1Z~ZWTP|h~%;|{~$(7n) z%Oz^)-^Xr(@;G-;7M!Yu=1GcN7dVFyMRy{@@@TXybX4&N&G~CgVJ$V9hWbKTZkea_ zW9#cQk|K$Ii}a`LzJmZYL+Z|4^g>n3qQYg0UJJg}!R0JWnPd~JKc&6S_~C_;Z_JS> z3W7G9lYoi6wCB3_UGGWaj*sgB+bg9R)%Q^0oe}An1!9O+ItXDw61t|_8PD5-5Y7WNX~~`rY6FG zKH}Jzm7*5(&hPRyO$S zaGXA+wO(np`2gfSGxbTMD2_$^CyHLthck1NgrME5Yq&4KkrTHzqqR&t4l2P@&#s&+ z>IXP@A3kI+17DJ{abVqf{_IDu{R9MIfQ;Njyt)Y|#|`?s$UTB=WO zogI1lJPb_y8~o^jR$2-=a7V``KBQ(ZgdISj?i(B5P62>5TYT?>U!=t`ejRoq;xVWV z{?-jR^p{V)0haHE`$VSdL1YT?0Kk9bZ?|ctA@n*_r}_G;hD|JpYlH?l%)_BAmyO)H z;CbjL5P5k=%aXrq(mV|y_bH{C0}!2Hy#PrHXID1FcPuym^Z zi0MHT$30zL+O)3{`8xsizmbWFHDuk4ZYX@7U935e#qJwOC8sc<@Pf_L&`(PwA~T}@ z*xCWp2h=e9^^~qZg1?JR22%3NvI`2b6I3+JLXH*3rXo;3p59`HJg08DbxQo1Tpm#l z!yj!TozO;~FZCA6BX(Is)Uc?_YsM;6p*b6UdLhli-RynpAs2eL+iox?EoaYy4B?XH zocW6WzW#w`js8^AC=`e5&|9CyaLqS#8*^4y09#d0$8pz|A%2eBkKxH&nQ4Wi2Tw-a z!%h+-UtF<(${X>_RbypFV=W`v1G#W>RmWwL^=5;eV7;p3-1@p~LT6f%VQBcsD4wnv zEvl=i*g+Hz^rNi`5wkNk{`qMibN}$A=bMRoO9n8kVNa2C1Bj)G)xnO?vC}GKU}cLt zx~}qbu(p2ny`S}Z5FL0?%STAwL>K?w=60FS>+oVH|KU~ytaWw-H%P12Z9Csanh_K* z#nHxGcN(dB&9)4=ufDkh$cXX;0;z@btHn-~c|iDco`p(<Mf;bOL1(9sKMUNLcIW`ZEpBjqn99Ek(?PwbL{EPuB!!akS9o zp?4q>9xD!cuNVnOjgOZJHLD zpA>cRHD+NBdd%vY0?Z1E%fKA$&e5O^c6XIB%qou5G#fyGMjJHZi{~f~{LiUb3hP^} zLwOJZW0AX@GXwo3fP=!vzF+Z#d;{e*H#TY>BNW3O`IguXqNYGl4tN4MdQ`{!x|hvL z)D@=1e;Y?TMbCfVWcz{4pdxw3YY+cKUOg?n{phy?m-+WBV;q$9TpV)h%+`Cr`8Jza zA0Tw<&;NR1=NfeHbI8V+H=I|zI~)&BBkgAQ-Is<^R!9Jzr+|Muvhh3+|6fr%KR*u) zfRA>@H`vxkMiqTWg{XD`fbZa5D!SW9374z~*4@jqBJnhkXX|5KuRe7*Co9YT$HyID zg{iSw>t5^~zKp$y&-1f8K6nE8? zAwrCNFhe)D4Fu3(g1;+WWdRKKuP=g(_Z3gwp>qNha{lS9{~>(_f9`wcvfPat@_+Sm z)Ac3+5dh*$ddrRvdb;=3P3U^<)MQ!h5{G{|jMN>@|>z zi8C)s_4$c_Xa!cvI-~D~a={j$1wWhcI@N%RBc4~?N0UCMCnk509HeUd0y^%92z=)` zQ**b@v=71d>tp#8qfiB6*I-<6deX;2xNsze`B8X~k@_TJ$+sps8jXVYy23<%AinM2 z+9xmK?(R+;Lon=O5i?V;ixB7FlqS0qm?<_$Q_ND1zJ0IIWW#wrbJlG`0|BXSq3s_0 zk6EpyPt=q*J(108O{hJ@0c4l*_}lK%?+B#-UNAt?&|ec^;6lmm{z~@h>H+ z{f~6pk586d8n?Ff9a3}BuXYgIhZNUVLO6x>53}DE#-t5T5|}<5y7X#Rv2b1 z;d??1@Jby8aST-1z+S(KwZy3| z-dcUT@yVEWOg-iTbBbme4^8vk=2yn;H3NYW$t_stb552>9CxOm0-UIG<3+})LNe?V12E(-8UFUYh2t}6{w;HwkwIid&}tgJ_20l_%@oH*>sKdrO; zH1pNCj)n0Z<=}R?yX`O3c$cfYDo4IyjHQZR668a;*uG>;L&dn&RPk?xGkw!JrLLlR zq}vJFoHqBOGSdh1P|4^4H7BBlsx3_T+fkGjvP25V`f31CWY_%^*vl4fsN9RR!xzKK z{Z0+kSWCqFp4PTXCv@b5Eyc= zx8MsD8c59=W&H((T$!jzr@v+*AC!Co*_2z)pys0kQu+Vw*Udz!okOPzY`dG7|BM7L z-H>y9RB8PGDg;4Yz<)0x|CcTT2}>O_a)$Pez~Q~SR(C{zt-T?#|M$gj+LriLyiAQL z;#Pneg1q2g(w3hpZQYS}xEj5YkWmDOaErR|veX_r&r6+8eri_(w!lk2A6h*K(``pe z`6#{PNXh}`Jm$T@6gKtu3Mi_g%qt#nrG88IR2xQ=2F+{D&tEO5A4n-D6kWftQf)J# zd?O^?I`_Tl1JK(fCv~J3p|)MY*!AcB1d{lzWZ{he+cxA!MiXz7qpt_@0pWpo(|JyTWN8Z-J%d!+}Iq6qTVvG3&6+0Ev zJaBO5u^GH3jd$C%PA?7G_boMQiBSO=7sIpM!!Q}_4WCD@&kNPegeGFmLiFHYaYcMsvA!mG_tBSHNh2L>0|>z4B;bKj+$|nl_92>!M5~~ zFm;0;wP+Rr5eQ<|`X>KsIH(S^{}D)zL57Rm{r&o^O4 z#H^Ug@Z;r6>OXg9_MIwtf1zAi2~kaY_CS}2h&0nK17wWq38aWN&v-)f_{p`8LR7y^olWxOBX1s^nTBG6-^)I8&2)ky{4e-xb z_+JbAKg@l3Ae8&R|2cI!omQ172`6RWiX;rmR`x7o$d-Ml>_a#$5?Qhg*+yg?%UD7f zoP_LyEZIhuF?N};WdD6;5S{P6-{s!#{oVWLc*e{#&+~cS@6Y@Fek~~@jruB+lK!)V z@yU9R?5UfI1(McdG81ER=rmiHA>y zIV0oL8bZ4=r`~gh*U^vKzEHOsACaW-(ZrMO_I7Slotu8xXWGz*6TB|^v=^3IF-b=D z4$8Y%`7DHQq3R2~(^1D@brhJp>|CDrBsDC?L;o7}q^iyNP_{iA0cCf_3p{%k!nTmW z&KLgumy{krGs_=A4<d?WuX4s`0efC z+5XGwUm+I1>{Le-`Gwuf`!Bt`Tie#WUKSUoZ>SSxLCD9hR4(G`Lt$rc?IuqF!fqfx z7o1`AV<5L%7LR&Ls1xTh`+Rjp-Web@ztKGV4cWDCHxEgFfh$#8U~aowa^6572@Trb zruO!ZrOSB5KS@Bli3oFx~2z!vsERiEP4^sGED-cX-+WHbMXo zYU<1LTSTd*nn{f7b3y^AxOM`!sykAHDc{*-Uh?b{_Hf_ikI&Uui637S3TWfoU{h8# z_pEy4b?Og;K7=WD(nH{kkK}4!Wr_9y5ws06FPOD)ScmErWESRW6rZ+|>qw3|!LWZ>m#bi@^#8NvCdWeJe1DGOi9CKTY;ZB=OveZ54;3RTywtXl;K;_ zJjpt&a-*y9RwNKYTnWcRmyht*(e0 zFVvzXOt1n!!JR!51zqbL_#IsfrvElIFG}$Ct0G1tzh}HW^3=2941OY~X1|RqU7>BY zqfYCSSQSz~sm3m2nAb-vVya3zSH8euHB*cQeHC_p$-#e$ zO&>)osimHIHAK? zUx=^Xd!}(r?D?<9dW3|!vs`K+f-g=D!^?I3Yoo2WJK)t5<06REDK4HNt>_ZP)nj?Q+8rDzs80C> z-L5CEymRGQx1xW{o+y0M4SAY@di>{XpR-)`0XHol1$Y`@6{{)HpWUK>e^2yZec&3( zjit_&U7AlWB-Pi|dL7Pa098~m4r--c{%SQ-AD?c8b;JoStX3i-ZFua(q0Y`I2R$my z;($*%?63xAbP2mtS8Cku1u$zCL(AD1|E@%>RR-7otSd(f^`EXw2ffmr8{x*N3V^Md zfhq>8DL_$fXDxn#OSA05HkcWS1;!jfYe15D3$c9CQiQj34~Q9XZec(aHtSUWXub^QN(b)&iHMz! z0yy}b9!CLCNQ#6KXf;>Y%Qt>%1SRIV9UuZkQuc>(>0fz?d7i%wy}g|RdfB`82qBE? zEvqOpH>LDT!sr*Dx}Is)h?oTktc+(eJ`x+f3qH0`{cZ$Q8C=_)r{Y&^M!-AWM>8c1ZzS)~_)U{$167f0eh||hA`kftHwEbdd)8J(~{9R_y=lfphVd|@9;8EFG z+=vEJES=57;k=Y9!rJhuBOgg*$)KIv>85Xr62rp#ETyeH4RubVY%fQ(k?!c(Nh}xC zCsTEI1YGEN3-wANhk9c-B#zXpeLwrH1r$-w;m2BfM4>ygssN_Dj@muTiqk;!W@2wB9BC{1SuDfrPkLxvy1`O5`?<0WsV|q(H^BExnZX) zJy3Ba9Lt|hJdi!QK-gYS!0^0vr8q|D3n@r^x~M*lHlTp@E}zdJ|oU zClnUH>Wo}fcb4C$tSQ9eSeBAvACV{d$^M%R0RQZ{A3%xFx&CD29|YmYEX)mh!U7y{ z+zHzTB2_Z^zq}EWNSRA;5Y1oL>OYhS=E|ERSaFh4R99A1)e{yY~0( zGgiqWaP(_;pLlEZU#n_cSg!rTY-N?`@vO zvV~f4NUtAxlPhewyU7h6g3tIoPs@cgT$MUw%ay7z2yZU9?ZnpPn-}hL z$YNM%`AeXqOM`Kqr`q^3rnB-V%Y9U6%0eo34SSzFH>VI^gj~L2f>NZAY)!0V*Ql2; z3+7CAElS0OQwxLUT?-+Xm{PT|p((JdzdEpca|;?aJ^!>_MY`cWzbA=A&$uCT0^i(v z;y`^TK1EYQuOcC^ZlbW0!+;Z!wlUgC$`d{kn`>g}#jrTJw=3F4gAHT8q#?DL8vV!0 z)q=#7g^UL>Dhy(}oOCiFzf3pYXL|bqZVdm#xWKt{rXW&|KPSjV-bpdkw-|X)^8qWa z(-~5)UhOwHaYm~$Oi7w{j1`*rMog}(`JBmS#$gRPFPAhVJ_>XHIal7QE5Rtxyym2q zl(1Gr-@V2UN3_=;FDt?Zpma?4Hf8J_(M?mkpR-9Rv(y3Q(Ce> z9IA|z5nQo&;Q~V)=>Cm+AWt8u0WztzTx)CgSr41X`}U5zX5jH zZ{x~9Qz04jpiLc+sa2IMpAM@$nEFtnPUD$Q{V1C|)98)7fAq>ePuVp#*oE~rTO)>! z`KeAck83cgyviHzT_xk0@%DmDlCTa3p6MYX6T$`g5iHZ}Vl~_i%FORk{`4^?DSMsTZav%_@Q~S44 zadT36{6RlTua8U^`U5;TulLLc=xl!oE* zlj! zG5bQh-_*OPk!7>XZ`yJ3C~8x-yK&D$a{wD7aCaUuY`)N6*ZQ`!+gqp8-S$k;)N5nP zPo;R1fV3USdADW6+o~h;y5*txs`KtmPs)_G{SLPJn3xAGyve~2?dz`?T~d}2S;qw??ih11Fxge&fPO(EzvWA^Vvg)`a_E;F;!vGa%PxE~V& zecFE?7L$E!^C++5b|(%N!=3N2q8gaLA8O}1v1DlIOfaOH3Aj|Jf})mLT0MFVw6eFt zpt-|tGmii_|21a$DJ&w>%6m0GjDA#damIdLMy~&Wh#;A(cYXaEjRs5_NV`%gL^LX7 zC|($07v&a(`3TV<)+R=^j^Bx8U$Rp7=oC(HYR)#(dy@Hz^!39`aucXlwkCQ}w~zHO zp65fT@V3QATZIk7*AZo9pbT^`E6I}(W2rI2~r#d z%U{=Yz5q-WSY6DlbFwoApAeKDX?asgt;XT?OQg$Oe!CkA;n1O+zS~1=SaS2}GT|;= zNw>6Jec3RpW1;${y7kvvRw@hGH9YkA3vK+=M>$d#{^;P1#2Lc`ST#Nsx?L|VZ6Pg@ zyP4VG+3}B zS(cVOW6_i~R#BKyk{*#l&@*1|GXhxUeQJL|uBi2Byo}=-SMR)>iVB6kxs#ay!A|Sk z>k*YVR~3%vZ#plB{5~>ejX=AFtmGBjnkY;A2Nkp;W<8b}-z*kY83qpg!jP7d1#m!d zx?eQlWeOd7uYsIa2B{=_BE_onefxa2D%4_rp&Y&^J%5FSxnn;un;w$?lVoEa8iI#9 zu&R*@#7-xKAWR_hWfu1ZESE;3vJ%W$y?=ltZNkuzbXS(FD7KT~%aNDW-g(04nFcuY7(NN#39fsVsAYI z7fhW<0VN_n9a@;&VhN z=FyX@`MQ@K2?ihi!`aFZ><1JAGQ?DZtS5SV!lC&k^;SV&;DUO`_NfE47}U*4(<{Jq zXlMUCDiON@fDhk=^m%dbmWy6=HG*?z*K1(pFbfe$KHRhsrOG>Q!li%+{$1bz5Lcd% zG``)_t0NCOkMz7|W;#pStb1X+{fuX7pT(==Zy)=C35J&s2*fL_^;#p>U0 zb^e2+`bNUVxvt)CW@(z`M&WiB_jFY2;5c%FZ@o;d@ZiUMFwJ=OHp1vRn3a3^7^-Q; zhnS?jyPCQTCNtt65G|qH*=X6N*iY= zUw=q9+F4%NAs=`Ee-_qmXA=6L$WMh7da#>?$3qDPwB7lAzxP$ND8S`Egojh7smF%K zz%S15&%_wAYByVCjRGT&w_rt9jaVjCA@N32x>6ycgYT#eB&BJcM*c;;w~&H5~! z8Le|IG5aN7h#SvnPH9fKnBBEcX)`XPyQ^N&Tnu~a2*-&i$J)a_zjBn-dekCrdyi*T zlKj{6Mf?sarsrKE(PxP+_U+4xRd=v}J1>9I(UFxg*__arzJX(Yu3jx!O#L;xC;Ohh zj*qfw7pYMvtUBt(9B<>EA?K&TbqvZXA`F4_KxMH$xUL7>HB^>07W?00vZmCn2ToA) z@;nYYFGFV%LA3fTsVP`gax$(+Hf2WdGL0Evf$iLmFK}f+g9qnh>U>g0n6>>2Nq9K_ z#9jU}fnUwiwaN(H=&WC4IU+IyvH2?+4>%iv((BIUC6|NG7ldt2E5tU#wsf>+=){^>UP8`d(G7D!8BBW;=ha=Z}^bx zd%9qogY&6Ip1eESst$8CO%-|=GrLEmmw7KnSft#M&qI$|UO=ApGjR$1m|rwB)hx$x z1O7qrgv^v*RApv42h|uXoyn1A5ntO?qT{Nd=wgb!@CDA?iHLZX|K^e)Q+5&cA|{%} z0T&H<$14^+wR~)ch&Mcp8e|Yg_!1=v* zkfMjYdqe-;OMrkL5Up4N0#K*gLSpY?z&1Q!D>##hk3et&hW302keg4P*#7U&vK3!U zI<78GGyK7u;5}~+#FlrOJD_F*DS(&TJIBos0gyu<&%nq+UO%J+&=Ui`6cqUkkWa8Y znTtT0_lGdMEj0blUD&^Q^8+(aLl3~5<~lE;AiA{VqU`RIWVqYb5$Hm?n&lK1xf+-{ zrP2wq36XceA6Py}7uKUCWfysWs%Ud#nc$6`gYvgxtcdo>zzc1}yeyK_?>yldZR<=-Z$+=tJ zncs=jcAzB=Xv1*S30SEj!GH8<)=PNRl1KZ z+QC(+j}_qllX2!7o!vc1YnbdMdwqkC#U@2}6?W4^_%+D*3|jsPi`)kGDYj$>kTO)^^rL3 zKWB%Vv?6$DEZQ(O5;A^m9O?rR^b8#5SrT%MXgZ_iO+R1=(cpTHAwT|Z`(C+Ep9*W;nyvuESKr5U5UR&8$�iH-fHiA(IGn&rk3#BA#$VR>}S#nm9C)UzenA3l_#%JxX$1JF^^xDf4$}V$Flkt;IF;h`a zr-r`>jo88SX~cbjxO4zaYDXgtJEGYyG^lB&wW%E>%pSYj?fB)K66p@Zq!?$7E#MLE zEMvdnRru4Z0l-0M8FIjeW%s~)((TZ>@~h+42K2j20n8{)DK(KM7k6jbWIN5)fA%HW zgw2BhBZKupdtdzpY!31q^nEGtF(AWR?zuWq5RBGceg1OB1Zd#?xK;e$A6@)qbIt?2 zjc$BwkyyzGk!ZW4Nls2AtVBi5+WR3NDEN^~2D;rnJwIZtz}{Kl>`~>4UTVFQZ6Vu= zNI%5|~{_**Fp;>KHf=T*u%OCDLYxrxz0vUVc zF*&iYQt1-I3BW;b?Og{IRUf_mVQNAxUrQP>!zJ})K(e_(q%D%a&9!&22qj!EFLXC>o#1c6O*)pr>h z*6_+APS;rnQbRm0TJlzHd$(e~Q!)NAs;{kd%EOBWC<>^>EyRrAG=-iHT!LYzG`jX8 zGwdaEA2w`ULsF+JHM2&AbL!>iNNH=WWj}Me39T3%w67&8>Yy=pzn%0x-I`?70_0kE z2YR@tLn{$iIg_1O?(pcmDXp!9qPnb9q?Kydl z4JZp6qmvra7a_??T=b>Y>7mPY&m4Lif76b8TIcX7*aFcpR|74J+UO`u>@bPv`2d)* zJ^(152;v)=ZUMBq`>>_oUJT&AEzEwbtELy)w3~}AJ`h@2lyq&J4LO>S+J@#%?$68g zO3?iIkU;PgJr4mN<_)xxmXg2vqYLxhiBbfO)IApyD0;gNs#;$9;TGEu4)FT@uzp6l zi5D#K5|xspdti&ejCe1K@$bI`iXP=a1PxFOFC|?RE^wp4J~<1%l-!~JYm=L-oAkqz zLw-h^fs!8(ZA_#3X_2hj>oaF5U_n+rK5;`E{%H{97G0D)ldK{PO3cz`$dk zTim5>p!qqkL;IsC%}h#bHVwY9OknbySN#!=9_`EMZUKjDGyQawEW}7rUi)dt$G7k@ zfP3s<)+1Aq?h}4&$d-dYeV|M=DWB*D|N8!5S7#>xv)`v|bQNFGc9|c1Z4Byey4J~s zOe5vBaJT$>6fQ=@(^#_{5 zzdm{Y*P*H+L&7US$OY(ri+wvSLU50OL8bA>ATqyu<)>X{0q6%ewvfQq6cB;$1GyQ` zqb%1YBuznFgi0G*UzHFC|k?aQ-i@_tpL z6(HCf*>dtUL`1`CIi`)>w4W_OT+@9g9=>}D^9ooptp$**%CAoesVt{^xe-^PzIk!Ar(9$1=h0dAPzT?S9Hce8iltYoCtP)$g{wg3 zs?=4)lBs@@-F`3|D@o_~htW&YuTOdB=M$Y1Sgp?7l3;#2^PU(H8<|m0<1+LdCL^(U z)r8oK=|yzpIy zn1xx*c-A{OvNJkn&^tmZq6S-2}#y;&P1~keJ`Q=9BEAk6uU{y@eHV-Xe#e8O?895F*2VA1>TJpmruv0CthW5(k3XSVOb{!l> z3ZUfY^62-o{h{_=IlG^lFR#?0xGLD$BLcw_8Cu8knw?{1zU=)`L%CSH~qZ78*-ZS=d zdGe5fvT8z}&dCe{F&S?@S$fP}zfZz16q5h9Ko`kI?5?@|WeDu>g1KXLrGo2^jO4>#;(Onfh3>B|X* z&l=7oBuZo0X|r+(cv@(_xbitSeJ|CShnyaTyh`!MoO&$^8t`7&RTB~9M~S3;Ss+c2 zZ4d#gX@WM!KI0b!q7+;d{S~vOInD7H!fiK5Tr@~#QcxRQNtgo;BDR5dx#xI>ir&wSvLa%Giy^xnj zf__Xh8+ygJvUj5Mj*F?-O&4Cr0WiPX5^AW5FaN`3=L(Q8Q=OBa*I^gQH(Ci@==$ifG)=T zeY{NCU0UriZkc`){|pyC?}3FYA!4P-)FTVw7}uostmiYuM9J6(lO>2F(8imK#=JSB z2X9QqaXvT$p0gg(wQJX&jsOPMxbYtm+p#F01UV&_wEix}N7^(ISyWi)0v<%K_q42( zyg}xf-M-#o@Zu6EdGUBWNGre9JvsCp19K|iVW0K}oAUG8rx5!G59V4Dq<|;_;DXui zOtHu`%%=oEH=PK%#W;9|?_T1b=-gI9h`at^Xp6UJwD$loHwKiqN)pIIgyLVL*5572~d1(B$*TV;H{Vo2=mfhWj|9W`TuFk4e-5;A?JP|ef_PctGp0{$yE56b<4I3+;EV6dEAkM zKrMqxY`*3FlY=U8BGn&sU!B-VpCAh>R+9L^G7q_U3uNN2jRM$v9xY(=xRqYX$D2v~ zAWZ{F+C?B^iv;_CGe5umzNEl6ge_tMfT}OpBuLD+NCByblHcw@b{0+7_e$YHUU^Pg zQQinm=sN)hY=f4*zBo|ACMUAspKHEP!|>;~d=@&`j(+NuE-epiChTV|vHdbpjYE0>N%K}YCF-;Pt(9XEDh&BBhWhxt|CSm~kAG|`hqOzxHseoPP>zVX>9}7Y zD^JT-hPa`Sx~~J+nRW}#ueNq+2}LYCFCM$22gCUlsh;xy+pT>XR1{V^*e8)4Qok1r zm)bNSMNNXr)`4Zztj5#MP|+}lH^^{|Wd3+=NQfqqU9``=P&?CPift4n3Wi(-S+p?bY%(zKaSH-HswF+O&#;6R{#3EQ;$j)M-IjetR#x{znv`j95 zFA);hK^*|bFG3)KKv&Jt>~Ha2t=9p;Ecld=F4BQCZ@QBNQW=eQnz`0Ayug@F{jEv1 zyCBe?28sdc;E5XYV*>%}#O|uXl9Fb=^(4izy8d1&IjXkEVG8lNS65%Ghc6SRF>%-* zCU7OilW_LA-kcP(0dVL>MZqK1UyR4>fo%k<8V5F17s@5Ru4Ogv{OTY%MFMH?A*gJkc2oaCs39 z#T}W&)3M>H?d%TkGVjzVzUd)Nd?a=@72^^yCK0V>%D~ENajF|Um6JQ=3HS;|OBQ(| zH}I4d>}U)o*xJ~D&G(HR8Y?A5aD^bvr>$3dB8_%y&?khDh|nogcggOMVjIx0Gk5*_ zFH?Z%IBvP)qrvJ+(2;H*fTsRuD|VkA=IRn>P7>|z?r#0R%_7?l=pX>4 zdas!8LCJzb5-9z9{eYAyE>8ciA!Yu#3;UPLp3;DHbugaYkgZsAkB;&c-rGidmF46j}cqKM(K$q?G9zLDKQXekJyPyH2 zWpzFm8ZW?fe?CQK>Ngn*4`UPhtR5p_PF(1#4=tH-eX^y07K8F|2Sgw;NCvvJeFd@x zOPUe>#5snB7gI?I_W~t+9Wv70aCh<-CIVa@InwX;Y@Obdl3ufyUFOUC+%w4e{A%Ue z&&jxbN2kr|d@B>9x!;PlDaph$2abM;v_G0DBGY>gn=yVzK8NE>x8C(P_4#c5+8XxC zMJPmxR=4eg4tEYGc&k*ChP4@DA^qAdQzAzb@SWNDX{0f(zfSOqHs?Z$4>YTDpA2zP zyDb%H%t6X&5ZKJ=9?9w z%T3V$BSc)Eyn0p)f)mU3d&7D|6ws62xtRd)DYOfJa6FmLT?0wF@yheMj;McEcDf0x z$+hgf!b-PxJM{}Jd6IvUtX4Clo(v$;(8n{L<#^Pp4Z@wN?~63@T|$5HTyLJ#4B}dS zt0Op%`J&dfAS?lPS35Y1qK=gxI>CJFUqPd$S!GQx&FEr%YtWE$Sy)}R34`HUu2b05{#$X5cY*!C~MK5J>u4*zaPw7 zts4%1v0`N5`i!3j2^0D`SKO;f&7pX{L@-Y4Q*&l3(12j=HeAp90&n{BJM@gz7Mp)M z>G?bj{@9{+k=ZC0XHcYxZQx_}NfhyRzotor_$1-WqI!VQLKw7pr0x7@7PsOkH{6V+1T)~T-vG_9ZQs8ekCayWae#_tK!fq{Lcpwr!a7Ko`9iemG{uFrH$+3g0HCxl}m8~%5I_Uu!VEd{L~68#y) zAdijlcMcRFb)wy~_s%%%2X1TA^`?Er%>VG$3P89;u%Iu$c=%2`_HGXcBeK40RGZN3 zzkc-XSH{)uH26gHu~e56&c*3K&xLo$L(ly~@NCrE^b2_+tCVIYuruQ%(pPC07>_ z{wtn^n5miF_;sqw{WtB8r$m8s-160_QM^=$VU6=CWO1vKfLN(lx~*Ci7uExK@iYeq z&Ky?*ON!ii`*BC<1Lp4aQ5e3j%QeRK8+CwW%0-f_vBY0XAHe3Pj4&M+&1Uc(-FW=` zS$D#ep`*@c^HvF@5W`c#`XJNBU_$Q6^)bc^mRlu8<9{6LSi|rBj9P-6?3SN?3-&w> zq&x+#P{GE+v$pT6Nh$lWwp)50$TMJ%I344zeF%tUu|xTIuo*pHG&YLz63{|ifY=Nw zshz>P8*Zb{C5PJ}Bq;efPjCnlz~hT)>Y{@p(pTW|o!TFZ&Z}5elb+Fc1qmFa11i^e z$yNF3uJJvyK{woeRmL|+)%w#BZ{Et85t1}S@P=x&{`Gf}{Mx6}Evy?}4(qJCAuV~s z;)qUJZMa3IF6BCsbYI8kUhS7*R~*Ci##4)EU~zk<;Qwe+L#Fa$9{)!s12f-6h(Ha; z0CWnk-7JcFN63;`z5m3nzQ7bsB~h9kd};Z5lY7L~vcxMdrIwA;4_V8`Zc9B=s>}X4 zh#~#0;9v2quf>(J(n`Ff=)*c}v((EqI91o1vIwS*wAYR6+SWv-y1rjWG9sP}$tH6< z?b(Kk;Li(|Rx(PHuwj3si2FMYet+geJyC<=7QUn!Vv5)VbZZCxH)FoiFYq>&aLZR` z&cS2nzUE^ioRf$e4~*We9EkX8LLG9TL=G`#p`wP)|FwG)wGSE^&ww(Av+|uE@}Ju1 zFV-54dhko#8pWv|Ikw;<`3CguJv3(zm(+V_?tdSlvVP)**T}9Iql$gZxj6R zF{)|C$!45Lv>**z|LkwHwJuPui(j98H5+0$PMIBSB^q-zB*7!#&sRQp);z^~R-JKb z2TdCeIYaL?$!Ky~X(;mFS~82{jXc@`s1T;bmiM6bcgh$F7(dse$FVFJVGx45Ql*_J1S^c_W^r%wTD z{)r2Rr-{eQo@<}}krw{UouWJF{4g)UO)Vp6{K4&~^30YK!)&?yjEggptzp)FUIDMH zY&V7@QY`FvrH;Wu{JElK`;H9gT_1+s7InjE-DcpAW)Zv1a9z?wKEEf3Lz{3k!ccfU zt)}}CXOZZ_YEDi`LtV6jq9_p17tBvA8ECcHZcg@-FdOwaoSD5|8Ld7-xcf8GyhC+S zAbLJv6pnz6U{SnMni&E8i*EKs)+k>>pf5pcA{m-;0)=3Rh|7>{`!10m?oq%I--MYS z%b$=~iRH}CSnhiL((}Nx=K-%Lt)S=c>tjO&91G}1T>%OjuT;XaXR=HWg;8gBX* z#88G_n%7Q0yTtZ|T^XTCnOrfECO8eojJFJgl9aB?+@|5GKWiG1f zena-Ub#A8>@6D~zxcAD?NBug;t>S1^YCH=NQ}!838wncf2`+VosYlI1 zp#s=uQSvCO5`JGC4YV2cyfs}-a7jLp&>azRs}SmC8LSh;m@(qw9=@J!ZTEyw@CWe< z?2qtMG$sUj*$BbLbd*WQeb0uhq50^+MV{JTQ8s^N>l%j)Sb%`Q_Hr*2KjS^uOJA|E ze!bXjcod9y7H3hnKh*ZgSowz13|w|NW;F({(Q7{uakTFFGuiyc7nun&s2naXK|REz z$u&&@t_-*U;4s3ndM2Q#vz19k+zqGk-4D}!i?fSCV|}MU2My@!o9mGAt2LyzUd5=$ zi~wti!W511Anv-UrYvpgNRO3QuF!5&HW%BdzkGgZ(~I2bS%P+mj{__INLM;zgGHjX zgOpwuWKVUYM}mx>msN5w$i>T+yfD31Twi-w_GiTLh)FG9pLc1`p!}CmwsuoCCA9dX zkwvF`tn51UI&?!OI31g~gFHC!{J=GpYxE_I%R}GJOtZ1 z`s9$)l1T#Sou!CKsHCcAI0H35q;AW z5S565fw9Q?xY)k0li>=oiq#saCxtg3_N{sVfa=;|y@s_t0{mMD5wZmw=MM9V=c*kc z$?J+Q5+>YXD9U7h+@*K8Oi#n!3qn?BH^(A74*sidU1oJn@;={S8 zPh)Qs9sFpT(8Jp9;~uH3WCN5sJnqCS7$8yoEwP+Sn%S%hhhbsr{KJ}!IXDuh`3%HB z^U9>UxrWeWo3CC{hnbYlhuJZ3VO$2!2W9o#AP>OY6%Y5srqijlnhJgPw9k z@@L8RU_sRVsu)P<2r|9eDk$uVNNheTHVZstZxOe}IPFEGfvlEt!26NA#?~)2&Nn=A z7!IKc*vHB679w}(<;l`K?g@)oRXqd`Y6LE*4pryBJN_<`$kR*WUVYon^C^!L+tAdA znu^Ohr_k7Ru2#MuQ4^^R$GtfWG(rK;9&Gtyjst@ZIltBzm71EVXla-YPygFPk(^b1hh1)9WZl;lk|z<$m!z9o_rTH8*3G{k@qfLio~+8@BFgS_Dadi^2U$$D67`6bY{lKA%J30Z`+JKx-y;;p<@U;Revck5+`aS1Kp-q%G?FBP%Pk^tps-ee_ceSV?3#|@y&zBrgp2tMikk)c!cT;NQKm)lq0+T<0G)d}4b+8iV_IZ>;vt9ax07(tZ3Tn;=~A)A3!&m#}3f$%n%RDUMlxoLMCKBLQgE)KKcGhGHceD_Os1OYFRLdgECz|G*{ zvT1{Xq>u0*7)YKfECREAFexX)gMhj^;AAh9#m`TzPS$P~*R1G8WN@xpinj3?Re+Q?3oTkCV2puJppa^W=pF5|4D> zK9wCZ?B;rz!P@NRn}UHqU%I+F&hnLWMF>A)IUMvcykUXEm@!+Yy;CUrqH-3uFiSaP zoY;tcc(83)WYwg(Wr9Cn(;2^aERCEWskwGM5ts>fPW9Ed5iM?#Y zMD!|NdxEymDDy5h19RBZ3eZ*KhCs9hQ52XUE0Kd&9-;7iMKW%?X0SQ0FIr*4)s{k# zgT3_75HZA(di>qMiRz$JJYHpl(s&BbwD|ngfoRY`%T_zn2)+Ow)#xP%U59*q=gUa6 zdQnaw1U9QgY zr7NjKyAKQf$C4c6OpAxbSh6@cOQmKFc-3>y^ z1ftUOK^&Q?+`TdADS`E$YI4WCgEPbGCB|r@#A>qv?Dm7)y zT;(2hs)~Z}L)|75(V}>(g!vbkJ5BN`AD9}l()CNvXqEUsAb~))_DO+jEulC2!T0ez z#jWJ-JjP&MVY6cWUgD;5p3@6Xi43mD+!D14n$lo`pULCIL>Xz}K#r@30x~1xZe;JT z#-SNH*WS`q+W2)KVhXj3{U=#q zgY*KPHy;dzxyWHUtyHe0cl#9#hx=tT#Wx652xJ%Bs|x}5le>@0wi2XGCn ztp*2`&*#E!k6tDlOAMJ$&Em=zaYTdy>>FFiO;EFfCf{v;KX?5an1QF@*`q7#8>y2O z7;p{V5xu>&Hw3OIL`p2y*J1D<;ypRNY5>ye^N0OlTe9`-?@5Vd!EvCXz85LJeKmJ* zn!n(M}BiJ$U8nn~I2kx;}vbhS3_k+VEQT`*s^jh)>D)t^&f#=0#A z4FDdZ>vk$mGN6F#tF)>Z=wkY#8ze^ZkEaL${R={5f2&&dtZ7GQ(Ra5Aa28_U2Q;o` zru$*q+MIE=0u*a*p_OD}Pi)^EYA!*L77=)m1A)lmds5%-5FV)b^L?+&AU28TM%<82 z@77~gJdk|mR?WSoZn!yot*h_Q&({ z6Yp5W!?Z*PhtlU~B(Wq+iS?BH?i`U67)h2)sD%?73nIPWP0+Y7w>2hBYI&H+|KYHl zA5hP6raXCGnYPmnIjd4kSVlv+^0U}Q8(H5>evS!Rw(cUW`Qe9q@VJMutSr`3(tAGH zoUdRM&R6Ey!8N6vG3l*D<_%`buuN>mh|ECJI(} zQpD8?bq_TRg&#T8@U$^M_gAF3bW`~0Ceo?W^6N27BFM-=v}*AwCY;lC+5I6HulzuF0M?+8CT`2$-iNx*6Y!#qm71n648YHJ7jca&~C zMIuNVOkTDQQV1&l-wy&{6d3W72lxh0_Kp2&;JJVRtP`-Mjuu*R!E@|s;DOErK4$)U(e&CPnt!ouAPNX^r#2Sq*pbao4BD1_({cmv7%){bcB|EDF=uO#|wT$ zbgqM`Dn3tn<7HPmpKtzj6Q@udJyRY*Q)2qw=5n|R{2JCXGPkdaq4F-Rw*}$U;ktYn zHc*TXTz)CXvQZgQ_qDxL*{S4C$SlQRQL3gyC{iKGe|f-zq$k~8SBSUzB{{Dg5+3K_ zKB!b9%oN<> zHCbfbPhAt1m*Q+;wDg6y+|?qx>#py!{0`q^yP@dSZ^&LwK~-MFKrn(Ju0(3p!;P7!nKg0)hvHhi z2kGKaQ?C%iep>v!6vfaGi=xitUJmD6z49jQgWnY4K*SXjWoV?XUbbjRSW&a)an2)6 zhfBeliXPRJIA-1pAq~TUWvBQRMu4O4>c4q#tJQHCJSI`)XLCtMU*CS<8&UN2@EO(h z&-gqpxR!cFGYR#JWQ{XWr1Xz=Hm-XvLZ(Es%<(T|wZ?f#7ssZS{Q0mFWhnl0hM`wl z@3R$j%kLpy_%#L7OGi)&IU*rp=}a1N1ztz{s+W#8EkvJbGVi_40cR9_97j=UBULu~ zfX#9doI&Bq$aHtOPSNy~on9=zQXg^1MPIuD2$4j6!+k0BA;7Ir5zkhPqeM*W?r=s_ z&$RGjW7rQhlSMB(AMX2MQshMAB#v!tLvSM_iQhzidDQkZJ9GYtj58g)bT`N|P$_ z%khI-gg$*TE@Ju!tST-T0BZx25kQ?iTB*gBbp}3(74Lf;<6zr8`2m|fc~MSWIUmWQ zgtj<3a%V%!sxmq^WxL-Df^UDn-UICZvC{?*=X^k94)SyVr)3vUZr^iq(ot+7CH;1& zqh&LF3k_nqZl&9*ev2wnUREQ?#q1qb4+!lT%V0;E-NAWu9USR&$n@N(k1V4(WNj+n zlp!4gjXj&~^@s)N{+m3qQ)3b732UFsyt!C`x`7xm_npv2)*bPE$6V^|%G>E?cK(rI z_!B{4KUXagJBq9~W#Ex$X7ukBT_o%3a%?d?+kv=X((SXkIhmEzM|EyZC@(8BE2n+9 z0i)H-wYk%tmTn(cdl1DQqQ%fYuPY>#kz6Ux+w&Y|6?|FL_}NQDma_GI-L$TtVsM-~OcW4Iv-C-u7U9mz{0Xi&~<4QhFDiq3sa9+XIz={RclV=l7W-lFQ-wOvR{r3HdTq*P*UyoMP>f? z;WpOyUeHR?!;g1PCno4~$ggS?r213)V<0WiAVIn!Sv zMx~d76$1QMK2dABcE`WHU$;3ZvKlM)WJ1E=3e{Gy*%nG@q9y}2@>ga?EPDEC2Qbj(?LqJ8i+f_U@7i< zk>+n^<7{66VdGD|&2pREbXVMPW4Dj-Hjr%twBv4QTSR06|6>#h=Pj96czCWMg$T?6j2fJK}8gTRwD`q zMnRI0DipN%XhjK+0um5GAt+)fBITtbilE6DjJ!iok`yrI5kP?$dTwq&{ozb!+8_Os zOlEKPp51fr&hGiX^PMvO{u*$BI@kQIgfRS?pss{0G0q7&dnmon-LnACgPb1g$l;B) zX^l$NfSBG+m}Ny5&D_I1MBYo$HF2sxP+w?XoRv8$U0CRz)R4#1$p{Q4bQ&J2xEg63 zyo~xpvskZXW)b+zc6m10WR}U>?BCv^lywx+>&+9H%rb>jhg)58v>8saJ(fpVSta1y ziuP`vT|MpsKDNZrm&dW$E6G1tc;;!MCSU4j*}cFSg$ZbqQ({cYg9}5Tmi$Px;r!Iq zMd93%j5+T;sP{t!^MIamq%5z=IX<&?$~x!h1(a-zM$yIKzDh{5mL)n*#1T%79-Xbd zb>sz$BCD-CfU7UOml9Ihc^W8Ie3tNP9+$Pz^{35V-Nh^P2FBPAz1LFBK4(811O2M1 z<5JINievUHHLVN8Gm8g7A5gi=cR|&FmMhh{qjU`44}2$=z1bM3kdkv*OUKwqXw@BApTU?(jK9^cl(#&9yMkk;C&y0 zJ!nV>CdHv2L=%EXkDXAvD@`_9EmRL!Qlm;+|3KTtasm5&rD>GK(xn|*VJ4dGg_F1H zF~Gm-`U``R@V=Vp06FRt7_Q;64qhC&>kpMEFLf7}g&Ofq=Tw0dXlr>SpH0dJr2{Or z8fE`BzIgU)$uN_#YDiSCmuA~!<6*wQ)JMvujVU@{V!|l2mmjaX&>8ITausv(J+BOb zjc=xH%tJ-P^JAm{Dpd~H4&WTZr^tHj)dIB8Z?QlC8iCG|@}~-7bE{wqyVf5P?2L?z zBB#umhE_yP9D^qP7MPE>ppo;8rM^e;{WOEP@k!i6wANp|9ySZh6%D*wMBKB8 z71(-?8pN`CRCgvPwu%x{F6jt{vV8YGa(%d$9>lU6IbsIY#|*7e4%jnZgKpBvcEE2A z-6C&G&Z-+JSKMH=GerPTULnqeJOniWN+&yKh59enyv%20FDz;xXhrK<)AJY)dwh`^ zQN0dF7z|PMTP%z-+gT!vgbQ~m(0t;E3Ai;-*ByXdEcY|OR?N8lU1LGs2A9+Nu5)c$ z_|?Eom$cMXz<>aWWip4MN+g<=iUOaXkXSl7J8L-Kqrfv{pD>WDIO9%;X>ebumo-en z2`upaYMZe7@pNDa1nJp3s~2+=4c=6135D84BHp)MpoJlBq%X&oD%6y8KPZ0!h!+%r z?0ukxn^@im5;_?Ob0`4F2(Lb$2^t+ZNR!RK zb4sopR6wRHMxMlOFNl-%bj>Y?r(+BirZ|*Ej$4j#)dOrNekGvOo?BG3_%8;M?10i^ z5PPC}O#c?$Ooj%M0IR!pp;uhjRfY#j0!6AEzwfgZ%(0`uhb z@X>~sEBMTJ$t`lPGG$+XNy)I~M;cFG$j#$;w!Nv|ec*fi4ne4_w{zdN0~8$E!Ai6P zCvP&IUAv`pu&Sz{Yd_hpMPH<+Tu$AX;nuJ}TY3SkINZ35t-*1V!FJ z%)8GFJpRLh@|yfBfqfamg~YBQiSm`?;@Qk(=BezuIQ)*rlfAh)=lhD&nrvb-GQ%{s zZeQodrz&=p%H)zL&y#L0=p3vUGZ6jf@iKkagO2H$)Z3)P8rb!_6gh}HNUq5o%iL=u*Vxr-;ycY?!lq85&$ZVMY-7ylt>43pS|Vl)-C`U` zN--2Eg0A`d%NM<2Ajn-X!fm-X+i3s}p6WT?K8|hRuJKivZg=s0^p0-u;T9&V0BA$) zpVV)N%W}X(1mcs3zL;@b8*`#orafI$n4)6kPMGFcI>M^$0jC3J)m|Ij_;!y!cMgp? zmcbt{M?kj-k`7*lugd`Y!k2v_+9!e>MehlXl_JrI@v6S*W;?akYM~9A9k*@Bao8XJ EH(Nn{1`ISV`@iy0XB4ude`@%$AjKsElJE{-7;ac^gJ7D^lPxW-QB3bI{w?CcH+ zc6P_QhU2HKr(Jvaz*jBmk=nnAGLiZk_1Tjy<#~JU*42EwZON9~2+p5LTjqc7@Bf`{ z$zc4uNm%p!lm32o8+G0L>6MGGd;R{p~qx9)X1_~cYCkPR_lw=0vY--=~ zsnGvNz;m5X6VE?lRw~)rzjBW3S^t`xFG@jCOT2EpOlRve*s6A3B>wA>3FVXXPxLNg z-oIeWzZm~D7AwU1+;qOV=}p*{vtiDMZ=b#fuK2C6{a?6@Vx~-fgzSw68#oSrJA8jn z;(}=ktlm3pRvWh+HD-SJ{(0B>s5qy)I``xF@_4VVy6DWF1oVr_X1%bOh>`%e4N(ox zj7(3KCM9eVljGhy+56sv!(vYabC`4^`V%iF2YLmBu%5rO;AfJ`h20^memlo?`R7Q8 z=_?ehjhr7|eD?dTU2WU=W9Pe3J7wYOi_~oJ_C_{I#x%vD;1m z*&_MHT}w8+OPZK|yvDrrw5i6iM?cqW**q)p!OcG)d8N#!r~YmCsxV)ydZwKD_7;V@ zwHIqLZrf?Eo$u`zb;UADXlCtYkd-sHtZLf7O=rJ*t1i7e4JT*H`}g%r*Dx!p&04PyEN>V* MUHx3vIVCg!0JCyKs{jB1 literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/Provisioning_CSP_RemoteWipe_DMandCP.png b/windows/client-management/mdm/images/Provisioning_CSP_RemoteWipe_DMandCP.png new file mode 100644 index 0000000000000000000000000000000000000000..f7d21f0a9483b634e2b502b548829f669fc20b79 GIT binary patch literal 1227 zcmeAS@N?(olHy`uVBq!ia0vp^%YfLJg9%7Za(r?DNHG=%xjQkeJ16rJ$YDu$^mSxl z*x1kgCy^D%=PdAuEM{QfI}E~%$MaXD0M#UTx;TbZ#J!!xT_$YEhYgS-T{~ zg1>D3t5R9s83?qS8`ziZtu3;p=vWu~lpzibKb}5!#-%4)Po3$Mp4%FIG|p&4 zVNs9sq~Q0zYb&qbRPxiwnDA+lflMFQ=~q_WSAK7t^!iN8>!a6-_-pDqnJ0aYTCs6& z&rID%N1FVWxa@gWw5xQQ@olAjiF=;Un6ofk;`bZfdEV!yF3qns__5}W9KS?fTKcT@ zyL&DzHz+8d+r%qoziabapLwQ^_2SJDUEc#zzlkiCUT;~Dw&s0$W8GGM#2u@IX62U zbwBC?b+3*Vc01Tr`C@6#QMp>KIcigD|6F-@eyP~rPuxG>Tye69o3UCfO2=9*UAHoP zO8Ydy*Udr9>19egw7RD--LTlT)BRvq*x!~H_nd6j+eqtg`q$o}Q`M-0kMVQ$hc07~wiP#YI;GJ$e(BsL~z6}bl zt1jNpF>UbsqbvI=+~Pv2S%QV*t>ojG-$k`gCc7`(I#qq)|Hg`x^jZEElMWqFxo0bL z@xr1VoLhJNaGq+~&-u7;!o}P>=AYG1C`Vmx`Yycn*AC_A{jQ&$$Ty1E>r{CClXu8h z(C3&pDc{3upRDH3vL#P$Pn?wR4&nUqpLAM1=C6BX`b7R+PL_Wncw&D&oW)dTvj0o@ z^ZlM)c1yf&zl`GfA^H5t%tx!wNfa6WJZ5*`%R})gcjmwD{IAk5>tRI4(RGiFPUfyH zJ2dr#_~gLpE_r|3{TD4M^m5GEa4k`=>8<~N`KgRgSypCBep+)*LhL+GOZ>Ug_@{ej z?kbGyl)00)Ds=JPO9#R=PnWr>Y*y>y?mi~vpvj(L75q8Im`yGF;l>NCF+YyUg(>$Z z2xq*mdUM_W!s(_Yoq0PQKYtCKcyG1PJ^4>bb{i8T_B0>ZDz^6C$*K2Gzs|cgsbsla zgQ+)b)_sZH%6x6_y%S6A_szVb&>Z>X=Ej(aoBLRg zM%esse6o2{;<^I$QJZkMV+YD4t#QEsD)Y*2mgYq8l+$T@IR@yhsCGCFs z#aDAzI}Dfxu18~n3*3`1{OdJp00i_>zopr0ILO11poj5 literal 0 HcmV?d00001 diff --git a/windows/client-management/mdm/images/provisioning-csp-assignedaccess.png b/windows/client-management/mdm/images/provisioning-csp-assignedaccess.png index b1ebee57d9d6b1070bfd6fee0dcf84691277910e..663f4499100e5318c476716d9b1f2838c6e8859a 100644 GIT binary patch literal 9935 zcmb_?XH-*Nw{EbZsE8mSN;3#Zm)?6qFB*D{NbeAulmM@YfHXsuF1-mzCsajB=+Zm9 zNT^aI^b)um^gZ8q$GvBqamG16Aj!^Jd(F)C%x6Axt{w7BP5w5~10oOzbX!pY0t10A zeE{AcT)zbTZxQ|W~?{TnA51qGfPEgKPvDwn=WUAnfW!ee}|tApu4 z-`T5A*ll%4IM>(J!ws#jwZD{E@}pq8t_X(oDM;CiBL)oPqksS}-(S>*o@`9l6+UhI zR8+L0OaKC{$`@mrjyLKem$<5Wdy=iw#3WqagxO12rBTFx%}w(|Y%i)Jok1Wedko3p z`ee1`(u8Bf8E#v{?`$XCUKD=jXx7cZ89*6v>bkmSyTp}R=e=Lt_zVR4c}zuyJY5rPqw+1W?!8}syA%acpNjeKn!W+B|e<| zDD2yTUIu}r6(OhV1EVFWrwtyXOpke+7uLE6K&$=~hbf{Sr$Zub#>qSPo%4fl${7mu z?*bFjzk|~nz8|$3Og1F#ezaEi5E&$_Z~jcx9Ca-@FX`Tcmj2Q=fY|BmYStP{|rWLZOJ}`D%HOZ2< z%62@1pM`T8hHKvdyzw6Fn38llo+P=m(SKQP1nd*c{h3!1o}Ew*4XG^dl5nNn=4ElX37y^AF>-=@i0H$NXFN_YXTRr{$G6 z$8r>zJ%LBFqBG5dHCn>h->O!XqXV$PQwEBPD9Qq(JF)Ea90;mP#I_8Poe^NK{(3@q z_-(xXC6Ir5rtf%>xWzRsF5PUjEh!gZ7Db7|8UWC};Jb;A~-qUc!GHjIf1jylgNVCw{0$pZpi54d+2 z{!q|Z9G~G4xxw7&gUT+eD%Y2})}9D1@P1v%9czJznSY>=zyoGc36HD$7KZ|>;1hLw zqi_(1lOp|2({0jE#UhHYzS`7R~Y3#L>Awi|1t*yOt z72t6G%uvjnJeTo|@L`|?@Hvkvxc+7^H9+pSz?+xAgdl&B08E`f;FyoS^f*p>1Tcj6 zzc-|r1me5DF+Dsy{7}$g`3@wI+tl0~Y6v=!76v^b1aCGkhWH?n_`;HsD#>KwK?zTv zMNDBXeCJg2232&uC{n=?RJ7L(5U-%)%+M$yNXii~#4ZX$*?5RsL-TUc_-)V;pJ9#z z(#`C)lk!tEEa9SlTT|0@9=m~;K;LgeW&%5*zMC@*krKjZ?PO;-AoqdV|vMbkiQIxCuIToVOyKrar4fGhwqQ+x*Mh2Lk}bA4qqTvjxrh@Kp>nn)+kRK z`;sf7RWVXn!o|$ZO$#mp0to{qX+FV8o_VhPo#40aF!BbwVCi`JYi%uIch?O`KmaoP z3sd(j7SpW8cc2UJXYv->RM*YS23=z$7K?`W;J~UCAC|b~jFr z*vaE-B!{3vdmkXIeuO_fxh4w2z6RD0!2oXX&Or{;Ne6Xrbv%T@!g$)ZXro{xRbtxntX$p+MG#5&p zvtxNX8Ssy?635U@2da z*0J)g@VV21q>E^ax{UJWargB)RZOt)oGaGysSF6Z@owH~@5DO&5}g=VlbNits$AeV zis=*jza%+)nm5Q*r>MgiN3OW}5}I{)TBfjt0{!(tc{`0Kb;%UU`P7D2UYT-H)h72B zV7g=j-ou41ZFJTgST5!#(Ae!6o_X#`T-z-@-GmrZ{3RA}VU!qw^CkEpyi zR*A0(c-7Z1e{CQ|4?L~EL#=IWC=ToM%P@UKgy`6ezB6oCTWT)(6 zuO2;;%&0^z0$$m780-mW)FhW5%Sr^)prvFTF2C_D2vjD8{Wia<13#G)_wyT{Qa~9* zjvz~-|N6F6eo2ap9yeE7TIzfXI|fwTSRGtYK)A0%5h^T#Kl1ab{?t@=5kTn(0GxY= zD|ZpX<1xVv2T7Y}$2zly!=txBQWC*FW7p$Dk%x3Mll)4X@zF%vq19DsR;nDv$8vCP z5Gary2ePxXGsLfkmap@kEiL!??JeGEI2NLsJi%dR8=V&;%PIA%9cM>Ii9k|e*f~I#^!6kPQnr6s%56O84~?I-LuU82hy5HaDJd?-O|F2R5krXQLQaKxR{C^y zgh8O4Ti~Ey0DJlm&?Bzj0eJPv?f=;Y^*}J(*m#7_hv>WHXtB}c*w}YUGAUUpEJ-R6 zbjGH#UQ$s;VN;mb1#wPMDxlj0DA`v9gE89qUvi*ddP)Y z%=|aNK}@ePkHmtLhaLx0CtklW5*7^%244*J?gePbjkBtuxnMB0aW+BXZ}JFv5@Ei( zz|W;JLDA{1PQfS0(>7|yLe#P&i*Pg190=i1+Hsay{-!5gj;b4ouDUD_R9D=Bv4U#A z?{)iL1sir4h`PBzHYRmWr=0L3KNdp_yS<&Qv#K`#7!ekLS&(j$=}~CJ#4|yMcMqAP z5p(kf(S$8IKG6_gA6%_nTtn8|YbaSVX}|?2O0-wYdS3r^W2pW2g}8}nE%`genYsp^ z_Npt-?KjLQy2dk}4b=t;lZE8|+-qW(jU$CAHUFa8*20d4X3ji7TjW$t?>#9B4)KC3`7?7>bg^AekiE*Glj`O3{bu$Yxf z-$uk2Xn*+BlbD_NAJ$s#%reAJxO|!l!0eXRrN?usIBscVGIp*hVvS=Na8|XCJ3br7 zR&G}BgkcB-XwJ7UbXGs!U8R0F2{VroK%pyd#>$h$GiO4li)J5}xXL?3>6;A_eG1KC#((xU1XI}&BQcH09(y8J42yF%DZ|GyjI~o`GERC>DPzHUWYGRo ziUbMzNb%!D48mher1V23d1A<#xW~Vlay``NK35;A}k z{{|rB6^U@Z;vdXPW3!n4>@OiII`PUM{MbM_H(KAsbg6hhK*`Sk4l3WJUK(eHYfr)( zqdrcP<%=7Fq^tpm5TY)FVt%jiUtb7g&>%CYQc+nUi+^39a%3;*v)a_m z6mTAV)N&;G#WJ4uwV0B%@rm}QDcw@@@&xz#j(#jJ_ zT?TvfB^kv4TL1*)SgEhxGA9ji6Iu=nDsETe8GY<<4BOlTR3Dja2eawNFFd*N8P%%c;@cE6^lTX+`9!IvICYI&-Ehxsv z9`F%*5RH!~^c##n@&Ch^vB8E3-xzUkm!2N;m9Uz!Ydt@|mz`lA#+vIp{}1Ig5#+La zNFOf9ZIU_H80}4ahqF+8ElvLS#vO`vOSOiCILbT(L*uS)WXa!E0|l zwT#i}FP_{i)OAGpmclAVlzL$U(V1Hqd&u@f@upeT0{<2Qc$yOV9!1jRktA40m zOa(^QER43NKrR09<$Jf1s%7*X^!38QL;hqVyl#iuX#PNH0aq_3p)QiVm31oKx3&TR zo_HO=kyk&JeO?~kOAP25B@KiN*YkXNX3ld$6@>Z_8EE~?tux?#4FFs%NfC(HTgRg0YrstY_&F{8M8 zYjG5?CIOGuC_tMgMaY^tK&%x?l~W|{fwVxr(|N8lW|VwLS)X>IQD^cCih)Ws2Jvn=G7IT~`(=pH23A!f}Wm*TS;~t!+NVrA)PaL;Jj&M9olr2fKJB0J>5w5LY?f z?RC4%qFchjp#j_XWE^{iVRI?VLC%>*^pjF^-m3@xf>#2M0umWu&F%DAa_5x*K+A3t* zOUsioHX7c%! z-~W>2{SVm;RN7r>Mu)#LBX6+8qa!7a;P6pOjWlWzSF832n&bV=w6wHQC`k644Os7a z77lwIEhq!o+}pA*{gTDisH-2c25@`Nb?yzW0Mnn>z_%~;p;CA0z1&r<^EiB}8 zK$=(1L5qMz+r7oyewoA>cDkGy`Of~R5qaErcIs_J@bvzLlvY$N%LfZ~_w{X#mCmOJ z(R%HTTLwZhkF6xJ-2sLP)s{ zj1g5R674&{8Lc_K@NzzNT!n(EZ%O@ALENH{Lw(tail)%OjVFk&{h9K9zXIr%$^28# zHMs&dddb1(Xz7glsbgw#uQEUylaV_FI%q7P7;Ys+N z4}Lzo8Av!SJ`WC$bWM7M_!&QGenf^2_Ik_3%W2>OAyz$CO|K$-{1t9nh8pTk-LE~P zL6hqVQE}(cx~dH;uJABdn+{y1N-N31(dq1OKnmq=l&2kp8jezm%o_ z$>4k#cFCf(;lq1GfC+-hqJHjli&7F?o3nW(ADszx`+#cE8p&-zjw4i(i@1TMoRX|Cin9V#;5kG zNM9B}!gUN#^0pL0E*%30Ze#8E*B4CWv)9~8AtgMq-hURXZ7niKif2r^RJ~i+;5%tK zpJo+*Q(q+{zWA@iZlsONFj2pFE@Tu0-g2%<-@|@J#+HDKs^aO92!akx{=7gwm+V}_V|*19R$PcQPWDC-p< zr}W}1^`EYgsGHw@M68-yQ}g0nY%V;9`jGaqBqWZBJbKAb*6to~=|?M6Xj{>Xn(^}Q zWJXMdL@8_BchQ~rb?fCZQ%PrhMBcO9tFn5!t!1(U;M@kSyXrB|!6C}qK|KcP({fSM z^3?g^zM7^MsPH0b7pL6!DJfJ9vAY)n5djMdtH;C&8-g8Q5tplP7x1*f$S>~I7WgiC z?~)NiV@vU1kVE_dyPs|~60sUvx3uN-qwoa0x}!G$snWsLjU{C`wKZPsyV~me=ainE zWCOCDB8&9R4j*(DVjmK{E&Ke=JSYpQ<}JmIKS6Nx7 z_gBcwnm%oYeMxFI2=SP>1Ne})4cvrymCftj%(fQQa5LrjX6T-DaEzX35AP4~K9uq4 z>SruN*OeS|<5&?z+fP<`S8O@To)3UcQQTg9g(5~#x1K$<1C%A&+MNI0v&(9_eM1Wd z3nTZgjelQB_?un!V@|bYcS-}$_ipCp1WVTV6b+(FNZCH~pd@*#-TllDsj3$&uAy}L za^6kF2ZOmoL||F&iD)gwKrkoQebzSput~5>Y@(Inq~r6DK?&NAPGfm#Ee7d!xr&}c zDc$1bM>jqt@HsSm2}>2vWQStEv$x4&L(5ZoE75GLy1GtoB@$9tw~pnrvWI+^=eB(L z0A?W$3&bp3P;m)0YV=7k^{W5a+J3GxgxKwck2|)l&KXQoz)ID(Qzqbb&##GW{crQ5 zyPjTGbiOca7ol!an1*Lst`#}+)L5Yb5xcV}b3~Y^4{)CBd2)D!YdXa*EJY%Zj}8|I z%FmWPH#ZD36>OCnTJMZO!AsVqirmaR+FE+48+urj?XLCI7>i1%m@Rj&5(K?EqhV^R zg~CPC$=lqA5Z}HE5UG2^cDRQ!&749tqf*ys!Pyhzb*pfGZ&Gx0jr3`lr&dEf%lpYO zc7u0f*6^+&Y3$K{>NOzo((3Bv|2;>+cO3xq_&)QYRYMfbq2p{~xnmE1c!f~~7Z(Nk zS3`83IURWa8VfTbH(c>AOc9lqCNE@$#vOanWTT2d^NoY(eg2zn!VtSb6F0kh#-30bEtuiZz*&mHHmk{qpN?$I!sa*Xlnr7 zhG<~+o!4>M66MfbfyM`!=aTjY>_XB$H!o)AZAS%?Y2;YGbtapd+wrdr5{Y2NTb!a> zY>Wy2HUG^{%2wXJ6cOhzOQp<_2%;j9fb3`gx3J}Y?h&%G)cv?rJC1LkkO;^fe@y%O z>rF0k5l^6#wQFLW&D+4}e+244=0uh)1GoCxbGT~?YkAUPiS(m()(!i{m<|NT z<6k)W9r+NoRgyn33&;&wpq%?XSh~z3-KB}4%>CdaoF9;D7ZY<$&dE^qNZkTZn(onL zlRD-m{e|lcI4uYfK*;8w(>otyvd%l1>F1?HCZthla>X#IE+Zl^TzkI&u`)_qF=Sev zjLBc$cv;3idU;RFcIS4ZNBSyEttCVypm8Q^(;fV@mxW5HC~kM%5uT=&Hc6J z?yV{w+#-W&bT zD!A>Sp#shrHfMI*2Ir4aV!nO)x%UA{8#kN=2Wl5`lx>z6LDt zR_6$rT;6VPMB-0y{)g)ZE~_~wA!t#ZG~LoY)AgZ%VYAPZ^kW9Z>L%>x zQ_`#r#;$danh$IemD-F&`S5sN(_WEGI$NH#LiKHU4NHeXy~5m);G(j78j79B9Ygb=)(YPq4B5w`TrX-VZ0e$T{bH+*HIl%UAt+1{8p_qhfsF==v*N}NDA8!sjX!&{R5y9%w_oZAKmI;z9FKYGj%9**>sM2Obt?O3jB+GVp^zja z6z0=mXSbWl8CVB-JdHXoTwMudz}>n4%{K+^sWW*_RiHu7$jgv^>VefZOTT9`5h#M@ zWM@Il|DENy3EtcdY-dD=QUVYb{|jT1HD-rW=B0Y1Sh*}-I0RdRQng!lMzmSFm){D> zF*J8?>sK2cFsZ*k%*|Pyvkb>-r^hF|P0VPm90x9O7@O5YPVxJ*j+0gE%l(;0)aT+p z?4IlxN_ku%I^+X$U#U3DM$b#Gcb_(5D?7Dd`p?tD%#~KEvRF;ur$Rrl zAS}muMuzl$Y6faQOrV9=@LMnbfVL@MZ{EClelUB^`Eu{(B=qSjpAgoS&6;_Pu%<&A zz4tfdX+6z=5-siW4sgtYx`etz%7U;}U-L!|@%o_XL|m7FdT<6f+v!xgN|ymL1!(Sk z5XF8!UP#Z->;u?uAy%h_(`T~EetUbn_WDP5U?C!inv&&pa9UE*WT|O;z#WN$7Bcl< zQzN4DD)0BV+Yrv=2H?a9DDf25n)lZyJ@7|vMg-5U{uz*~kK$ryUz=_6JKkG=dB$-9 zJRRWhJmV*b^(yKca1N`ua*Gp}kU;fljXCv|j9uf^<{!YrOid=`(%7f4ZsVFKhQ!Yz zhKIF~jJuJ~4l*MpYJtUcj6DN;1aFc3es+rlID(Q20Co|0I_({7Bi+A%aevk&+ZqzF}m6wADL{eJ*!+#*l_ literal 9869 zcmb_?cU+Urwr&s=MWjiQt^uTj^bUfF^xmW+C`i}PJBmmLL+>a>YCxohs?tK2-UL1& z^d+k2niJ->U;Is5!Ucr%$XqQaFdXh5Cj6F}w}nAD)Z0f;_0SkA4OCa@j^sO%4PqkGXO3;BwtFCcII(RwVY^1%}m#r?V36G=u;RO=!R%i%`ji<#&cD>E0RCIEqk-_pZp z8@ybcnsDttd@`cAeGP`m>iLl~$UUi5frE{KEcGm}g&)BcfP4{ZK=Lri9Iax|BtDRO zx&Uw9b6R*)aB|ekl;xClu+}B)f&_scJg0{TU>CmGZ{b!t#~AmVX5X-AC3V2}NqkR7 z@)xu5K!NXb!DsG=Ye^coul4q~V(AuO*aZ;C?Mvv%D8e|viNT6b-8-^Qclb&UZ`$$^ zFhKJ*yg$PkHy5=r)9d}c(nca91!wkTJkml5UtOz($w~mR{9YYxpV~XRKvvaUsWB-zMlLLP?bU+W&s~F)E#>$zMH9on0M&H1APO7&(IYy0Y1C=Gt%CFtv8GtO1PUuOUv1P zO)ioVe2*GpwVn31*Q|=Z#$|m6Zp@{swjOnFt-;-jgX)uvsi(X_VV1_^_;L9ZN8u`$ z&+KWIIj=t%f*b^TeFyBEk#RV&CcC>ifd9xnYFnSL_$CL91@mJbY^=%I3ej2$7BpYW z73uHvISM=GHUH%_H_xGCXO=SR0a`Wy=WOJ%x_1fm;C}TFq|1`(n)KFH=@(De(wEs3 z=%W31Wu`1BmeXXab0p(O_-nqC6;-fMI){IQ56R{JvNWE-d(Q3mk)$Rmnr9r$XB0W( zRg+`Z*Zk_Tjhh zKr%%vUrLBXb>--kzvqt|xyR78RiGngv`JgSvA*;(PeoZ4qEY9$5eM^8RXT~qS;egr z&d0iD%sEfDlOdzyudPH5PJhef-OAVE52Xj);Wi#NeLNk}SifVj&6AK51@VXdb!$(} z@!zm*hn;fp|7Z#Frw){i3@z7&Nx-KhJ zc3sV-u0Be|!4YL^Co^3$E;^QILn!0qAyEX|Xge8rO7Efcvhr~7EP;!s$2c~ADb&Px zG?Gu-Aa?;vh%oepFO`1xEH|2e*_c^!Aezh~4!VT)(E)eJr5g21X zR@&&h>b1o$$uZil+kFDSxZ2E~70$BMx(R2dBCb3CJW%os!J*|9>Pl%Y_;e*~lA*BGuR55Qc{n{MHbxc=` zg8y`r9kMY)`s2J^aRB_VN1`aH`FhVb5g!7yxM=zte)Uyk`5`TM834mo;KW2lMPUz9 zOr3G9_0Mk2K^uQc?hhC;7U6@2U+JR5>piyo54Mp3J|3b0$?51vrnmXBj#}DOb{^A% z-ro}g#~i@6F~=LSXV_(p0dXbF@CV1{fa4UwjiFiI07qU55U2o89BfchRu%xjEMOG7 zDF$X@SniZx4bm=w;0wsb_^?@in(EGms zW*27C!;Pt$vC+{|(|YSBQp$UgBO`ilc)ti1K<{aRS<=`rk{+ABdwbLyB-R==v(hp? z=mnjApMat_s){q2;<>zm`aW0yc-O|t($?@n??p+ys6~{}5wpHti|Z@Y(Xz)RApvOI zS51NP!`|KK6~VIf`WIO2#?+!b9%%V0c=vG>NRte*Ueq6F{9ae(9tM=FNxm zLmRgOOp(^5w?Tp0fY`TO|9W&Dw=9={=pv0deYH@mvRH=)V!sOacv1^C@OjCt?%lIJ z!EA4Dzc>iAgMju>@L9KcB1z_{!Irg}qLx4Qh@`(Kqse6{8W{)zVIH7OZzrNgHV%3w zhJ1Nvq&HI3ZLFIO#0n2vw$05>Vad%v*qSE*miq~EIx=S7@Z!X9ON2pSuKPT=n9oRS z(AR4rteiV3z4k^#BsH3_%PAshFc3RFF!y7ybHIJ$;UtX|Dl} z$ZU_DtKFk3Vk#X}zHsW&QAQq~ekv-}$*G8&nE_%aIaq=UYrPBMG-a8_T3{xrW{HEJ zui}my=v-?d*&`j6-yc_EU&cFxsdK}$_Ns!}a=+Wsgbk%DTQNgT8R-m4(sdYDW~scs z+D#9jC+aIZ&!z7G(({QO?K7ZgkmfZo-@LiH>2|yc4;bTN&kW<&w^ZIvhnMqM$2o+x zhDzm(93X4_9Hcq-)e5hU<(qj8$|w)m;Rakk2SekqCze6yr|wuqCJv%_jZ%<9Fe183 zhnf8%xdnz;Fx`o}mCSsk$QYrWo{dbZ($O_aR^!J)g~Qlg%b*a2HIODTnCXh!(KFGP zdUl2h>%98V$Ym-c)@szP5`Lc_@Q&>+1{&%z5sylTCj+_e%H|HgPKMF~M9&7qcXY0T zP=P1~h`rO|QrTIQM+`BkLY!8~(uk6B)N@GbTjd&zJ0YaBJ1(Xe5sE-$G=j~ZOxR@% z>~{S8ILgDFI;<>=i{U)kvbk6Uned@}vZvq%#cIcx;Bi|j$6T93m}Kbw4@svxn?1LX zg`Y#aqnh2q=+iKtN4m=Q6z@1D^7N!tE>Y7-ZPjQX%F5E7;enn$Kr_oXWmowfT@bCI z-Y8aG28HpbVu!e?eqZmyTP`>8Kwc+OV_kK1yK_GN17T9}H*81qLisYr!b>2~cfnBlZ$SWl zat5L9N&(3FUf|zsct~;B)fIj?rxSRJge`Od!~mHLqP+wT`9-9KM(B4R$FaQG%^a%O zDn%etBCfx`dk1!{{{?gt=cp;~eZHwsdRhXY_Z^sa+#T3+@WpbJ)Lx@LgaJKCz-+?T z!6ElvpRYE3m?e}x_1bx7Oy*8&IbFsL$FdjWw*5cWde-*|*#J=&zebj$_W3+EdA1@o zJj|9M`Eypq4g2T_6Kj5E$puO3#N3niR~b%TNxQr-Tf>duVWB_cRNtbi8lrSW70^w7 z3w|vlbSi0VFyXD>h4RTJ=HE*bybewZ@()gpvxM_8Y3dnJXDW6l#5mKBmx(N-v0&y2 zN|h^4ScU(V7}<#0V|G%A3j51#_o`|2@Mfum_X~!$$u2tkaD^!3kRi8CvAo_IfE~Hn z3PTG3S~&J4wpc-KA%1?xKZCqj#Qq3Xhk;bS!27)ZDv`tH+g4Rs9Y+)Jq7#p zn`-|@ZNE5i1ymDa(6 zN%8GvEi#OBzqfO?i*ENQS;I34T#ScnXaF}kC zTub{=RGD3a%lY1rSws| zwjz%uin(E^=kRtQ06Q&|NZRmscH&1fhfhMK2906K*A#B_=t3STztPrxmNXTVK$Kv~ zp;8kgsp3_7Wr%oNca(JX{t5+k5|MGGe7#grsK%Ul@Jb;}r=T&Zto7EkF*Smc%M_nQ{)Z6nck)T9ikXPuXu2KbFYlA)GX(+=hs=%9|KTISdeP zh{*dhx#fx;X{iZB2vuL@`H~?oAt~t1MMrRP^l_>k!19^y8YpKpfrVI;{vO$gA<5LZc4^ieC1Xyj0~p(puU z+HG*Zr@T}yB90z1elwz|0rMvI19yq#%DZaz=VhT+GpmhkR4BGVZ7o!Y?^%=5qVsAR zP*c6UV{yOm-R|Q~_6ClI1kZdcybIX2o2VE^j%gXn`hG71j|g0bA7^W`tbRf>KMT)& zrj;PmX;fB4DSfejcoyS^1e3x{Q}!VzY|TLJC7)3%PoK z6zkSpUfG~=d225M7@(jnIOa-8MJ;*+n;OJrpdD;3(;)FhQ%~TCMgjg6nz%yOg{ zH(^VqpGTQm+wipDwmrX7gg_c}elj{zIUTzV%4>OqyX+i1*!S*bxnzou^`6dSL7E@l zPyz3WNGlMq3DsCs(xQnMSD|@Ib9y=!e#?Ge!rrH6g}stu(J;sh)RXYxu_E9b?aklr-Kz-tuPR&YvOAeSr5lzr%c8umbld*_S zm$IKtTBBUjapW_4Q%+r#?-*oss_y=CGy2D1QRt9VsfJBtx*e?zB(uudb$xtNxW;et zY;KMA4^E$sP0f1m4{fW4p%^NPLQSgFBCeRQV0!qzy3yqCihmv2S?lBu2A6$0r~{DY zV)nD0&A|Y#pMx4^r*j6*{?Zni-rLz8_N6-E35H*TS3Nx?VK#b$DjT`;cVL0u=ZF%w z*X@*eV@UVK2MJy(uk4?-&i&vqDh>4sIQ}pbg!pI5`!gK(4C!PWA?49d7*S?VDlSBJ-v16<1>)QpExv8OZjdpYgo}{!c6mp%U}*Tc zTEW5e4lMup=%<%`A{t(wiOMYBY8wME_<|y+CZj|}jam}<(%$zUJ&lEwHVg3_Z#>r< zn9Z=hndFZ!RzAtIbI)je&3|@U)q4T1hon{kMULuZUj1_D1jWlHQt3U`Xl{g+hH;1c z_Pg1qk$p7g?XL+V_P@wKzy7#n-0zL__XgPH5y+Q;kin}+3 zuRXcdw@BisJ14w0%{8o3%VtwdTTD1(x6usb#<~2rd&>yT=t!Jk0 zXSGz}wxJtz&#K&9g{oxqiPgEdW_NGM;rO{reoC!(W~98S1xg?-9w|ihfBZPNJ!X`L z?p}y~%A*NBiC$%4g-BcGW-l1;tz60pEk{E848jfj`jkD|+$TMwh)tCsfxid#Wx_n=*(?>_AYHAjbJx`$SThNxFu05xA_n|XRzoXVrYVj6d zJ0>3vyL=Hd`Qpaj5${+$Mz zY!siL_hAr;EI8L_QT7Pkmm#@mxf=H{gjo9YVE!1pVf^^#9z1GF8xe9^-4yVJ})I)5LK|jqCyIg>CF-02nKg;UnR~CQy}Y_lN^?EpG=%>}4@1=G8A0c)I{&1*p1A zh0xfFNlJ4`3?Gx3=~PblKDYZO53gY_X2`0dvu7E~_!5Ke3}N(s?(aX7j=zh4G3pdN zwY}FufP+C~JmteoKDeX179t`d7U|#H{GOa<0$wkme+=8nHI3DuSg@PVoKhtmTH0Y7 zb?rurIW^Q_Ty@1pud~D2267Yveg!cl-wFhH)PF!tvjC62CcYR)%eHosan=+>wbgQN zb%P-%=C$9MCtC?hBU9=S#T@hZ$P8z{`DqO$J}+;7)3t{DepFuhjNU#cY$@(Q>2G%K zqt09Gv-}TCJl$Tnf%Wq`$qDe29(0UGAx53r8T-Klb4PmA_vCJ!lSs4mNrtVpw7mHgbCnSqLv@!kKGzsqPW+!_RR5%%L8$+4 z`t_f723+6YU41$NU}7nwKhAU9HX#_Pxb8W6zGcVk?YULuTq=0VMMcMs~P6oXDdywAh-L%bDaq6_a^X_USh(!e@WP0{gF#*$+p* zkq;Qc49klvEY$W%s707>EYxi2)C~T>R#RDigv1ya!xilH#axtZPbAjo{m<>{Zn*E} zNifv|;mM8dvv7U>3|QD9TNZiEUU8%U)Y5#aNtR=8ysqnCFZ9Q+FxxuwI#1v?5CR?u z;K<1I$;D+746CjyJ#>(Hn1pi;7v0huhfx-=S`G1$civKP5Ai_iyp4>9{)`oOS z6sp(csv9iBL(}z*Gm+Rf;x$$uDy5|!Mw&!La!!b&-pwj7tVH?i#`S=s5OOzO3QLzQXv!hP(5+0mGE=IIoBGT`Wj29lXDtoYC}BDyKT7r$?14^ zn9HMo{^xKrCZ(l<1UuGySQci%Wz3pDPQ0 z{+DgBTQ!7?MDv_m;|ix;1ZQ@2hxPR8vWD^%n;WtszomUM4)d5KIcJw&!Ogy&Re~Ph zxYlE(BQksW2Np3pp_R@XNN#yQ(h}KYSmW5~S*zxdPZk3I&|W1Ub0! zVZ!VkV#)S#`Sxy2*KS zptgE8n>^o7>cPq%F-&JH3{y?qdzm41ALuJ0WC}j4v}~-a*VU3hd*RU zPG|6%n-+r;yCt*=HV!|EncH&9W@yM|g4-y(xZ-QsON)HUKPqP3K0})yRGhdLq5)yz zeLDMn7^v~k0+N2Q!_SsvO}sb9Yk(Ro&Hdx(%$?0X;qb>gyHv6k24U$ot@kX|pOqA2 zq^2uS%wwrTwdFd=lwLEI=?Mj}>Bju_(IW6dzO#beZ3ywr^JLJyX)nq{g<(E)N;{9z zek6dR%%d_)*oPb$S1Y$23Ds-#W!D@RGpr7kay0KAmP0S@XI}lQ>3GxFl;K+o&vR1X zj4Ss0G0*+jB{8#&{LZtf_O#`um3(~ENK9i~!80cC{?)>Juza;xa=5YJ>aulcgXH>e zs1oEjJ2s>(w;%!cZw9e8hMPzV(@1@fmbwn!0?^j(oEfo%nn=;A7})cDHl;>(d3>Y*XJC`i@@6e2?b+vQP^nS6^hikFWfvztUY zXQoptPJVc=_H*)0!QhT>-$n0plDST>l+cY=^b&XE=E53mq3S=Owx0jPCTu8v*(yYv zM>%g-neMPR&c&V=dRlNXp`K$(sy5Hi)kCY0^O6csZ3$cyxCb7qo{|uL<|U|YIU0~> z6iI0>9NUr`lzzK~3YfS+ZD4W`W)EJfmAQaO0?o)MRMn=Gq#fT!h#SqqBL*uBts#&0 z2VyV`+Bc~kbz^YSyZ>Ef5pdUaUY(_wXNKM8`Sbj5M#cYYxF7_0!JyfqNto_^!06~` zPXfiIKPGcG++;dpMDvaAwE!H^g@*z~*$|*W2$Zb;ob87Xe=r}Y!oK}O5AXhQ=R24? z|B~IO_WT(*bpIU6z^8FN8K_|=nC0;*H?LQfAH)or`>Q*|fPk(@`L*gKP(HetQAioB z;*!yqaM*qHc;dNZ3@>#v_I(~>8YSdob$#)`T*7YFdBQy~r|@&Q=Y|3rh(QHc0W1+x zLa#g;?Ysuz^)oQY?29*uBtIloSWA>MJ3s*x<9yi~^X_QzwC?ndX?Nu0@uEoFx7|bE zI+f_?`F2Z_l$ryjCQ$<;F%NmZ$FWUkq=-~`!!RquwIKYA-EE&4iIKm~0n9XZyRmIN ze+4p{i;NImK(5W^{@G^568dvpl#IvvltDj&C>el{GUqNPHjkyBZ2Bd*$C4HEu02V^ ziJ~f3Ql|H*rLKP;09RhIb-jIka5om_bE9-ITmzvOCfvIQv*vzmvs-JfhzNJ}Ku!av5 z-sIhr{dIn*1a)JQZo!e33Ym~f z8`m^um?_=HG%GI5gmrSg2x85nZ~fuMF*R~?YAgDOxt<0eJ$xzf0`}U&2TlXfmZ`pQ z`xI94)c^%2C?T}KkUEv3?o&4E7D2wB54BerpA;{LNdr&wraDEFzJcErZjAc zEy>Osk09@`nT!tWU$+(~@2%yWpiz)CRSDU)bnU49k(wOmk)TEIB-3Ea&j^s zBkO;L+n2?TTdj`AUm^l5yZjP7u4_UH&SeASfAg;h7&YsEHTvwEHF}Tef{5?|g<&jK3?9?X){XoHW{x@#jG5)t-HzH0%0qeWNRtk>jvCZWqf8;JliVHFPl2!UN^bS+ zz8oOGFx;!j@YO_NU;ByrKYx8qm6_Gt$DojXRSeZSP#(%_M;i5BUgm~e5{Xl6lqd@2 zq&y;FypmfzyFY>Q%KCKXT=o#E$7&l5>Domv<2Mxr=ZpWV3qM6Eo4@lk5B zU7+lclUy5;Q_?V{sFG2`R*zl9>NUacTadQ5F65n-jAd6Z7^lUPd~-LG9tIK_H0WzlzTdk^BXILgox{Ir-oxLE201__(t8d`hQW4lRK*1 z?9}Z;P*%t4(;PpmV@$xh9TF%H<+UTtJJ=f1$ZnbXgncxvjoMZQs7z56VM%?MMUP%PSC_yyc?2Q78~usL<-kE4kIP`z1QFD5+CA zH%W5QF=9dA?I(8S{rIU1!hd?C`FZ-~^NsuQh4h55grOK+qHbGM3PfI%t@284_3XYe zmY}%Tk~*bxOD-kfZk|^t?z{a&t-SS*J{Hy^t;ou2uiw0RQ@?VJL3qLbfb>Kj!=|Vd zNGc diff --git a/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png b/windows/client-management/mdm/images/provisioning-csp-dmclient-th2.png index 486779f0382c7a657cb2f1654c88f19c5f6de399..28ae086ef78a0791bfcad361bab42e87059afd84 100644 GIT binary patch delta 41984 zcmbTe1yqz>^ge0_1}YMQfQobpC^-WLNP~0_3P^|2L%pJ+(lK-lN=i2f3?La!f6W+lQ9Imz0KzT#WX~pRe+OowmrK|x8y}# zovsd+qUM&?WK*2Z@oO{BDIqqTz#;JO#noB@>F3HZ>{0OJD=Gy)j6pgW8;{qmh(!1_ z7M=O_b<6+E%>AmGZCr0}WYtU3=pDHRLii}RLB%t-pngNLSL>ykroAb@NwcP_~KpgWq3m+tRWfu6WAJ2L^nmDL`*zt&w|ewn!Y0z3-eT9VGGW$(H`}(8J)< zFOcs#W`2IYj|vhWFf7%MuMvxuxOCe&&VYyS4Si{AXX5^NPu6VXvf-ql`xPtX{c_|W($da%qc(IB4uyNR}GEN|!uv*kVZDr_K~)%^~I)|Pt&otSv~k?frIDjqCa98+Fy!7Bph`K3CWHAXmd__h65j=>SC`9$w3Px96*MHSCo7Otn(* zQt~lxo&6gx>!g>~uU)b5l1iriDHO}ylakXv5$kSHy}O&p6(3g?brnqhm}{uWak|cY zU&AEFXpApzgGM1sbqnh1jnvpY>?M{irh4NsX@@iWfyY|g@vNs zt6vk5FF%sGDHBDPVG%w)$K9KM-(DS@IuZ-F-}SyLN2@A8x4fiKZLzki+z4~;e(UD3 zcE;nJnts&P+(gDgajhZOui(aFjfxSS@%iv|*!YvuYR{|Mj?>Os za#;}uY-7kZdO6DOL@D-ZHWyPxY60WbYBD zOuhtHG{41U_rY8jiSU3`y$;!ClZ7RDtk-ti*tA}mEv44)+l859cQ(g^4RxZ=%%xE6 ziwxZ~z3;O5Dr$f9m0=E56dlO|tj)1%yJLG1cKdUkcOQLSAZRr~;zh1c&@~okz~|#l zZs@VPmGVyFt7a2z29E_|U&mhjzBL2*Z0<}1ez@9mXSb_=Uwj8TUU=U*k_0ai6P~-v zO@FcAvdh9y`R+n0H9m1C%Q*3Lwoftk6?S+ZY~;!E7)*JEv=7E*Sl-X=wORkXL`b7_ zgPgTy+lAMICnVYvOP#o-buw`~*wAB}_}+7bK!TGR^d>p*G8nYbL+(}5vN!>3?=$hz zGUmur_r>asj;+*2pVQ-SCEWJ}M%;F4#A{4~S>F-}QJRrLLPB;U)i%60z^b2#p{p3* z$p}MzE%e5SVYy{6$%KzwJAvxFmJ^BDJ`>ZMod z`!oG-U#{=9_XR=s46@9W8O1Aw_kRt_3)$g{{~|F2?U_0dce6(J`rE*1K~ph1U(c^> zu%1sqc*vF)R;B%3(HoCk%tMHX?6;8+?5_UT^GW(!AUq((0TO@qQbD4_FpSkJ%HG)_ z!xL6bHP5`J=Ky-oG5-cnrd|TE&rVReLxRGbtlyJ3=x^w`lOW{pe-=y*-BK#X4_7$N zwrzEHZ&s{--Tt|-t?*6QLge``X%ICyd4#~I&p*DQT_*Qj_AM3`kBCj*9H>9RPmrFe zx}y@OqtiVv6x6XfkGLZs?~1GKr=ythfSl$8{HcE--AUGE{EK0d(To~jvpSc46g*r@ z5M;6hK)dp&5mf^{z_xLbpP&=!^}u!q-pdG#cx8Y@6|nLQ2HRNkh!j13<Ef%I8Zpq|L_1IZ>rm79#g=XF&Tm7A(7XjJ4;&Eo~>*w;^wLj8DQMWtXquj&8QGnPP36!Gho$2?${r2WmoMUtDG#=f`po~p0!4IZ3+RGM7Z6P(EZ2! zU`RlOJIQ$M;&)r`%2mh>CpyZrKTGP19&(#RRO6Z93Z;YC=C{z!G?HB0WxuYx=m1yT zdwU_TwY{k7i{N}u@5(Zgoj${D^N9Wg+AOilSGAE2m;aKO?Wq*RCD2Bgus6UjA~uJ% zQlGGIRhz0mnGG5T;`|p?ySf5gHOOe(&_Nf4wOSMckO-TUwQ?407H<9Fv4U4@ zC{1yje-7o_KEoG~*FezDIQE3)ebE3C;5Aa71n)ybK0sJsm55Lv0&~m7?Atys{~dJR ztiu{fH!vbGoK+LpiTBvrk`Qqq-rkp@Bt0e3ORxnQ%zB*_$^5+2fG+^BbX%A^qo=3W zDD~SHSbGVV!KUM(y`CEPQ3vmAC?sLB7QdhsR#shLn#T*~`RtkjQ+__%n?sN{gO*k# z*rWlL1%&UrjY-6dxWuv|!I=DDS9JO(2YkoL8eNT`m5J71<+-9NXup16>l^=dQbM)e zPQCvt!lzuGvvpVLH;(dtz*DkG_y71ITvPlhKYwXpjMKr)@JV$1RrF53S@qg_A6kN< zc+n0a>aJ>#1#-5{j+3MIg&A!42znDQdtt02R? z?-mBEO&&&m=)J^Gq$|U;$`b6*3xqd*6qzDT%4gkOH|dphF342u}^l-nhWr`Pd?Hn^?HffeX(`5@+o_~g{TFwf<9|lW7K>{DLt(G*{9U#&id z89a7bicz|DmDY~w6gJrhM`a6B9#)&*`?32bzA`k9M=bk7RFZsIrL=gVYlA?`1NLXm z(WS4uj<#SGtMO9QD}vc{Zv*AEMWw3m*6ZlFA@rvswO5);!oV6?5T*JmODbi_UHr@yzMw z`JNgw!L;xnPl~h4I4NB|Oi*SS{IJ9*6@Kbg3{5h9B+bB5S(hW27%p;_D<4O5;g7B_UY;X^iAZSn6qC_Z)EegQanoHqMH1 zd1X=62T;7L8J|WXJU$fT8=J)JzWF9*P%Eop1jzdQlo*Ez6H&>-xsG!(cIB47<_V$x zeQCG#y)!ut+DndgI#?Y|3Vize?Q0kDcdE+n2o20QMI&9u7vAe$9{MoNVK?#X&AbF; z#&7V;0m;;748uA^YN`jt1m0%Y)6rlf??&UP0<`A?#c`WGCaJ2dNi)5FE(dq0ZId7tJ1>sfj{jsSQXQRgg^)647{oRQZ^SufM zQkh?5osc-4I3|%Fr1}5+ZBz!T7N8ee$oC1HO>(*CLX-a5Klzj<eIA$K;<0*VKypZ&$RV-Ek333-lipJd1PP z7LB#$Leuokid$k;u;$cLsdXi7Z@7&IKuBUEp|RbF*LY4u-^eG)H0J$T$gs!|^Mq|s z_}P0ETiWkt>YRSTjGbRrpJh0GiL&HQ!$A#hhypX8vPfHQ>;tb8hh9{r^`Xm3O4f=5 zsDWoG@>3#ref;fex;riupJML;p~K=)qDqeW_vPmvodVJuy}HgHWrpXTo$4KZS@P0m z@fR0J%_X-NkgSGPA2UNUzSb+(baoMn-Bx`iW~|$eNWY&YCe7s=j|p87jCq z{5ZX#quwoSOJ9MF*mpZRvan3!>9Cq$sW6ky$cVo-HYfRlJn~(;#mo8uKnBdwyE34K z?pVwteYQUZcSr|}{0O?Q9dDOXVN%J}`zZ51P2d$nrQUfJ*-VyjdEZMj$#LJ4>@D9G zR!y;yx7@kIdVa|LuGCqz#K{*Y8h$~Sac;4Z8ix+OKe_~i*;#h=5{hMn3odA0JoV;# zsJhnF&CL3%g5j6mnZiHNhSKngw)ouOrd7G7B2w~zulrhXmdFeW`A~cH6Z7h0mD}Dm zuhDZkG;<(Yu3vzWW8-3rS7A(4;y#+k{Funq3_^9&l0Sssy)CA}fAb5cb?|mFq<(#; zGx0{yrHH-dX6OA+*{Q_u&_{81^>dx$=PWeNM4Ibg1d{rZ zBlrDq=Oejmv1_j_C5XerI#(jSm0ZB)9-mX@is?{bWD74suP<(T|2 zvC|~W;;khtVKQVnv1i~9q0zScpL}iAK80rRI6NwgPgA8d;&pp;=SE@kB|SyQK0RFx zrTIr?m8Xp!d1pA^#pL(Yq_NJ3t=_dW_4yHB%f+jukPBD``d9e*bUeIT^iyR8mCaU5 z*ZOd6@A$pGwf4MY+@|@&TOrFVL6^%@&$l{<38JY*-+Z`qj?nzbT}dxuE>raEQ}+iM zmkO>xl8#Z4Nx9z>lN#wpGVS@4DdrxL7k$EUCBRCetu}ACTl(RXKqy_P~&pPckdFx(z<&yWIAYp)`qVC-7 z2znO)Fo#}*Mr&esl(E(OZ9eS=znZs7>~>vsVjH59rCMg9-l=7ERb`sFYxtvQ(eqNT zv)!^FtDAXqIdhMqRwVO33N{cLTE~`8lGr&KU-mUjtM_3Air8Cy`aM`i2rrY-kOoFux}wWQu!LAx9t>8(Y}k2%d_D8YVO?FuzDnBA#sPPht+Qnk|{ z|5H?SwHtg9!M`WnMaWdT?h*SlKc#@?&>@Axzn|`R0oeX*3#UHTCgU`+^TRhOJw7cx zJX#PMNlkKc9QUTMHI@9zv1`weRyu#?ZDU&VGN6ePK)#9lZnB?Uw`d z*S{0Z?koQG7FS+SjQ-VVXPw*G*Dp*SnHa;#(RS)&o4%tya_GhMVQf7ijfG+fC%AN- zpi+D#+>-LG6W&io_YT|Dg`l+~8q!snH~VKHCz>c!eVxOtDfV;nAgP?_cEQFOl0t@p z6hf4+-BRi89}xF$_=*MDE$7QlJWR^8SsFd>pM4VRJ)=(FnHeOR*Pm>zoIBZ#p#pCU zt6GQosKTRfkf_lb`yHP(u~9^6qsO{=@y+23GmTeuqYJJZ=ybg*?i21x3HJ$Ry5K#R zSBD9Q9!fQ1t4^Ljwbm7Rx%4h!6%bFZ%2f=0YkLAXBKRupJ4W_a+C6g2R4cg!khs9)WT` zipOBH-OkH6j|mK(6LLi~uCK3y@{IlIRvs&{J_^0J`oV00iD?oL5=-M+iLjdD%}!~? zek(FCe&;0Gtbbs@ZGH&5PlOsid^Y&{ajTMA+{JRVVW7uwfRjWV>>NXBRGufU zj39Pr1{X0Fd3V4v0Z|Bd5+&ZjgYKU-Y!xdM|0MQICobX4$vHN_FrQt>#eN@PZ6&BH z@m4z$ekr;)l6DZVIzY%ZtRVuL2#^L0^T^bY_Uvq@6gRbT6 zxyfG7M)lU%$T370G6hfXW@?JOrH#mTtHizrgj5sbr+kkN#B(s1hN)^D1E{Ir6n>N= z`ZYd-+^Wc5S_l(W{);`qv);-;QJGXgDdpYn;1tvP&X=lr1nd7@A-kG&YlQ$6KC{LB zGf_7l2{lDQ$*??BJZx`fgt%Em+9|uqc2NX3x5vfnS;60p@V-C4wA>T>d_I!mRUtxg zulEOsvF94Rt*-9n-WYh#&onXOSg{>quUWN|$gR?Z$;R$HVow3~m}(a?prBm1q$_Q* z>hrmgvWmkIgE4sL-YpI+MWAS*(zjGAs<%){&j$Z*6s*4GiSE1pFSRTh?7GC#jU!~@ zpN)CPv(YJ>g)8f(1!ahcW5=ri^ZVJW(+capQRPA$ozObUI}NMcz^oL+d*$QP=BAM7 z)=k)=9kkm|phltruaHkpx(tI#XP|W)0fTMe*y2y2ZjqbNEcMJYV^6OK@7}XzvHDS0 z9v$_^E#iFxu!QQJq8LNs%+bHM*#@y9z4G>-4)&tW=;qI8Zn;=%tg4CT1!jDWTi8%DyFmpQ1G&}+H3^&3&GvuB_vK0)l z)>Wn|2Qw0Tf9xetOnBit(}}!oE4N6XUo%ySXD=-+{nb&O-)Cp%9&Kg_$2hM=t#g2Y z^Z7?D;dYJg{!gF2pd>f?UnhC@>nB}!`)7aq(P6aNR$^QYajR~QhKLN9BTVA=CmOf# zIKwKVJg!3!@LvkxzfFvg2XU;fJH6)B{5%(lM0u;c7X<_p{Ti=fgc`}$B$hBC*S)y13J{XK@&5Wa)not^YXhP8yTA;2vTlvr6&e6h0A z-}+MEkF9a;XHY&{v(;{Aiv!L@Pg-B$ge&g$atm)R^h?ife?u#Gz!)s|;x_p0bFZ~G zE0{d&UJC`de~iQH z_Xex&s;eBIY+dc2^;l}va4I43&Los4kxi8+uyOq1_>3Q~a{F<(YM}2>QDM=-gk(Fc zcqWPC1^UV1!oICVsE9l(Yj1A49uR-?{sgRnws=z!ph|x*lLk|xU3S*zg>V&1dr=JaODwFxSD~MP+GX@y z4c)r|<_tKG7JBNqfCOy44uJBtL}JrtNZ@NVz7@OQEPqB~cwnH=kOQ3GMQ~~X68ku@ z7J@htvK<^ZAOQAye?xhn|JGUl>nfQW16xsLWo7ePz{DP3Uc#`Cf9rIKz}w)aehHP4 zI3+{ZdGnuCCP^zLW^n?y`RgVVZqaIV;d; zW~?$C4WYsXcn9_$>fK*>51=Yt!#h)IbekjEsy1W%HzCIaud6gL7+AwS>MS%Ub0 zgM|5ln&$`VJDIJ&-`wN9QvLuc6W!*{AK?!o`2$3V8~Kq3ko~S0>1;;F8QHL6$Z4S{ ziQQq_!rj(c-uA@vCPrM#UV2b&SUz|Op&$l!M3^XdHUAGCx0UMCIMTy{iT_2-{0*1SCg5V6X_*wfvfW^G`Kgr z%pxKNG#?^iLY;*Bq0cNx_vL1?`eXu)C*>4#W4k2DL<16krDuE)?2{9d=Z#(|9_F%5@*fsWX>`0>UD)5p6Zc~o{4hJxb8ROKD4zRE8TuCljw7Pn6H z!<26Nsm?=NKdXQo*`EjY_n8MUAa!7=vNV)58rrF49oe1yvR~SycD%+9d_MdVe^2wO z==K7M@cwlU{T4vdPhaeabDny8v3UJqPLUss!uRWk|-T&HPx)!xKn21u=WuzcB z9JzZ0MqZfo0PDWKI{E-RB#rtMA^{yo3!RS9(Ww-pdDq665opm7>LlXHO4)KXzKZWt zrMQ|EW0=uVI?j_-k)5+4RcFvAznuWH9KpuDHpf;zcTDR=%NcxlNo8yRG^w5!z5Nk* z*_s9d3%4u7UAiUMS3ogc>MFgc5}t00LsbyDEg!hBsq&k@DZ(vwY=zH+{|q#5d_O8FP4Bk$aAa88WRlgFEXeoVk0v`@g`KUqTkK0XgyC&qUi3ij4Uk$B@nHOgZ$h!lA-^}66}Q_Faw|z+%#cDpqPK4;7*cGU*Q=B<;8rY6sF3irsfxw!#HwDz;3-?(BMm(17!e{yu zQ4Gv#(8|}gmVx2gyCy^#8wH1;?AB?-@xc=D@e|Yq{-C)6GOmt79YmG z%Kl7Pd8f%Us`r4&hikxy%f`mJ!!y@^pl#)G{_}c0Eh-B(nRVuW51%&}1p3m(@3#%4 z{{$<|qf~f}#fy-EPRfV();GD0|2jh}(`l^O#|dksiiE2G`GjASMMZ&ILTqp010cY( zg(q=pqlVb|&l_}gwP2Hx2%T?sH;u_q&$+Ktn^^xgFP@Idk%B>Ae2isdmR?o-6_h%M zHX^AN7NVCo6EK0y1?&C0+{+PcE0fqV4DxvYbo&v}D6v>*xlCxl9nJMWw{Jdj2_jEk zElUmhk@1=pnlDfE)#`_rAO_vUV)BaXVuPk z;ApsbPXwj_!tKz&3xHN2kBo?kD5-qq{dG5VAlh-goe-2w4$3|CL>DhI6a0V1QO+ZQ z6#ji+@Tn0jZ`Ycf)K0V>GH3ADIvtrMutnTr66{@q|6Y?_#ib2QBXSv%u{K5iG*R+T z@PudfWG=zrpKqT~?riuuV_@mlGSqo)kgYOF>WwR!y^*O3PW~6ia*x#{;u$*1rH$&6 z0_;y$>LR#qw$Vn!jh%4sF$w*8*~SZ?-&%A_7ltx5%}WW;G^72}Z+prb1O3v>E0G4>{!o~(iSpWg_XhhfchhX39hL;pRG zqO%d93a0=0)zy2&cwhXp59^`6XaBtnCNa6)J+7FEKR9xRF^LlkP-Ni9Aq7FZ9Q{Ix zflgPNZI0rMY z6;NoMzK)7XM{GA87%mBgKq^h@Em>{zd>ztEN(nxrszXFbF>zT$*xfiELvwrPst)6j zLE>pzV_D5>Rb>BemCm6!{+xcVDZcJ-N%1la&NA;o?~1OmiP&N);hXQm^q8c4cP@+Z z`fDhGB3)Xhn!UOoaSg8Mk9G=KfhoP+p?IgF|2e2S83H{WZ)mmYuvSVNXfr+As|gpm z-D%6cJxAKYffDySZhGSbMXHm9u>=k4=Ln2HR|Qb2f(qT9QED;5%V?&*v+8`9;%KU* z?D<;K-%@6n2x$vLC8C6X(KI1X3cOw4-EIk;YT zinFP(=txOnSS(wTa_ziiaKE;Qb^yCPl0qYyF#IDDb1p@QNl%96AERo-pU-2%4tg?p zZ3nU{k0R@n=^Mqf!+4<7y|iT{qM!LSOPY8^-xZA*$>m36Jws!+#uQ{rbY&?!{Ra{@ z&-AORFe}=!yA|3-%b8$rp8Dr%#{8A1H%bYMd+RH2YX%i@t}gR2TCR3tFg|IO=@!D= zA*N8JXj&NdN_yZGs^@86OV6+t<+;pCWu`v|?1vxsWCCOyGZCrE%E{WB9lCh{P=H}J zR%%dj)OAPmebAgq_P;#S{S&DoWI2hfkm}ca^|(Lxvs$Zar|-07JFArtldcT>FGjUx zh{;{-M8HA_u)O(2d_Ox&gh1-eF7+U5(@*&62P!a4N$GQg+KD3{I~oOJA1{*<6io$9 z6kSN-{FA!#|M3tyha=J#pD*g+gUzK-Xja2u&HEH8jPuVLZzXi~6vG-}SZ7~$Dfc=; z=9Aj`BJ+zVBMIV`pG~D&r14l!9V+L<(#<>@)FW$dR2wS`x71s-kjpPpAryXrKL$CI z3N;W8y&+|pz;#G1X>MyXw1*UKffkT;R@BE>yUQRJYycjTn+t7l=*8(@)QfpP5>a0b zuN@=B3e-h*22%Woej=+5n7~jI+5-$h3$e$DRq)Xa-O)jC(UOB$0UT@jjT7A{Qh?K{ zapvj6^%|yGdpGUc^Tz62C(rE@+@W?zo_pjT<1^jM!;yl@Img?g3Ent`+*Kc`c z+GM%Dc3>_ZmR%VuvP=i{bQQ`t+~c=AuxnSGq@+aKAo;6)c@RL*pXoJz>CR;P4tx$w zmTvfej5U#z=p~DP*hoRYY}A*sbbqhS4%w-YN9!NmNJhi}S@_I_z zY9MA}oaegeSYs|;)W`00RAHUTfV}Lb8_a`e+$qp_4EH8|t<2uaBUf$7*0xJh?1P*_ zhF%P{1j+xrTA~;x31+u}+?*Cd!+h}bf~nRz+#8va>A#%2>NyslFFvWqBjkeHo_rJE zt+Gj~mi_spT~~8`=A}>m3}w43%npXi=3|5^-)Zt$-M{ZxJd%ROGsE)Sgta8e2~sv# zxUzN0Oo>!x3zIA2XNF1mLG0Pw!!*mUHORjUT8CkOH2i#xZ}ea@A2G&ub6@lpz)tjz z%eVeMjDxfIi9}uC7F9AYmTyFRH}0`aKB<6*+(i8>e_!}zSQd$nzGNOFep!j#T~W*F zM;GDcOOx*hYb{|;`)V*Ie4?|sQh3x+Zo_ivR2dUzbnva3vP~jzOqAF?NvTUb*9qcZw#FA+Pvn1@0}% zfI=!u?%WBGFuXeKo(LLlGS8`(gCc2aVEFVv8~rdFCogElLHP+^6*F*03vxJ^o0v}A_p}pe1jp-FwTGr zp~KO+JQ70NXt9cMyEpg=W6r=iBLn#bpstHh&{1g=4e5G+mfEmpaf_JD|D|SIUTmrU z)>b<|3#BX~E>QL%t9gCfwH)8L73f4M#$w~NMuoi5o9gH3ckW}#y1sBKnt4R7FS5Hk z;o+jm^oqh-7wWSJy{t1klgirx`ImUedx(aqbHV7w_nU}Eo=YYl-B|jBtMfTaB9XT= zv&Z`QGJK<0_3j)Mc)Rl9u|2uqWb?rC+N6n`qIH?0t0*oT#Ujc9-4YLp>oWarMv!cQ zzxSgquFs4`s37kjz$O)DOm_f^z`=n|=TGeF`1Suhln=;6Mu0@#;d8BxUL zBm33dpKqbUG*m=GGqC??D+MwSwD$kjH2S1``uqvd)BkckCgRSp7l6$XwAnAv#g76& zo4tm*1{e6B?OrNl0t=*4tie7L|R^?KP$Lr_dREbaX<4gT7TwR_DLnU71;Bf|X;f`k2;1 z%lXwt$Ex|l;RL1P=K}}tyy+t0DviWFXwv+XJ|~n%KwewEKdbo-3Pf)tT0|szV!OS5 zqPZh3smZ)b_y~HupuUGs8Lzfb`irK1d*^gU%AqC6C;6j}A*Ud`yvkl;yGV)sHts>Y zW+lfjH&)fl7v)`@)GI}N)SnMN^R+ zUJfBDlB#cdm#`cDrR zTIHD8*{50qgt74ip{Y&c#XF~!)o9_oqMnXe0kttKHq*7TtAMF$GLt#U=^+myuIt(H zSQx}x@$ns6kB-77KJ4ICmSEHtuzp7|jHX6(_K z*M3`c3GHZVMqWCn`^PgXZp5k%X0CpiT3ubwKHLAYqA-ExN86G?|I`@zKC<$TnssO< zpXyNJQ)8Z3odFv?`Wfux^v%i{y}$&Of-Qb$kK*TKul}VM)|vmbV1+FF_jdz?x|39| zT^afZ|9x|er`+ltw(IVwp9mgqz{tgk5l}$akUJIA23zZr7(*URc=n8 zvWd>g;okWj(gYl5k$JocdLRKaU0(A6U%?p!70*X+Qrb3)oZ+zt6340Q6mfl2hCn(g z1rh7fQBi6?nLiA~H$aoxWHZ6QscDrO=^kuE0*(nb`` zuR+g-`HA1GiCf${+GQ#xX0rA%QsumusC%+o3g}M&U8^rZMF%Lpyt4iTeEU`1c$eT+ zK-ZIsBv8}oc;nXu=i$mw5GEBa>|P&~5p{!t4kUx1d9HBm=LYlvw)nv~i=1))anzRi zf)yiZR12?&?-}Yy4TIT5d!?j9cAy6+37lFx2_b)bTOP_|y)tSU!`|`?EB`TWs_=iT zxGY7$ITNc!5X2>y%C=vDdak(3Qmy@g$pRYwk)?uAN!=`p>jC^^rQZ#}%^yQ$N?#)# z3aUo>4ETBWvY#z{acD~_)$P!&0xlk&p^Bb%ENbk5J0y{^-b8uGh_sDiH}Kt=y5Cs? zMVya=nceW%7W^(KlnaxLv3lCVzl%xVb}RopYrDS}^Aq`cl>?Zhz;BjPS|$&G+3i=q z36lTU4=B)obe4O@P$h|u)kXk`hx1B&T>~lZ{kfYjkrf3c&p(wKpCH|()Q<4Y3~e{# z$@hJQ5BPFUVrRwwT~ny^`|*!C^@04RrcZO!tCo>C&{BM{A4oLM{=G;$>x?tsKAw;A zlK|rRqfecmV0L>Sb-%))E~}!^-daKhi8uLkwSnADhgbB9yTca|$-zzEUzGHV71lZyKQUt9CxQzIrCD9rFMaAS%{_MTD_EXe=u#iV5O@g(^ZAcgS$Oh zvwvn1Nlvf#yX(w=#8R_CHz^J=W(vX zh~Bf2R(wyV)-w-3^h5`|p82S&U(G)g&%OqeJdsS3c~X`sGV z^K@bA&BkssEXuy{so7SCNqm}pavd$aRaPW&U#BTTPQjuG4%ZgiPLCOQPy!(-?flBh z8rWGk#v_u9-ZEdpk~Qy@{gIvZfM8`M62dmhuLQ*AaUR3DaZQ+ z8$dx51jkM#h%5Z}!6Uz)qY~Etrg!tI+P31%20>CaC^gCRt72z&S&`vjL9H9?BLLl{!xI5#>Vx;Pe<;a{WD5WTYGbTF8OtcZ~N|8%>29!DaF4-n!W?R z_)TDgG#y z(S4@-CcJ;oRV}n?1;&H`)yDjXPN+Ii*Z*6!+rt$Mhb!(k?L&dNI zMxOmdiCv*uPoFvQdKebQ+8sQmp1F~46hQmlF~?OO4=?C8ZlNyOz5~9*v|J;VN7S$S z5}2#%ibyH!81oRpz4jAwd)Bfrcz1FD`L*;kJ`GZm~pu+BNYyb!wqio^&BV_Ic91RKz@mzI?FJZ zs%4R>e>JvNb6_a40f!2dqrDPoXG{zqW1haaRx^2NEpnA(t%XmbyX9j#>a!dT zG5+E~Bm}&<^b*YI?*sn}`y;u_Z%UIQZmSU--rb|511uxa^yMdjqVna-o4x0#3VEOZ zm6Y-j5~BQ*6j0m_5)tdK|EJJUVeU~{2dza1LS9?Opeh|?DF6b<{KDgFh3=uE!tTks zLWL)DtODuk2`udY8QZV-M;@&9Kf4U;Da7E+t${vuP_U8cOSMTPq7DwK;%`uHn!z(< z0qw8j*tmanGx7aBmvB7X(fSW{LJoJC%#!e6{*)Ku_6CVYzSeYK=J@jQFo=2rtdX1o z^)ZE6?wj;5a_F~s_=k?1y$QZ&7*)Nwx>uXybF8y;;(J4?{il}Hl(H>!dYZOWx3L@r ze_~ebq(Euik{@61x*v~0kv)?^FFewrRkjS3ShcMCGoHUiEkr(jVD_zj%BNE}4wf~l zt^?LnYWZ)9(!4vlmX07o_nsMEU)wC5D0@AYbnGjGpAI^NGEDud9Pj0f6CYi((hboS zs`eNmExR6pBJdr*rAG={nfyI}&8vGD#k338 z_^hxnUhS$*!b`KawjSEu^l1Z57enZ>tI@Ano^B=L2uSp>1J+nu+hE&@M zTv-9=xmPOf>)*h!gm#5S8>T-Cr!OFv{U1pwZ!~?^llhO-+qSI0X}#=qN0H^KnrI+0 z*VHFN3@bq14CvOP;u{M+IcQGYXl4!-liGZ#yteVm4fTx5$8=)Q+?*c)@-46gA+Gc|OU?1N6RUW8Uv+ojody2yUG(nE zEU!go9`OYYx&M&lih5+&Gqk6#kb><$0DO)5J^WoIML(GRpb>iksZAn4kA4$`h zDo3#+CLqr-$E}ip0U2GMr>V~T(wiRyVv}_<;4->ukJr(ZE7n$UvAt}V8m%#c?h>!zE0C@7E*w4=bo)!1|3*Gb zyIv2LFk?Sw&@59sW*<{t$}B1b=PGaBJvdA@++fE+VH#6|A%1U_08HnVbRtf0o6giI z+M0Ja`4+lPX7zDG3ch?9l2XkIFItV1d&MrnD#$c2$rUA&T!yz#bVIFQPZDA-*GLau z=`?=UTk5hmJ} zsJ#OT;Rtq6hr^7&;t^b^%3-Aw~mgf*o|Yh>ok4w^a{H3@0BGMW+Qlv>}`7asjtrXj+P*5IvrGq4PC1pUW)-=)4X+HqA)xBznVw(+Jd-0p<*+aGG`S7$YIfo)d_u_ zVkCkX_i50;$;mQ?RIiY(WqE6{Ci&m;SO_^)&S|(e%315lJo~TyF?od`jlrEyI%bYE z$iUfhLW?+p2j!rTx`l&5TmmX^n}1;-Y#F0@aHbv$OMWXDr4_qs&uM?<5ym0i!a%QR zYBu@w&b5e9i&y=rC+3OXI@I7R4l*Kwoxl33ZlKIT67;*bq|tqFYs1TZtA1pjg%H)3 z=(cr|v>EfKr{|=1LR@)8iV7i32C53vv?-Z;x3Nin&MJ!7J8u_W`O;?p>YYs)aEecr zVrZotPY%?qF=@>gjVPG@GPQLg>Z269h6#wuu2P6zcAPmiUypN9D)9ip0kJy|OSMra z|A^TL)8%ULA8z4(JsZ8Q`bgbvyUn}@}EkY z7fMkhTHLfr!)^$tr|JoEeJ@iL6^<|Jw@f`0_>wuwQ-)&EW`v%2C5+CCc6f7K@ypGk z%evtX#FL!d6aH|?vJ|ySTKnsx8%Y-GgVAsEO+^LsLu#e77jO1_-6`CL@4O&de z`QCOzSiG&oss1;HT%Er#faj^y&wP5zY$4KKS<+Nq}*s+oE!O^VNFLB61Wug3mU zuAfe7c0Ru$GFs)X5Wi0PO6he~4X(?(K?xdgt#+l(H8_@&$1WzxYC{jjtrPc$@wUGW z8kLdHx7JACmj?BnVGi^dGCF+iFfenV+uPXM5+_O+N!`5vcyypD9PnJjY!9J#tp^Te zLh)|^r%2hgtJ*JtCG<#iOr`xd z$U`&iqWZ!$OKj_`+?ulrA5T{D!j0e3ENFhIAS<`yP}#Omcv`=cx|N1Ic!+#La3K@ zQhT1e{DSg_`dmxxKTAr=-Tm-%K_q4oi8#{pt)^K^_7%-ITqqNY zyznrIF5$k09S22=(SY&sSE6@h{hTB4JmTrSl%Y{lnoH-0eSdtCqQF}*b;vmTRI2v) zJwV2;=VPvE%;kpZsaoKAivM;@9M8y*b!sJtD-XU|Ddm5vHR|A0^^FhwsU1!>4%V|w zA7~qO5lK$8Hy=96%FBO!6vNO^-b#jhqTR$T+VF8GLM1g*o;KUo$nR@6SCU@a3zV_} zGgRT{4CmaYQ8@GZ(dRnu6pfo_A4KI)XIm)VY0Dc|RCbn?F9KIF^Cj~ohO6+U%O^D~ zr_lQ^{x*^>scMzicq$5^*keuEm(yKdj{^D}+8@KSvai`B zzcWbcdKdmgJ;GndO`$j5RopO(9TsGUv zB}j*aB3%NAg^my@p@URIZ=opln}FQwuf65@-sjOj6q0l1oS8j))?Rz9!=JC3XjTQU z78|536(@zpvUaMt)jK>Mc7B(mxY;*jA$WXTc1@hdRaOvV#8x*& zb+AoXf9#xND( z(*V#v=7$pGf%Axh?gyI_>3~uD2LQ~=%jbs~qxgG%BmD&O0Un!u|KuPC>XiC@)ES*) zXUJSa8ylN_fFV?(%MTcY|IAqcw8D`_SHcoHLZn6<5UBYRSGrv((K+2b8W3)r5y0i19Je0we5}P zqRV;Jkm-wmrv;Cbbd;_7fZ&VYSaq@Sqm$iq$?gzn5tmiHGkS$lRYl}wD_r&6i&t8hDM`hbvWxm1FX+TcPd|@xB$nnje&e~$CFpr(j5)f2D?(S2%bT|f%kBJ*PUr3ruvVQu!A72nQp2cyl4Ra;N+Vc;B9?oFs;gz9+ z>zzO!!0T=U$u^nKOpT-X5ss*Hz~g1fZfOX0h>QCdfA-|nKuY)=puWoY%aiE|4)1@6 zl9SC{S}eH@ANOtphYJF%SP^Wc_qUzmvePv{*>PT;BnVSP-;vn*Vg65ShVd@l@flqTC7TP?{q2A7&$#a z)zB_Cg;|wwt7f)paFxYoom&oedt}0G)M(pvEzRzzY^701yV}=6?H{Iv(4udmMcIj{AbBo`+wawenj1}`5GD$C9qTFmSv+@ad zFV3krT2#7%g?vanzFzpY2%=TgRZ;cTk4a%CW__jwxA|j1n|Du0?wQpEGdA2u)qsG| zip^Mj^^;*p#m|b%%TT8SZeboI^m2K#0(!pOCw4sVm48>{e;o_o_!; zr!$`4oh-QU_0O)jPljqjS%Ei>2zK$XDb{HTRW$@LAzi`f3@nmurGTof74P zWNGBdH~Zy!-H3JQ+C64_TDbi&xE_tlpgn<#Tb(>}QHNOqa1Z1O=)#^g^IJXG!DG=+2<>NFKR7>Rr-w(Wu!3w;yL2#+U z1U>e*0)Du7wwm^_(YqKP%|@5&K&0V&@%g)6?JTK0U13`^j;}JN!_>`Iy*2dEowq~tx-L_x=-yCe@B_V`tF{a8pt_*wsjysW#lE@QLh9yU678d$fy9aq z7cCb&(>SvZwV2lRF2*h>mVa}gjfdbOo42y0b4?3IbQaJX%c-&ytl^6?>Qu?PKcRF_ z5&4ax{poD z6RKP9qUA~z1m&S%yFX56PhQtOPoEbXFps;EV@osVfqII>g zI}mC1tVGsT;#rbf7)kbL?DJD+*)W8P6WX~3gPpoGq>7MwYQN$4WZJUxCb3)A#BNa&^vHkXNh*cmWD6Ay>F6NTED`K)7g%$r_zPAdi9Q&da+Rc zw?D|o)kj1E4BuBdV+0@Q-*RozWP5TqT2NK%p0a*-s%5t|`O1P&Afh|;f=S=pHQK3Kp`U;hjP zEthD`Nh5Bd2UxR!kO+g3;hVLpFg#kubvXZh>{+|ckmbsVY5EdJI!>?8;hw0EeLsAy z({+6wdE>PLbU1bBxRZ1BD%dyK&&&`8mr{HG!tk7yVb^MC(Dc{uGjn7WSJRKz|DBk# zm8qJ-)nEcAiyT=0&Zz2g+T`%DqpJm(FS+!ol}44; z{|FyQY%f+HN$^GiNbV;d&&Ne5kVIv?5QnaN4Yanlk~5|Je6z59Yk-yl-XK*g3j6?w zR#t9|2|&Zt2|qqdZhXG&Pg$|C*jRkvjpa_VG2k-V-qHVYaCXw5E9d37r?=~yUaT#A zAjzi6=%yPy4|})8i<85xgr)UWfv5ypsM`xH;LpZK7Vj-mf+=KRkk3T1xx3q? zu{Jzu&gD)BI;xIQ3Va2>V9Vm=Dc|{gqM3y2K5f;IQJGMZm$v{EAxNl%jZqGXg#geU zrOnhs`DYfH2?SU*bwKr{sKzQ&48qtUE~*uet$jzFFS|E_mYuzOcBRdK`p4YetgI~W zpN*zlev&`@AiVEN0c^l;diV47ctm9JiBnE2JuZZ?dig|O)sC+glucS<+qBl4CTkXX zvx`ar0WGo%Uo})O6tlFdxJ@HNInW-%BlpEtc68xN3GOcVHc9s!*wEXjTce`w0|$HqC_-e#@{6p#E3^PVX2;7%%kKN;W${Q z_)w_Jk`L%nyaAhJLwiDDH%+3W!XIW<^2+`mc&_`am|1_Ei2j2+;YIc=07=Yc|jl>|Gz_ko*Y{;~w)rC&(dXuwv$3`idU*?3-u&@i^E7 z-H7EWW0l7iWlMhW5_=tPF+pRM*+eVJl(OlkL@wX$^=}aQQ722Tu`y5IV&0uL(j1E~ zvb>=l@Mxg}$X5SUCt(*_nf+5v8f>{a_5o4V`L9GZiWunux8G}*+h1>=FNa1vT$$ES z^~A$hItiua>x1$2W3#|WqtH2i}%z>p`W|I}i zS_dOg)c)WZqu|T1YB00sDz|+HhM-S{d;FryUNgu;rdx|qES}?+yeO_d-MLw2AW`T6 zQ%i)MCiqQ|*W?G%(Fui`@5n%~8hk+0c*zk8twVc@Cb*5XGv-B9!l=XGr|Y}t_$N!3 zN0wkR3!)Ea_I+6TE8jN;yQh8dDU6o~Bqi z3Ok)f_1@+ZII&Q4vCYGxWq;&61w)~L?u30H-8ny0MhCi85Bv$=|3CWF|NcWDk^x-_ zI*L2_r7l02)~Utmc5ecDN)B=&qM`|F-7mRi$ke_cqp`V_j`dqrp@;syYbnp2CM)kw zDS(TB=ShYLc837o2KkUVZ+v1mZjn#BgFC}%6c5X#oXyE0NTQf`U>x!z0|(Jj9;IIQ zBL~8>Yi-OSx5!OWIZtg)qY$?C2rKpxrB} zNX^5pJ^TGvL1n#i4F*}yl>1DS`bS}fM9AYfhaz_u?iw}(n2Sx_afU)b%T7X0Ejp!>c>PJTpc)WAm0c&@Z7hw zTTFh02s0c2R)pPh95LDWIXurh;D3~~N^_Wjfpq7|vqFlslof#8Exb>edybImfL1Z+~^3r#m zxx|h~KhFNuGmj3G`Cy|3MGn1$zxnK}*wQhEPxmjocf zrM7t(KJ@^A_AV;@wCJC#w|f!p2Z0jpqn%mma5mo%FT{t&M-WoX1Mqw>e3l7GsF%4n zBGjm-8Y{rK{Q0J6Coh6K{{6+<#kXWB$?*TqlrC3z-g16jQ?pCW3ttf8hP%o)p*QTz zh}YukYfMEVuFMK!uNGtwUkBt@a85N#Nqi2n_Y1y226MeTImq+r9(4Boi{<6;>05u# zq;MaF869DC$xiR(2X_?Og&z9fOg^?04l*+J!JUuX8M@mI#LrLh;UH;695Jmnt+%)A zKuPWZ#nHWg{a1?+`lq$~zh8x5!QTmszJ?cf97KCj#=SivamrXjmPyk03gi#ulE^#% zz7NcT`snngv=+OSK2i?MZ4T&XCc6^6SWv3lDGH^{4CYkLeRVW%nC@(yC6?=I393gOcM6OT}Ze$(5kZKT=DVm2yOzRJ2ry4erUL>Hl zT^S(oAk<6T*R8&_u%>8#-l9ssbHk7**xp*eF?Vx|rh!1(o1L7d)--DCSa=DaGpB#~`#=%zZ z5^uAprg6S8oeihXrQn)i0gkDajLSOI4XM({mRnS;$$Eg@CN8gzjK#!IADM-}VSSc~ zclzUine%Z6xJo0$Jwo27clMOEDWt*WIK89TqX%zK%42w3&JylYGAbUEE6Z_WAF>d6ht0D1QF0dqdDXReRpDOjkYMkjeB+ zX}z|%E8sx2Heq5r^v+W>ec83ZI{|k%J`NrHYwv?Emwz>8#O|H*TpO*pbuO(W z9noQ9jpfZFNV`|0>WsBhx|YRWJWLyHeWdDy;iipe()-(|m+tF6Z#ws7(W!cLa(%Zz z4>H!JHj-5BRqdp^66dV(nJM#7%Ywrc*n6BhK3M=V-b9uQUdJO&Dh z3xtpTgrWzHARnBgEM`89%W?2!e<0|$?EffO)G?)w&s8sS`r78E7sFL1&Zbz3#?PdS zLO>ZP>=owi*hCZ7Z^m4$ET@RnQ}`*8l)glK6S^RD)9Fc_CQ~GP88{xGz5u1ccg8ni4!{W^!=PGCmUkFMEy&?!ur9--@UOM;{3>~}^-WzmOe_6Lv-lW^G zJCT1Z;Esmfb0SE_?!|S}Z9Iy@<2Q35jnRgw|a9M@4Q_cZOWhb z7zhx)+}?^t$5wnF0+J%+Wp)hR$&-bhkc4Gog&FogQu<-!ZSVG5HWE)Qv5JA!!LAqF z5Yp@iz;MzySNa4Ods>rw<^!gFkHIIg=cw|JR~l`0wcd~JR=Q{J239c2%!>vxE3{Nh z!e2Vsh&8`Le6;vQs{e5S4= z!;L6bR;#}x1D7!`-yqazc_vMK?!{Py&tG`PhXP>&pdWJbYLAIChg6?)3telaxpR^W zqljy{Q-nDW{X+ZL3~T@T;A5aCcC`&*x(&p($W7tY90G&Le)CP$ zcTskN3GnkF%I=f;gf}T(0Yx++I>|Cs-y3G{;D@*l7F^p2sURCHDd{9bsk#tPFG`O3oAAF{+xL48BW3;e z$6o8v)>x8>$FhpZ2WLoQBZxnXXzkzk#l|rhD-ChoVc7-hLE8K3YL^;C+ku@dkQr=O z9?Z&YyVHx}t=u5;YRK+e13Ta&;>YWs+#x>jbdFGX0g12Oyc+1o{r8{xFFyp@ET>qu z)^<@@9sqmq&(OM@tfvr^Cw7Vx&X_&#K|3b=W@89Z(o=E|l) z*eQ2hD0>d*)1N_(L4J)8;JclC`s*Y?CWkN_-yQ3vO~947O0%2)=L`H*81MqD&O4mD zkARwa=Cz4W=9l>S(j zp7ep&yFg!A5V(|-FX7wS%DZ`lWQP_-@T)S>U3YKzGH4ENoW`xw5PA0Lc3cxLZW=>x6r4NpGH-z zM0xxEj7g=mX^7~uRPK!9eRe=Ip|PEgU3`aGMSik@#J@W;OqqSww_#2S1KM@`FC$|Y zkZ9j_4z2Q;Wj9*;nlx_4_U=bSVNQW_04eyOPCmvAu9B{ZP>pb1lfYwpb(%;q3B+^t zkn@Q93QVm;+W}Rd^Y^=TaMFSuqi#)xE3jC1FILrAtEZ!h+r!4MV~E1rzJQs1zZWRY zNQ~Y!asTbTbqmtzlrJpB;csY#PwFE|(CNduIc1aRbXF0qHsP7HV)yl~R$U&vGeO(q zWv3PS$v}HiEMf1V@5i&HNdEn$|I;ZawFZbOdlT)+635=C!F-S8H{R-geFCUL%Y(Du zhWFM60gISXn;!5ZeuTgp1lhAc+8sD0kc-uzZfE}cQUG*P3JNf_|F2dj80PPRKuFejC-0~Di_h%WdGg9xv0%FHhF%dYjSVFjdt z_yw?XB-gtEMD>XoqEKcehwjtxIdXQhgWG-Gib%EV_uZ+_p~+<>F?|#%-MV5Vz^$l` zKB)m18*GUjtvmv%iUaTP6ZJr#bPn2Hms~H9yuEk_Lq^R&-kQjs70+@q$0YaLh){sU zRD<@HdVXWUgovtXyq{oEDhV5c6JbX~MAP1YX0+$Pnc8WCuV0@ zQ^*0K?8O2oth3}Hw3?Aw-bTObDy|_)c`i4kLE^?M9y(V=zB5zj4`5Hq_TJVgc&}^g z>Et!$yJQ*PiYWJw$#&EEvaDJ~V#;|AT!5vvr4u6sq!S>Kr^-rOV4P! zycU9b4LWsVzioU6u;{TZYraviZRxj|;)O)i^+Mkl#jd+ROU$Mz(`O$iC53QYWndJ4 ze??HRR6`?Q^MbWaW_{AlS37F|^sZDD3S0^^ZtMca!l^Sx)bK9j61}1%?9eN0j=^S4 z{0|dDhXCmGD}=x`lO<1ZT~LA#;6U#n#CT|n1gr7;Lf&&dr;*LH+@iEi+Q?KKw__44qHVr?i*V^KnEmM%~0!-m^10UR|I zyq^U%@q|ak(&En8-5ye*a_}&6%tQFil~Y%6s>+lwn}vf?J8j8mew|tAgfv9QIW?>? zt;Qh$Tpr3bHEdc|O?i&CG15A{!orUW&&*jH&=g1AeaZ((v`ZwKZ9Pt(1ttq-<+klq zvSuzRlYx3lc391@q_(!+0{eR>CL7$6a>e=FfVshul{Rbps@Kyx*GBp!2#H%pvy$Dk zy@p^0K5HE3T8`}L#Nv!5Z`+oKLUtTC*^p!ypD4Ng6M)*1KiWYUsiIcf*jlYDVWQ9n z5GSO&G+!}uLu*2bip%6lFx(C{H(HPKr({|qBl~K;izqO4M3H|U@!36)u3RT~?>Qh_~PQ1$#_TUTa2&o(#%u9(Mj(H8XeWkT% zUl_4mbU&I*9>M4gk_;gN-2g=Auql)YK|P)cS>(RPwh}8=0GT}%@J=A)No$_p;%z~GYO$9p!r!2XL4v5+rdN_uB77{?koeDQIb_~(B@F@K$HHo z=mIsglquF5?_r(?uv@SP!5mcn_Pg0?d^gOTYuKF7ivO%^en)9}VSrH+QnY=GY`rpx zbra31HdvUc4}bbNdY>b`!i@ELSLU#EaV}=xBDc=|>)tuAr_rZnc%)?m>4aq>PN|kE zj}FVNQkx=_zeyBdh6@M|q--J~6?xz<=%XaOs=CKN$-{+8mtjKPMtG|D%DbN1ztu8J zN-k?en@KHHrhP1YRguj-h0f2bK3BiCWm4s7&-7HU;kK>n3!iF=L=&AVUT&?yw^6%Iy zAJ6hx5@Z|b=3Xu12nH=drr*MH)Ym_CuPheCMTlv|t`LPU0e(QBSMmDzZ1<1~q}O*> z%Xq*?kA@6Y*-zj1zNud#CzBMT&d;ux5oWI$1hAWim84`CXJ>odjfZplXa$vhA`hHD z6RYJhW%W#lig@v`mxc5(r1djBWFFgpRKY)gm^|JScp>+1Qu~*(d-|SDt=dNAD>OPk ze&&vJ^KP1%Hp(@Yv68m9BuJd^R8&>7&%MGT=84kuBx^k2tQC7pbw2Sur7wul`&Ry7 zK~0~ZXjgwqX*OMc8Ga@%ycgvabPmdSW9%ON`I+YamMji!wzDHLa;54iGHk~$17ZN@ z{qv)a!g4;>PL~8SmpozS4ZJcR^%Ye?>laU;I?z}9@TEcWjV1avX%YQX$NkI9EB+v8 z&lcrxLVM0sIH{Lrm$wU3ii3Klfc{zC-k6Lk9AxT0SJkTa_D@X^YJYeJZi>zRhn zEl)aSk1ma_Ok(csibg!M9_D}LAd~$aSGbzE_FYD)hxCOwPAY#W`SE*@(D9WKN|dE_ z+gACN%Vn!DXJ|Qq`w>jpRmS>tD0wJ-x@=_gkL&yYv-gLvx#K~l>p2jEjKG72veVzS zo^zeernApK|Ee$8{pG^%#sIoxCDUPi<*MpKjxNX0ijB2VPZP&l<81rSXyWVM(lVAP zV=H`6Sf`S-?H{LCnD<94T>c>R>|r+8mEm~hfar{92H=zF4yFBX8Hi zg2992?fL^X4ZShP6%+J9kD9>=DQl2YX+|trd0NC5753;*>C8_~b`XXP6|F2EJ+mUpvVKfx^vc$q8QW^yc>aPe?Jr(;XyMcNKR(T6Z(3 zKkXr#mhtzCPW1L*IsLCuOIl2$X*Un+QF;=mDA(bMu)I^_i8}E$m<1CJ>}AJcOzHV( zvD{1KLx2y`0XwW8I)~IfADDjYd#>SRPKrD`RMRNSbeG}jn|Cy>uoIbfMFu>Az#hql zyZB9xEyv-ov}bb-vh=5)q%9kvVoql=uydcSd(m5|>cON59T0O{U|SFH9dbbwjdzT! z6&Q+orimoScOJYKg{H4Kgjm(w@nHEk7A)7F{jy+zc0E`Q-apI#oh1MnXx(zQ(sT$@ zi)ha-I;9tQZs0uOCqtkFyqR&#VF#GeUFBD=uzqA}IP^WXLKuHkwU6qxFet+0vpV1z zErb6!dhDoi$h5@!p1_9-hG~A4{`=Y<<;TAo`*>ytfzHJ~Ae_NFNRciwrL>UV{b1sI zOk94#vpB;Z4EoVP-NH30jov#Y=rTMk=-V~an`boA|Gek#9zw~RPYHT8A;C}+BS$Vb zIxd3vyd&2D&TiSz51UlaCodG5$tuc_8S21`r&ss-nsx;~HyY_#fB_P@A`6h36m9(P zn!%HnN*Ef{EaxB4P0s-`noCqW6wKbAj#(($NN&nw`!<2$4rc|kUh%LYarmj zYM=AqlYd~Bc97rv`WW(Qypb_(xG31EO)*^v&qK?7MN`eegqCkhJ|erezb?ngS_whP zA6^;4L?jnAa~*tBJKi^XM5RKp0<)pXl{}cHch}Lbn_l^4bFECW_IKKwT&9sdw&(lr zNHb@&mprN)TMzK@xQr=o8-c9)|n02oUPyeF}- zigkSzmEf+RBj|KdEfRCC#<55S^>5yVpPG{sdbtv?@jY+t3YCfI&Y_99A1T^N&b{=( z37x8Seq2*}tNV7QKd#!BTJlx`M#y#e z<5G<^5PGQ#1hpaIpEnfy3L)><1!nz;bZMg6YfG6G$2VRqM05geTYvOmX$)g7Yok4j zc&ZVG!8B_)?Ny6-3t>su?ob)Aj;Yft`8+?S_Qa{h>q@zrl>Cg#6k6YW)E7z;Q}r+C zBJypO<8AdNlPp>$K2nx6%XO$2{Shy%(q^)bssGr-F;+4a-cl+SE&%B!-SdQdxV;tgi-YSvzgHid<@X9aR=pi_xJ`4V7?b7I zP(x>Vd1~E@YO2(g#*FK9-c6NZ z-3saGKmW9^F8^s#z^Qlgu3BYh&1lL-CS%f`yNkKq%M4D_IQ7vJUsVeWkUd+iAJ?AVA=h=XZ zz&{x86Vyn(%V?q>QB@x!4a1jBbKC3Q^Bl1@3RYm( zTq@b~h@%l|@yX?sw-Dh!B9kmTUo^wizRC4(>hvM2wG-f&XX6Xc3S-Dg*Z(Bv zLLG==hv4lAV}5i|^RkQ;ev>sKkH-uG_cTdwhkniw#KnH0=jLNPT5W4~-y^gsmjgfU%(!UC_*?u#>@=@D_r?DJllKHnPt zAG0lp^Zz8>;sEJZCMS8-ZUIl=mQ~5kE;gqFZSFT5@ub=3CgGDEdfEk|2BfQBR78!# z4b5j{ZM>yI+imKh*b)PNcD;{x)KtDqyrOQpigfcmZmf6Q{wMbuZ5^>5ipG}`S_N^`;-rep zhxm(#?Gb7rxsc3D!mcVdrKdz+Va|B9_+hBRRU*5r zlgb8KF~IE)*ROKM@3?Z&f#IjwTf%USZ;3}dg?OsIpS+JOHFH`%P8iFbrlookgnSiC zDa6-_qnx*GKewqE&W z{#V>^!0;5^*d;cEli46JT1Wa}jVE*(1aPJ>q@aaGNk~_XS=99+9*tY+eJ@o!@e4c& z=UILRrW9WmW!W5fAkP8vwpiU&!`-|M`Umg44Ya9xd&KJ2Kbq%V`1~*Cd0H>EzRY)I zG}o#xO*js4LezP;%%qEO?vEyQPHglX7yUM!jg&2lQXD* z@tg3I(Uh-dr>mSO@Z4lZ!;0Wqi}w7|^B3?Fph60WBm$8oLOZ#f!*G&l$+c9r&&_#whd+rFG;rUoWa73=%lmOy*yy-+#;%|EjC) zQUA#8r-|e_-~pM;IayE5-kDl><7n+P*0uccr`9btt5~1;e+ww_?bIR5LzDTe$!$5d z2n845i}-a$=gAXz1+vI?PTBqmQJ4>IQ0QBY$8p_{EZK(wVAC-<+#s?{arIv*IS}CF zl$nKH9}`Q~=?M0eE&D@&HpfE5_FS9D!DQ1MSu>6YJ-qomj>Gxg+h;|0S&sd(uiJhS zejF&!j*8^FD_>IqT6nT0a>?L50PJTP9Nc*C`T`d(0l2l>ccjka_!MB^$Q=);)eFow zzH*A5ngkFT`!2QwjlnC`{oev`$=FC1p3J2AH?^m>dOV6pVd-GSS|*A%f#BhOOty>} zyqrVmPK%`x(NuLodIfg^ty~Ex5eB03g{G{Pdq}oQZ6k$1J6seEQq;9(tbO@P*o`&H z*m2vPuB#iKB?P{2WKNJ(_CX0?Eeaj&(EsHvx)S^2*kSrkrXul$w|cvr{?5Da^9zmZ z0@uH$@g&{om|r55ziq66Nfro*^*g`+^ymvO)6jFm`nMT#B^5M+-}r*8?lGCSg|d~e zq8aS6R&1$B<>AJ8yjjXRdhEG{iBsk$W)F(g*} z?##8D?_V%qvdc`>!jAJHS@ot>UV-~vNwc=F7C#pB%By1rcgJ{MZ>!bP-zOuV!TAkm@;^ zHysC|fdkxT(QCX%u3r>MpYLcpiDhlRb#kTQ`Ps$xlX;6~awbedr8ln5mem>EHm|BR5G6Qt)sdDs|xH_g+G*IL$AE^d9Z%SQf`y=e@Pz$^3;o9wg92ko7fyL@ig$F8E-?xx3sVM9_euq+wwu{+qVbnto zV6-5?;L3mEO3(=ME{;?V_1FoSojUw)xM0h3u@Rg9EgS4Ejks)9TpTSrOs*94S>5Pk z3L=w5J`ZR&-N9#SJuqq9C7j!d2HcRgx(~?eSJf~0Jjjy42HSMX#5F+U6OR%~SE4%} zC@dx%>e)<*6!Fj0acQr^Vhx8a3VFv=v}c;}ngs2~@ibnMGKve?%^IRTr&0nDey;Q7 zpmWlx(?wLT-*T=Hr!pj)hWm1Bl)n$m{Arof7+C-fnqdQGJ(aKk6`gbwy>*iNDuMDj zeeqi7lC+OM^LSGhbS73PdJI^i6L_?vfW@Np8UF7Y_L{&v)12|^ZLAm=iV0-%J%e-7 zRU4)4?Aoz4dUt2zFyY9w3JgVlFLagY*Qt;67~)JA4agZpMhG&B%8aWT*<=m84qqe9 zr>Z1jqsNB_kUtS0^bCN+sxhDMKACW9^Ti7)w}v37XxQm0Ivq4s$~b%_RJ40vYe#Fb zmtiPxcMqszq-|?hT2iQFj58%=f<)izjG3XYbR{z13!h@xsNP@`RMX%y7+&QuTK*A; zD=OZnB>34dS&Zd&OL{Fbc|)b@Z~zrya^MgK!8dQi)9};8AC@|9ur*&N2FTVsO!ci4 z=ElE3npqiO2%NS>Q79{N|7-b=SkS#7>v)xLhU5o zehSnVvYixgPpKmBoIADtKdp`cHwy$*4K$iS%gWkvE@Zde&(1&(G@?O{kY@^9`5usa zkn+;eB^4DuKj|I#;$oqR>3Wv;i`iuD*qYa+1p>UhXdmE-$nL$O1pL=R$S=iZ%7*q`kzToBr-XpilBx8TJ z79>!{`As93Z*F~fP0IBK16T<6+{t8WhWn^?|6O?$U>Uz}se#WZOF6_c4yA#$xOvFyx zp$9$(0W&jC--RNwrY_lj4#?e;8y3(npA`g=9;qqIcq3wgAY&vwcHlu;Kd>u}``JS7 zU!n&dlZxcK{Y3iyOAs{HXl-m;qT+|p z1r}aA7unU4hE{(zXf@(DH(vj7C5^R}uw;pKkzHh+8F)3ZTn^qc4p62lj{%c4&;ya> zF<2+w(7Ltuli(i)y^V!!4VTrbZQpnikony4MwI4vI^w3K$H2M~a6P_=Am3aL5X|!O zS}&?b?0+2{SY^!TzT*W(E?8C{p!gG1<&?=fN@dQ(=I-jBRvSm`0P+M3oVv)ihJcX5 zNv<)9ZOmanx5hm1B|PeFwupKt%;%P497a|#nvQqFd(D@wOsqo6oSz6EEzX}Xm35r638=^8+g0l{9ljj-I^*S7&=p*(>k(~}qB zNxl!;!@@Ri?e78vG_pQ1xsd;tlz&PF3s}@O$50aGvQWq+xsD@b?erQG8Pi9P8hWOU zx@6{I47)nLoys+6(VK4U?waS-UQ@Y8NBaVaHhxvN*>PEYAjj6x%fD6QozS+7jReZ; zf=+MqoZg-^{Ufdsn=LRZArM-L`IiAElfV1x9 zn&9gFynsVE?F6X4UQ&n}^ z?|=OFjYznA$QUQ|6Nl2jc}%8qJZ9|LO1pBV!^_1BLZ+|MCSK4lKFTI|ZL~b`6@#cu z`D#{5Eo~IGT~~X7j&Okc)2s;@s42{vRQBYY zUDJ|V@l-+?i*4V^JD(taesQ`9nva zet?O!`uFfXX&Qgr5!gyO1iPJ+B*~b`on#ZZ8C_TO*wwtvxXgt0f@$HwN(y>(QNTcU zj{fXrB-h47M8?nXwkb3s{?qfu?wlTBuEUpur1?LMg2gGgdn##iarL>fzDkl^gr#2; zxotWvl@pe&K3Z^KR@HLs}I6&w8rMi6%hIc;7cUd3JPRF|A+F?9T zGJUIM6nE?5O^d5=0~JxR5+zUcJG1O48{Cx%R-J~RGsSbjp$XcX=qJ$}v{e#!G5SjF z3GIC$%Rf(LK0p&ExUyln3|vRF4Hd;h67u2sc<$80_3VYNrH|1EQu$@x-uCKnN@2ce z4Cqpr_!5(xiI~el+EycvM*w-yd^Z!0nJ6Xd%Pm~5ekawEp%onb6O}`4@HCP^94Mz& zE3Jie1+3~wsz~{zG<=$1USE;&gHYCPUQ=NzwCP8y#XFCaOnoF(V=IqX||sZ zU0cYLl&A38%`pG}f)1SQe;P^eS2OE;&*!20n|u**dbjWZ&=|Qlq>rQ|uFF7gn?QRzKBg&Wuk7l$| z68Wjeke))#c}XD+q^dtvMObJSV7dKg<89e0|DJ%ahu6OB2|kjY2&Q2UvJ$k^p~FEj zz~eyjzM;wW)4kIpe~^L|AvXt&pb2~B`E_S|s63FjOr$I$;q~iqQ zw_c&gBOjccq)%-)Zt#6HXBy~dV-sX5r0iOHWL9{hpD^Ue)S!~?w% z4=ci^JRvYnEjNm>-U?sy>UC1eEI7*jBgpf>S=zIVu`9m~^+@Ogyw`Zwu`b-uKu(mqN@$UAU8_clE=WS;+9u*BgcZf^OSSh!9)f7LvuSc@ipsjqQ4 zq)2liGF&{<%YR-M@^em~|TD|DtGhmeK9BMY;i!v8ttMma;%|$c=?r;$-?N$wrdjqwy~(3H z9y}Z08TA%JH(y_^G4rZ{htot2&yZUSW7#k-v zH8mxauO!QbO8#;59M|L#xy>J4EU1ea=k|R>C1xu^CWt-7WK|nF;v5k5J{aOf=QDAb z8we8LMX>z#LP4H*r8Z|&Rnd`4Xp)i$q+Fe&=xr*@2}JcjCJqY{1J-o=JC`^~Bk7Dd#N8eB*MR16Bvsi3^SQ z35;%;KyK^IubB5v;&(%|Q+Q|Ww6)Ck&yFo=T<7!kW6j1aVh%wfn4&5QJjuYQ-q?7u z9u%MVg3-^CZ^jy(mb)fXo)ZCshar(?&wI;#oeIhypqVFVtj(B-uLSlzJyYlQbI_Ws z<|tQMoOoFN)&jG*Oq$Y=e4U(&2CYMXcj^4TXnD-z2lNOw;e59UWlU57kY^eqmAj?0 z83uBB+K=kwzK`~_@<}XTI0e$Cn*;`bkF za}D@qR=2qd$j<`FCl0?b3LR zxPF^K0G38Mvy*pt1y%m+V=0HKN(Un00KUNA6T9NvJEr}K7Q1hPwVJn$Rpz1cZ(9fq zPo1d{K+Y;~gOu@6Agfr^5alS2%7}Q{GM$S7F2{a=>bn@_2 zX?7IWhpO@Tq;tM}gb07v?-yi&<82|QAa7utQ##s(PK<(;E-kOZNAT0PoAhn1tq zXxdCyJb;$#eU-&0hd(PoTClfVUc2Gh?)9MbvJ`Ft8Lbtd+qD;t(}4N%p5+)h?tuM8 z_16g{CkGE4w2LY3$n69p6fVynwOMi+@=N}QKt@g|0sS6Y>xux+-;-+iv3Tf9sYh5C(&|sTOdo@OIH8o$0bLgJs(WB1hN^) zfe3J@erv9-**C-wIHD0(=t-qO054yLr6=56 z{fqn)VpCRDfSngTGQB0LFgdpwSeg8F`K3P6C|kxcQu%9(B6wbc6dIF10Fi{?@7lSF z)_h@z6RwvnushXZ-NORT!;U)FU+D-4?5y1DYR zmeWB5f{1R`h}QdxjZ_ZuS~kcT>)!i`Z}R{lj(_-qAJ@PZ&}DCCFJeb7=xktzPRVOW zKjDZWckb-X#eWUmBK4V7QWBR7_9t2-eIyx0S#l7rLb$lIlg}r)DJ$}Uu`u-vy!nNu zjZ8$HxEw@VlCYF|bna;RtU_ z`>_O5v?`v5g({?x6i3k=o%6x=@#kw!9FxvXB$qE|dptC4km*`iY+V@TO#|-)-k>=> z`K8EpT^YS4kEYL6|8k8_6FQjw`%xOi+U&{%#06_P{oV|dqi&N(S(WL;tqVmjzS?@v zQH30cicGJ_~sbdiL())>A4RNVs74#BSW9>>#bnrYFGk6|k1)kST zZ#|EY2?>*-vMGQ0|F`!)L3SL6oi6I7m$T#&OD?fwaD|;2F|)u@@f`BS*kOo#(irpf+kIZ9)W^dqS+L|79@f~18krVKvHN@Ex9Qlv|2vH zi&hIF(2qf&UuITTR%TXJ_NjB~{K>5Ei(iPRvhrW$=@SL@DeE*ElO@ePvn9QwLJXz{ zCWQb1eSb+rK~$5-|2VY_0l-jyGt?iPDF0=NQBi+)!t2idD;4&s>~CFUSmkzcqkrIT z!r*z36nI`3Jdcpkg6GW{Eqb2uxsuG~1@_+=t9dQz8@aQq%pN=sk^;{QgXa-4TJXG7 z(NZS=V|$)^Y>uS6g&@-0?!MB=c%kOZ11fsd4+_8g6EA2gLWx>WP6a> zHq(t9oW^Y}+7G9M( z+1Q?E)lv2{n)Hn3d6ie>&#Ep%R;!HN_IPi%YpRFmjfdw$>ZMht5UQ0OmYu6Y(uzuc zb#p8SC{C1nwJD#?yzS_->OcCNDzmHk*PxJn1%{e3cpfALo)@Nbo+r1y$~sc#c|)bF zO0s`sdvM$;nP94~Xxg5a>E<+d6K5VgZ%m936=sx)l#8;XN+VP9B+*(`RPw8vV>v)^ zqOw?flE8)QLojN)vD;+?@E6amaoXJ7HD2sO%@iqX3b5#&MT|=2R*N9 zs@C&mmD(lBJDKa?dE=t}&T=nZqFy@$Eh$&7qLN?T9FO67b$xnsuDgWrSknd1gQURo z!hGZ9PsIA1SlD>-&CkZkiL>kf>py;IZh>>1+*gdu6>{TBo`~gng_o#jl!cB|cwT=Y zJ*r`TRyGudBq!h~PL);`twdpMSL$`u6_sZtn;Q=^XT#MB&#T%swA;$p#hO%(CD%mH zuTXeJV&{jQ4{4QJt=vG;;7_~;@Xe9cU4j) zk-UPhN1|LD%HFDsC-16Cs%pA2hu#%c&Z>yfsZurfN{#2)mX=4hReouYTaF&9$lE(7icV|Ba;pSaj59O0 dD^vm8C=@pI6edywKLY>&002ovPDHLkV1kSKXAA%U delta 41703 zcmb5W1yqz>)HaNPg@Qqd2q=g&s7Mc>(%lUM(vs2)bz6v(#1JAdDBUQH455UQBi%y? z3|&L#cgA>pp8x;X`@f%Su~>`y+~+>$?7gqO_qF#iZkIT2hd9g#8gZum>VqSjQ{IA4 z-HEAMGndmYM`oj`vYND*l*>!#9LgWW&Mh@~qjy<0c4Q;HlOqiJ=JgING}{`)Bsy&Z zKCTB*D(XF9)r~xLG)3lAlEk+p@^2?tJU+rZ-f>(pqHM&wY_6?&e@gdiyK4OSu@YuZ zbLozy=O?jY9)a|!Nr+knZAnDt!bH)v7N3;s(C!aR z7Rh=m)uF}WJP8R7mv2~Mk$)4sSR;DD6T6$O4MmRmENoF74ZXgA@5UXj)y2}YYFGK} zmQ?0|QADQct7u{OMf6IK-%|COjxnd1rD~q{#(Hl_Y3af`F&J@~I|^61z0m=Atz{!)l(dBHrXIyKPLe*x}b~?cSi~b71f-zM`Ms8c7r&?~`?Y zokO;mhnYUCbac7tCQ~whtKt%G>DkKLuQ(oAm@AexuVZM3RXA@p2bHvwy0^QMwqciP zg1WdQ!@0!{nJqC1<<2-I$g!Sqjt#XUr4A#a6$11bjUQS#$a*YrXDE1RunM?JUDkBwg#$;oY%HbjZ|csM(E!kq}4{rEU^mCXG5)0n%` zVy6o|Zw!A+sVz;dU}4hI$>?kErzv*D3V2Gm@Q~q;T6WLW;h}?ry7&Ae@Pe4D;B{k; zA?Ix>2cI7kMknAMm-l-*1d)`qD^(qvblbk2)N%F(@UCZ813txB*!aBGJQ++-^c}JV z%Ao57N_Kv8JRN(1Qr({&?#gG$>K8Wh(z|Z2;-P}a_Sipb!*ryQB=2j77Y7D>wZ)p= z%9VpA<@HT1QjeWZW(!tCYvd}(ld?*Dc=L@t)xXcJU%Jldz2@!mHYedQG5m2=iZ#@p z>o|gqgoI=xf*`$MKQAthM6ZdhV^1URrdaTekHva-&Tc0LA~w?8T@PoewywM^6E6sT zT_~FwrTL5^x}saC7#mCa9v3?;^*+?IEF7w4`0TPEvQ%8Jz2$Hd%vmEqy^erONd z&SauqJbHvbn;Dr>gd-L$6~~a!uu~MeW)Vw>D1YUs5{R)t+AJY}ZEUlbg4NtolG@ux ztCTCuI}0%Bj6X8if?>=<6LH;IEE+9qM)^WFM3iBBb9Hz+@5KW@XUheqlSB~EV3N(f zo!;t$G4_!&XbB0LP~`Pg-tJ2kYz=|vL#Y6}U_q4ue6WB2&W5A0qfBXqnqKa_#05-t zzDm{`EM;m6ZpN-uuaeCs-pNA*s6&<89*KMmSD!p7VM&yWw+}Bjus@A?bqXUdn#2=9 zzIRf~rKN8*)sEHf90~`mwYl^RqK*y-MJe{cxJw==*T1OAJdVNV5YKA(2(7@(JDSo7 z3ni?RanI}WOldqaqS0V12DQHyTi;n~Kg^aV0G`%(d`E4re5J20xJA_`%X#2jCfo8N zZ}}wmVeQFkJx(ru!kE7AsPwJ+UG|ZK{^Y0c!iI7A&}$!yl`k-;lM*~{2wjKO1Gq`v zKZ$Jo0NWbc&rjGDJnV;oXMI#`mn z0$x6dD>qV7<4ba&Y_kBetk`=;n9wg5AARs_LB$VFyYoYVZ^?j<>>8xX$&& z;?vVtTo=OEKM$|RzH{tw8gB{BGpx`uum_`_e0(pm)U>;F&^a_h?A9S$rCoLTmGVuG|A2A&8H@F2(@N#ghS0of~7=H*{73q8m@;GKN zI3u^UtSK;_&#?7i4ZLF_qAlvO)oQ-uU4m=M)hvu#@YW)^7+wT?y@a3P z6|F>U(dwh$hw|)T^H!UY0kkzp5Ams7>UbC_%bv*f54@G8A7+}ZDmz2&ll$&}BLY@} z1P%{o;QMyLqPS+vVI$DnZSE|>cD6pE+;=w?3aQ|`*`|r7LHKdg$aAC9+0v+QV1SM5 z4q=SIM^t(lSoGdp{=qOwB8eFUpp8t_y*dKD9>VM8^HX!=ClP`ArS=I%Lc7mn4(|)f zflw%AulLg7SW9^)>?a`k)ZtICYFaVqWIj>>W#hFcRmol zqaQh|#~Ggpf#5Gx?4S=W4PFO;wup#WSXjuF9Zz@g&H$*kKYy%3jM{sxU3$Zlux^DD zwIU839+OnPQMmn0?YsdW@JFIoPmv=hD3DK1xPYINP>0P=Yp03fg6oJ%%RsAQ{E%HW z7#Aj7xq;5j&5fagdjlW;V(o@<%Ra8T+N0SQOn%LMXAuETQUHXS;L(V{c8mud(LJaJ zzYOb09z_rlRUXCE;$=b!f$iEE7#W69u>g+ZE5Z8SgXBh-+REJ@#YY z);!yyJ3(N`SC{~!u3wmg|;)=V*)%0}8f;&~yz)ZxdbX?i66 zIVPxNwNUBoqf%75Rv8+*rQU!CCoEQjPiw{ZgtD=+N`95-u6A7eCMO0{7HiRuOTY`w zJFi7_VYHh~R<{`lVfXG4RH-ROebbfc>ds08qG768dfnd9&P@{gtu>j^E5j<1v!Ki- z=f=A?hSjMQa_Lv1Hi$zq1EQ%ek-Tn$Sg>I`;z`Y&QIbC0i=T?$uvfwQ3(Ex3o*#;{ zBK5il=1m+KY-qBcqvcXfx5cbfnFn+zdfTzO?xEghE3YggE7V49`Rz`po{St+tink$uTtjF z_^v9BZ76nrj~vO8xFZ#;c#3b$Kp9MpZ&#tXp+qid?OJ z;kwsMgm$Bm_^Qfx&S~AYxmIK-DLdpfAY-_E^UP9zR>3f5#Y`s2{dUQgdq$$@NdG-z zX06nV_|v!f%3+Sg&v+u7nf#e!v=3P`rX}UrtxMSuGZSIffgfJW7I-**Gi>m1OnAwz zLVG6q?OSbkJZ-6fhC}di%rT;Aiq2U?!o+9h5!eRa^mB+xn*HUZ`pt_7Bq=$>hW^Sf z%!*utwSP^?FmNs8&E|c9qKaiR=WWu^2CZ;RG`D>L{T_F zd3Lt1EmBuPv04;O!$r9AfCvVPrF53nnk6D^B_P=5#^3Q{ykO)S0M>0+^d2qfQXNZ``UTEs_n#LK<+LKlE>i% zI|cU`JxlM*9+O!`C~++Mzu zl*xR#f#C)iptc_Z{k5URhTw5LE^a@N96`~xXf3k8Q4za@Zn#twIk@b;{vW{83$ zo$pRaG%DTj%bS;jAEx)8dC`02cSP(-MVrD(f<9 zV2%I=&MT_dR0WG4-0rxxnSI;38OF%*x{TGuQuXdrF+aNb*2_5{O5QjRTvpuMqBR&J zrKq3Q@jym*b$^E9mZvY(j<(NhG=@#*e~|8?hf>e%RNICNTVBsp>W1G*aS)*M!+}PHKo;+^3Kn zyOiW!DR~?1WbHTBbx_6WHh%B62JIRo{oz4qkRi3?Ey)iN##CTw7k@2n75&{5B5&h( z5jV}}Hy0~p<~AGMsgd;{N76mZQ-V_0Bs-vXJz6VDoxN+p{>ik4aTe`)Zrky(zaI-9AHg&+<3I*QnxL4@X$F6QM)>Q@yM`M7^r_jo+LGo}5EvQyXLtQq<# zqa;^mZ9zgx2+r^I!wiX9TWV{JL1u)1*0GlbmG3nIbb?11Kgr3fYR@XSkFPsumS0Xk zt(76HYyEaod1@)ZG0?i>;$hhr%}`8+{tB?x%HxE)k;IU+};)Xlh)>Ev6U|y+^n+&$hqES&X*A|gDAMJ$P){BZtPof*)HBu zZp-)i@wK_*M#EK3HLYric)h4aO_9NDy)~UpTW$ukZhgp*5i!}`MC!__d_2fn9Hxxs zpo0L`5IqThqlT%tdbuVtjZ4ip2+3BgDxg~_nJ)W{p&F+>AGrA?K)VK@3{j0nEgrq^ zi|U;~OfF_}ZU^#te9(4fcXy5dG!wEM{_wi>Vn2MA;<37Jzd#-VxQG}(FX0pymvEWn zCpMt6osoi%*rbd3>KXdaWBbK-KBK%OnB{q+hC_c1eu`5B{vh44JG;YE-YycGJJhzj zkG__L>+a6Y4v>BxV!nC(=Q?CY5y%CEUn;^)vq-}t&E%}Y4etr9vyK-`*LO$Ww#Z_# zr512VG{c|4Kq1UhpowY36n%WgVe>`d`n`%vNd_xRx?7Ql-9iYC+b<4lXo+efpX0_5 z>X%^o7d9P&Qk!S`b1E7kX9e4AI;BN3ps#P_mSHdl>n~n|CvqZZ#3E4IwB%pXPrJ!q z2|7YlL;i&DHqvJky?i8QNs*~7xNFRdURd=itN+Y(rZlM4J=2PI*kkks4fTbBGu83_ znRcOm!zQ(6fV_F5^mFEdLkzx%RIs&!&dd#V-6>bn0TWqw+y53v{%dN3`8RI5cXO_v zpFBD-fmOKT_~A|KdG6yxM4iWe0>;hJO1n{U3-u!ENNb7;S6rZsUN`If;>P;%?x&ub zva3*rdrevVJSFP+eX>Vy0MOh_tn$L{eL;_x~ybV z^#YVUJI{R=)~a+{KqP4elulWPS?39*wSiaCPQb{FC5kACkD5hhBnfCa=b0GG<{+oX zcB4n?v-L)MwaQjl4TIVydjo>Ox*i=xUbyHA$rqUGJb!3V?Q3Y5F<9y_NJ7Xskw;Ke zNs*HsO{-tV`^yWtGrYYvR6F9SaEa)-nzlz0Ap!C-5^7#TR;k1p zuT!xj?_~~*);O^SfA?^XKTb?|7YSGqF%`;!LhqS=WwFEA&BMuebO13ovF}qUuq*d_tNRoB)IdvNKA!7=h@%`xww31cuA9EuqSFF1oS@jJXBhS%eVU z`FZsF+hQl4-5J)6uNHnIcJc0_`oUn3k#yhW+P6VS_ndS; z$z@aM{Lr6va&$g~K$qz4njuh4AQApa?hqKd;BdGX7LZ;>@etQ?L|d{*K6ycGRPk#K z2W!~UF1L@V-GcT;AVlCmFV7U?Dyw&}{6>3mHS$8CYiMx{V5Ltq2X(hE@;pRsep@*S zh}S}G0%_bJlP}^h)8PkLr3a%-3Cv>%Yg0S7mFbt8cY0x|fWyemo*CnR-PSi2)qpU^ z1q!8g$&Dhy-v;z=-Z1h#P^N5a9b_kvm8NDpuq9|~)gcn+8i7nV+9#ypV5N+H3J&`H z9bc#}6nH9gx}i?l=UgqKwY3zy#WL63*yju$UAW}nGo>GM z%ydu}4%?qKqTN-v#+2~&a$Jx)yPY1EWN6tZdrqZ10by^MkiQCR&tRN8?(foSQVQ|y z!U>TmARN;$c%cbUDUg0Gc3wsncYzFRHsA$czp4ZayJY_S>3f`PbJuO&uQ&v{6mVXB z+@1@Fzw}Om)VtjriAg*}-c$Luh)=Z?+sFIq z(oF$tn5XjDgw^--^bGY=ZR{-Ak>TgF{d@BcI^ZCRB)Tl@ftmsp7xeOgsz!e8-smJ$ zwztUilgS_?#2kmt_+BxiH?*~4q2WGNdwYp!fx{tC44RK3288$%pQD)UEkNpGj0`+> z*4#f-CQRnP_L*AFJapO^iUrK*pbbDlqTQ1ys?{<7xu%Ua4zwqr1_9~G@(4*^y)yyS zp3+FHVyAg?X{g+kn+c4bXZL`|0|v#g!p+X^i^oC;`-p(s%62c;;C{duKLC%`IAC1I z2;Xlc!o=N#Z`ZG5yyq4U51KS9$iM_)C%|9Z^06wY&GmAlegcv4Am#Z*}icVfo?TUd`dH|4Kvh-bB=$Fn(MBMBR|m#1)qvQnUYk!R6LF^R&));Qm6zi|IY~3lqXcZJ z0>o8!HooBPN2>N4^r@;2J4`QQCnmywki`o^JISG<1!7>%C+(l{X~AtGOKl0lK~%Wv zgU-Xt9?*&YP4De(F~p;>bO6d5(!jKCF?e7jS8yX<(g^I=LyTQTwastN&FI9-`!{dM zt;2;6S2s3F_8$@AtD`7>^Q%HTd8_DFn&G{vp2MNNb&`DAb3@M*H2zda=r049V*!UE z<&Sd5wIvkd+6Z4gT?a8#{6f0>KkiO~Y9!E?)`LE90D3@5)U=-1d}x1;zG^l19&1Aw zfX|BO_hXCu%RkhT77Ebk^SQg2*6FUDak!e`IM{8iITgB<@HMR3Ys?v(DVkry@s1GgxIx5&d6nY0+nn)cnI9PVCXk6vauf7Wjg#~=9+qEl)F3o6j+s&gq&5`bLGzKl91(+T)ucKwk?KAV*yhwdRqh_3N0qgj6>!pnEI zmk!54wPtkeM@7>Jo!8;vW-W=4_mmN_=*QlVYMKoqY@H2LbRTAplXb9hUJC8Z68)58 zwMIWm(J@v1l%kDFAy;13d<~FCh%fvvz47(c2xwho_c~a%)k#z@Qi6dIdY5fl$CdVG ztjozSy!#~yje3>)Y&E>nv-@Bf3>$cgTaN+tJ9<#Yt6|;{I1n#pTg=pty_cR+nQ52m zzPga*-7rO#gX(75=Xj%+_n}HpMAdfRi|*i(C&acrPPRZ1BEXZvzm~@F}*K&P7qAx*t!$8f&=ve zPY@mLngTy(bq>{Q16c2$r1yt2cOD_kp@)kJ1MQtCeMhc7ybmM7RY@W_KgI&@|FvE3&tJce}>Nxfdx*3o2%OQ;r7+*W+sKe z-z@M`5?vfcgi(Np0DqO?yX~L`ckP9OMb-BB2upY22+~kN3Q5m;4!U`rhuy~g2tr8nCrxG$bqY1;3VDJXs%WzROnPA!>;#?T?mAVNm0BcVWC!C+a}L`PdOFY$hM@ zRC7h9*jfXvWF0BW>-a2d*p-A%s)3n_@!wy2HiFTIa}1D_e{5iEZPCu~kbk6_CWFYh zD935mmgp}n@qcIU^`J*l`4?V6WJSkB!kxk2k#VBvS+ z5U*77Q0!}u8)nL|{O`$<>(v{#-^;6ZDqd-^mzV8yYUlmYU3V0k|H1Dd z`?)4uL^+r@lZ)gLEsX5lIS)EBVif=BeiBS4XO_j*ErmL|RZGXzq+^}k*3l&;WAKtI zs?O^3I|#b|hyVT(GYYr4c_Xv0*xoELuU!02)?mZV-pj+GJdVk88X*=;jn)T86-w{- zk0VfS745M66>@o*-M_++eYF8wQ7h26y1=iBVQj#BSg3c0Ol z#{ve;L=WB(d=o`9=lJnn3+*ZCHCWUdYgiBRmH;Digqxb6SIDI>l8F1~sM#?97zS)e z(s6B7_fEyOpwY|Ypu{rZfaGGKJn!9kWc38*dCv5ALRgYUi@X3+;{l0F{bVmU2q9i5 z*lI!Bz7XY?_#)&1r;F9qtq{Ka zs)ast{ZU)EtKd+!FA=Us5Z6lK-PDbEgZuq54U~Trq&hK1+HD-+ zdw8#TEpM-0^pV53gG13KOgC&^{vV}))3sMI9neY5ILl&q@>LWu_eKpaZde3reB!Ia zUj$o2K2c!&BQWGW4pQVYGu4Ga&>JvNY(qkHs~=tL)aYx9bZ7Uv@gFgGZ>)`tjwmv} zP*9>1Jg5OR_YE2nqSMIlDgw|>BmqB~gFsp9?@F*P<`(7)i^kXPKq)=U2|oDW1+MOm zHsz=DFb}$WGyvMpz#Kj$i7Yj=$Le`iC5y} zF01GW&>#>|usdS(fFB{k_S0xo0q)vJHwxPfKTO&`;7v6a3QQs^& z7Hlp1;QR`DpA>nS?K+f#PZ7b0&K6?&G#IY*P9p|7vY7qEVca_~?hIqKVA^rS`)d&* zpb_pT7LAXHI_e_e+S@_thpvxpt`FawK{R}f?v3(~`a&L_UWB8lZ5FRh#8G2N%<}H{ zz7UcBLgRy4-o~Ss+C#8Zloglvo%Qc%3ryK)7J4ft57$Zfz;OO#xDmEPAlPs@*t(M zrjPyhk4eG`lIun=5wfJnYwSXFpH|T}y?LBOHD>spCZ^pG;wQ%eKuT&8YL#I}knL}k zkTvYrIePwSM#i@kx1LTWA>u^|Rrnt$hYk5t)rLnG5!}_y4*S8t0V!mYkeo zmCAq>nCi$IEgIR}bVkga#eWBROULR$bZ2=#@S%F+7XjuB2?#OjZQOM_vRn0r_1r%m zipJSn+7X4z?i)vYQ0ZRn5NQ=|n*FS4;Ir13l&+p=<~Od=Khm1vnb*oiH+()}&f3*V z$(7}`RN#worZ$<#i^sCZ+nJb@dQ$by$`Zsvkjl!^!B^oX`~lKH@FEoE`M~HSn|g*$ zf9@2bt+XW@`{`EHpyTig+cfISp#iaBe+iY8j$kw`MMhLqm&661GxkiMFbz$glazHq z=yfGwsUdoT^IGNQ{s&+F2w2qJLlS{q#4mR`zz}CJG;|9r8xNygSQq$1F!(0%2UaGt z$)Q5YY)BS52D$fF^yj7GSu?fRGZ{S9DlS3{`fOP#jZBitJ+A5jIkCr)eZ2ILKl2m| zn;`TE>8=d|J z*Dr1&(~eq3XX!65bLiEj=!8O5CjE<%XU!8mikHo@NnwpPG|11)8XWI&t^d{g71)#a zzhgqc0Or9fKb;`D)Y8)vz2AUr)OETbx-*^ZS6>J~|MTAXKE-Yb@|_C(aR&~f8_4fr zY``~=L9UdzCDN(T;~_UX|A=xKE!#NM9`boKuW{9+-2<4*=;BUrZ|>kJOq{MRy9GB- z!6B_~Ol|F%4XXv0c{K3BW%lNYQ_sx0{!Y>Ot!35t!$+s@w(OPcFD&L!+D%%`GR#3s zq@V?L!hX2BC14~YEgF)1OA?{_7xHg1>^#K!UT%SVqU=_VFJ|27RkKv=I%T{hJ8E2@f{epIuTzRf`v9^E>1Fw&xhaaKJ|OFK973|#7L^SE2MD<|?m z@9H@V)eyN|vt*7AgRtN$Ff!<8WL96jOTWZ|*`32_(~BN_wqH#skAi%+14gSJNWJnc zN=uLxUA&mY2%q=NQ{Rey%*w8iRvCHYx>`Zy2mUcc+u*a23&CC7?tcD~MJ)=dkp=#Lyj!AwqVJDJbq}n)dQ-G(z8vIYZO<%{vr4x~$LGD6y7q1U z#6s=J;LX{%<8(ba=98+1AI@uuB+rE6LYRLmb|ANC>d0W*AKXX$7%sMik5$@HwX<0$ z%Dj5L5eKT*FL0VM0bJ2OBlhzYJs*QWIIZn3ODn;o)l+ z97EiuKQpk|hj)>e7;WJxU*GB~ka50$$NH~Fyde?v`qGsJwU3s@j@7b=H}+&V8gF=T zW#l-zqnKYF*GqHvQ*TP1QYjwnz(4zsLYxlJq)#ZLc|=`6>ms*ly?iU#vpcMSe0VnD zQTyN*d{*0(mF|s6geGgD46>S!?}#CCgAY#j|Lqyhs0*#3Lq&J2NQiE}(J$SCT!_R8 z$;U6ZQd#oY6Xbw|XtJ4vyUKAU>A&G7AP48qzjA3?EtG085INC zc4X84T0O0~g>GY@3jL%vV`HqF#BBpF6dzlmjhU602Ii(toMsIvOxdVt6|K>_&6rln zM>})#k5pj!NGsm6j(R1@cM(|MYz({=IV`|%WIaOgD)-vvTriMtq?XKPR~6Q~kZ3_#SvobTB)8(2cD$#({(N88bOW zTYgs$A#4VcL5L0dE*2KoVbN8BV3?#+sV5n**HpydllEK5J*9Y6HZ@4TFMO&--iZ6; z5yiP+#$Nf7ElqhWVSVPy84v7h&@l8fAOyjjkgSAapw;~qlwoY}1fs{u_R!;g)Co+` z1~+M@C{J^}g!Q)_1y%@-+35!piEw{>$>zE5h(VrAuWrU6alyy3n96h`zV{xQoQ&VJe9ocNXAgR6p2?4Sp-_$*m>-+?z`u~TsKz20D`&Ikwm^LW zQ<$bhdKRW^t&;Q3F2`ERfO$IK6#X@X?UUqPD^LczX!M-UM8D3I?@%p+e6DC%Yf5?@ zU1ub|Xt<2@6!t&*GyXP^2hq%Mm5chX{pwjYkLH8-<5tL8l`8%ntH@632M`M}?1oau^HpGZ$-w5t)$LY~k;_1{@uaGoZgJ$@R0ELuf#|zuVIE z*1p=&rNIHi16oD98sBno_q;}472)}BuUUqT2fX5+1AtMP!la`jBa=*%B*q%r8QJ%j zVf(in?A+SsK49AA)soW8Z*O~Fz}Qgz6HDRLE{FQcvqviNvMrEYS>R#Y^)3AV>Vd=> z{#NJZKDEl~&6i#D7w2qIMFBe?`?t9bX?r6IEFXHMiSPC6TWi`B2Gs}T*kzEevPHd~ z%uLC-WS0{-H_h(wsr+2r>}+mp-qsx|u?fy%w;hu*xLg0C67zt7-Jd=0RnVi8VN35# zv&rZWjrq6RhML5x_aq)0#pdbIhGUAF>_+fK^ktUvsdeNX#wTYRuJ1#|s{JSZof?vq zSnrx(AGF68SdFn*_uvB0DRbo;gkpPG{TjS7`mHtVb(SOo8BEUPzqaO24`Z_@>z9u~ z%N<;a@W1jYK($^866xyP$f(Ec@#7)oej=+IjIk=Eu%3FpU(+Cdu z)zuabi-r*GcR~}~yn>mFQ^NLHjyr#hWoul$S|ytA5bMAVZB-0Ugt+&j5KR7?C7y## z_a~*^;~vSYT+y(|z)9|qxQ4Y|Si5`MTtx8^w1%EuZigv4kGCDuh@U-V)E6ONt@{608`<{>2+=Mp3EIdKt$sxQP0`C`ezXrZ z)eySFs10d8*hPMU;nEq(XD1wU@0cF|aP&kSTy=xjR zBh$8o4!Hh|OKdW(EJ>`zsdDszq{`fwrZCP7_Q9u5ThAIrg>WshMwaUF)KO+$VXWU* z<(o>1%^WW1&ckvkGb1vpy85Uog1Ak0rT?k}NQjNpw&lXVcb}RO{Rj3PjFLpSy{YcK z!i87<%>@S2C5)b5Eb#wH#3-|q2m{Ag&Lc+P#0maQoqL}Vb@CSZFDivlx$Op*iinJ# z^$!db{F4z)5;`xapCDE5D5H*0^H23oQ=h;)-g^p|h2CY9yFuLoNgaiomuK`N%fAs+F@YALG+=RN5N`F?B zeM>+8WFp677%tHO%m9spfS{YRd+7x)7bz^bshPiwCiK#Nd}{Uugot;a|0F6a6}>RR zYb}KE63tRUn^37L(gE78K-=3ro}VmR@8EnJ-hz~~twP$<14~ZOP68uUgZGTvK&6*5 zLJp6}+OQvdW>de_5yCUVLxHV*BNmL;bl>dHj>)Rs0e|pnDwid1sdMHH%v>7%%*@E( zzdlosBh6>Q%-u-bUo?j~1l}3KU!1*3+W(&~ZY3ccgnwJ0p#{Ey6AVn6oIeYwkSs|+ zOI7QQ(IQ#IMIbT?Nl=6!@B;rA=lOpvfniTh;#KQPV? zN`3^6h!=^y&ks3#`7K~8+nC>M(GM4<=jw0D{?Qt2pBjG&A8Bt1rp6rb%U1OMHz?E{ za;~oFxv`|Jk0ORo{v)i0=ubq&u4Sq_AhV9j;upnKfQ|(Q{blrN(tpk=gwyrNmF_XM zm0eI;Gd;t9B?gyEuX(9l+S875NXP@e32gfXS)7rIu_OCxPL#L}PMMTPg}OVYB4P8y!eA8da6*@g4vSwndDd)s#D zpp8h}_F##=SwgtFQm%9~)5@O%NfbsWfq>6@qatPn{c`K*L@A)NmQiA{I5nk`d6tpb z;7$#D4V`35LDsLUrLG2V{=a2^vs3Ewx z_mNfoqB0rnPF8QpVCywlb%AUts@ED}J!qt0eGV0d5FhY_yMTi6@}Fhw`2xX|e#~O> zzNg7_K2y%5F3i&$8ELxEf`7@CKV4mN9h>1ckC0kgvv>OUdmcYus~LNiEcpc_B`LmQ z%FvBT9kv1gq4OdJdvtJHnYhVJa`rXPKvIj2b`gi^C0xKLqV}&bo5~M2j7ON68cMIV z(@FBV^b7kc zi=Ae^tO^3PpX!*LB-|SlO2^Uw)BOwo_CXTL*{1KeGsJf_@i5;?ajL*&@Iv;k*A!`23H#o5zEz z1P~#VGwl@=@G|{?zI->Lk>ECdABN;?Lr=rl%Z;DZIj|eOwJ@Nl&!W>97!jyN^yaMW zTM#MyMpX51kyW%f2n0`nR-Zg`3&gE5eVa#JWwf5~xOHUZzm8CHqX{4EVF%h|Dx`KH zK5NbgyR(4B&H^o#1Okl!;7QBq{DeJFM5Ud`2kjZq!ScxQO^Sluvv?RjUO_BSJri3S zD4O-Wqj=mgVY5zYlhvqewzq7Kr~Z&qdfjdP3cry27$Uq$C4w?= z(HU}7??bw+&m$)`Auy|zh?B{LnxKKXd`F8nMqNDT1)@4ST{EYz$7c9$yBQ-(jXQtmSJn)38+B*WxBWkO&$ z&(gMTC6l1MsdrO;Gpg`{3r(y~OtrLTVp%)+AkaN4P$WnPf z*x&RVBrMy=Uf(s)z(wF)2{(e|)_>;J1fu}$4Tb4s^qy0q55Ad6WzrF17UTtEx(J?g zkfP+T`_9KhOxu)tKKxEzG-QjBl|Y$)SM6w=XG^*o5(n0P*MjEZDd5_3##Bho{W-lK zUjSwGZ#s6P2M^No%;F^m(A8SZkwKV22KAClO?{`aWA*Co3AoF^1c-WJaeK*;7ytQI>S?yWwb{!?gqRLoEdh$t8A) zFK{!c=AgW4-a_LXSu^YM65~lvp~5*n+oHp$b?q0J)PeOgz>5SW*GG&~eeQeM508IT z>6ZeO8v2>rZVio5OoHnoBi_3mREbq$WyN9F2BPENmT8b`mq)Jgjo`b^XIp(ze)Pbi zB1>1)l>Kb}w5eUbK#Gl)eMcI>`IVvvA2h0eU}qTKBqaecsxG@T}*7{9Zeg zne0rvUZ(46B0PgSf;uHZ>W|e^23*k;Y242iEi5xhi8)jL9NZZK>AGUeYSkW?oLJgO ze)NXaLM)EBklz!&JpX;2%;wXuM#byWFE4{s*6wmD9iQX80RhnXQy!i2NTVov5n7P- zO0^0Xa2?d1O||m|Kj08mv6*G&$J0mCWQymyM7Vt~WKECxCVG-&{z*Na;z9&bkNh~X z`Du+WeB{z^W4d#0x#AF0*L9!c5Ybw7m7lsz>xB)9yOJ!khUqT$yg{GRoaO3kAbsdX z|K9~XV!hi|-xM~TEc~ikOutca!O)sXr&a_*V}BrOJAmIKZXQc}+bvK?RB5ObZcQel z%;a`q%{p6ZxEiabc`Y2+?C(POBY5g?b3sr%-r1Q zt*JqIP(z*Lr#~`+tWnY6d{>)CsCxh+S0UF&=5Ah;-7a}mn;bk7S&_KN2{SR z-MD!RTjYJ!Yh=00FLm$-UpX4#cU=qWpCKQsa-WMxZt{RF8N_R6i;U+Zb5sQ&xAo)M z-Zqb3iza24Fh zGfOdcEN{^nyht0j7;Rv7@INT%@y)1Ub;yBc{~S-dVhPoO>Sg7JH$D|Ab>IySA%;xd zCRI<_)X$NF0rjuk1e=&TrgO^;(%~sSucpt*a&^xnd#_!Ncg=m5sYThFV94uWo273Z z{?n%s`T;<5!JuwYe&5LlY+q^~c&V5?bbG$hgo9aH142Gj&N|vUl1u+o2s|qjxgp4J zV5JgeWlEvnlg+BcR@ucc2}R{3xT1|$oidN3sAi(|%*6iW-!*u*=%(0UE)C_VB3XgM z!uC63G_q7EsyNBl1*us(Rk(V8D(Befdu@9S@1Ak7yQs`+bQ+i|B%0Vh?kRrO*qjP7 z3bmkl>A%!#8v_hu9atO~DRO*))&oAI`bBjP(!4){f64k9E}N^|Zsn`~JvW^rJ3Z)) zL0ox@+VtOnzK6Gg~B4}QcurlapE{JWr=z+RR zVZ%2S5H8EgptYnB#LTjI9l7UK)(WVwL`hFnb(V4K$FWaPx0Piu@2px0i2m!FkXAXK zH*ro^veY@%^2D@mU4J~*XI8q#fd5;F8BE-I7I8mVEP!WV{j?ig#hlw(N%ilUa2?!` z$6O*45Kq1$l0c==AM{oos*9`OHc%ywsk3gu^8JG*{D zS>-ng4Z_0zCh0%^DW-?RR3Y=kUl&0^G5ue?9&J3J$M05|O#xa*_|q;&+uV4CR#68Y zxVdSGEjPGy{shPyJ%8A1cXwx+)BWCMJ+Auj^(xx`b*`xQ-t*y!_qaUob^m-|GdVx6 zn&(`-JJ`fC73v`^{OaPnN!L`*id+cog~4muQmLi3y4txZ@y#}u*~mBG_5NV#%Fj}T zP-FG>Mk=?c5A@ikk#FZA{2fPvRIm2S^m7(5SBiE|S{TBd*cm4KB;t%V0~M0~X9Lbj zj$-;izaTzdInmMt>6PnGzokxMByNWVu?)ROp(3Q=!Go&4Vj!QL2E$bV&YPu4L&QV9VbD3lt zZ2{fc-ovEaA9XR%;Ek@UP&;#Gg`S$jzbu-XQ4^)0Q<}XUtDZ4yZmyu~;!?pwqso(^ zj!?@2ld3R@XCfqDJdzDsb+0YW3t0CUuABL`@mMxX+BqYiA#rpadT+JIqN^MrzU zC1O(4E3Vx6R6ys4EB>?lqXZB;A-K+Jm)zIg_MV zxihK$ zh;|eq{Mzl*f^(E{zm@-~$kh9Hf@8>Ui@zw)VC~M$`0=s~p}ruL_s&Q#Uc0_UO-m;> zAJ)S1ZZ0-Q9Wi)5lkMgi->+?1sB8=W=^a3^#gr;IT5ZZBIdtQGvEk+*uR25NGKt`K zz@p3cc7Vye2n%Sc8p-V$o4Q+$b-)DPfl8*9q*0s1?wS(ZX>P?8x7wAI z?ASnf_A@&382uKwidI@pWyV!+wN#(6=TxVfLjYz9zDuB?98K+{QI-vP5HL2mJI|VE zC2|o6!%VC_JGkxQO*WXI`Uqhdmw*h}kz3S@1oy+Njsh+PgnVtVrNR*eK1g|len>Bk zt3l&68wE>ii-h3UkYs5sw+RF=yHWOEX18u0Lpq^9pj5DXhM^-=v1r@Xq4BT!Z6iw;bDYZ<1P z{TBN-%(bz_Js{pweV_p z@%-2D@_em!ai`WvHy8NrN8TFyDmv-$UHZZHR3^B@@DeUWPu|xD z$du{#t3&l}*6<4mT{B{b-h@{nad#c7_{M`L-appN()-A++_@M{l@e&E=_Je6n*A1Z zrv3@xuJQ6_+HV80d{70el?Kz;GBD(JX*uuyjen=i96}qpvh5*bUBBdud#Eh$ivR^}45{w7KrBQ#HTJlS_BIZ{T8nco!+J zMqQFM^EW*rx%jE=-GHJOO6$0@%;pem2Fl*Me))l|_#t0N78GA6L>vr*gyibb21VD zy#>@1P&U77o2OeehG;VQ{WKmycbv(xLIB{Yg=bb#59=kKA5tgv1&OVrd&D-&R8mX? zAKVOp&93kjc4nv|jXr0E(f{4wkXH*IxKY5F7gFzt;d6d7h!ncMu&=-{2_|A#V<~hHklG;rhAQ(~r4}#(Rue%>RB}{P#Mw zpOrLPm)s*Sr*xynT_9T;7pq(&@ z6G11$_DK!?6&ZXCJIYdJ6+57n7>Ht6TWbECHKBF-xRRVt31mKdfW*$eRA>t_ib%<} zxg5CaHdn#HMwX+pB8*locMF?psQ=B!O&@OI$zuK!a0LqKF4OSD{f;<;7dr>vdLIrx z7K+SJ!Yp_3(b3MqH(ti@=qI6L*q*z=NY*@k3yR8_Rf=Q5^$IIRuTlMhUHt34LsjJo zp<4>iR758%1X4-ElDd-X9d6_Hz65vC?|DTCn}^-zdR!&AQuSV{`!^p~eLWiK`M;NX zi&T3sN0PZfs%jL|h+()w4GC9IYp=PHtaeB5Gg#%1svXDKGk4sPLVN>K+CNbp01f?U zPO)lucfd#d8N?sTRIS4i4qk#H&J_*Iys6PpQUaf#;4!OA6GkU01cUTg@o~>u*`m!S zV(GZQzgt@B_d60_<_EW@){-6`1nv8sBOww-izXK%jpcG^&9Y~S)s1E?yg$dhMt2P- zZL{@4F?z2r-7eJHpV|ef z;k^gX@Vy|!X=gI#e}R@8c|Y{lb(a`rmL`X zDaWXBppT;GhP)g1xO~6?jau!mW(m*Q>{Va(SO^&D4#x#)Xz|X`EdC~l-bAkL zQjli_ZC2tt^Q<3`Stn7lbZPl9*7Mw~wBVYs6Pd{K`y*1_o5~(>@^sb$MNM$Y|Hak4+a>e!R%oL?u$}Vw-2;8_?5E==+XMndrha zVPth&alh>ZTXapO{JzoRB0ejyU#}{-0a=gHUwBl;P_S+u2GARuxsin)3$yP(cT7a7 z544=$F)eh~#|#i{3YMn9W?+=6^MO^x@I{Ht;8L;u`8b1>A$MfHup;Vp#mmZzfulSh zHVd2fP*$r-PVe*%3GEnpD3h-&ghtQw57iEEpCv!Eq?MC}m#CX~q*__oJua%Lg(z<& z#z``zuU-o5K8-5fKjERNkzXkpl}9|b+wVUibx)3j{g(AXc&A{c-3&?dM3ia|?F$uO z-wT%bXrp-mC-|X#xeNEufn$$F`+3i4qMMDpMUQ-nO8E^_pWUm?Rzvf4KA#(>;w5$H zb!x&y?a!?%h@Q|&V?lE+4cK&#K*jABM;Wd!%`9=p39=5E6#A%8Oo-YXD;lu=cN7hP zpaE}gfB-?~04Iw~vnp?WYaj*O>B~36rjoYgrx#ydhbi6oq{65jrTufdi!c$MKi}`uVT_T)pxVFoVY_=a3`BN zMqH6KCa9r|4~qn6e_t-j5`Taa{jbFmhB^L4EFt&J%(uIrA6UFG>`Rn`$h3@q#>PcE8=bh;|~iGI<50IXN5YF4(-^@2AWuf3*KMEMaxTyp5RrCutK?uhA%8z$~fjS zP}n`%CsoC;zo~5PeeI6V9JK}e9^fWt<|8|AtP9e4wRN8xZ+Sqs=L-{)c&fnr)uiHR>g4S$Xkj% z=;~~b&Lq2QTQ60wsATTrt5JgIXFuUA_|blR)W%IcN$*BF@k3qzBU>`LHu-ukG?pu@ zZ>xNvAYS{aKxwUQV1j_s1$Bb`vCFw%zZ=3HUzWR^%i14oxa${#Ncn_YxlX0!M2JFp z+=@yroNJa;-H)5UgWpuv7OL}H(3DU}V3l8?=b=n${l4g(Q<$cOIp=$2L5l_vDq&p+ z?T7$jc3Z#ToPn|r_fp5)-O^$^uJ@} zO5>}nlPm|x87}?oBK`JN!c_c-KH``+6|m=aq9e|Xq(2u?_5GqSsXwfg{Sf*ei(kMp z#SgydUw$AEBMGL7v~45hJCueKZH|v5CSU9}U2Jx*uq?|_%iNUf(O6QTugIboo?hzEW;)i2zeh>FLkbS|eQPsmU4sA8zl)kGSiv^=jSo8o1qqRJ}@~ zPH@4*T|A4lkh)f~`(jNd=X!?O%1(KA;}ic~TaSHA{vntvnUD&sB)I`6yuzYn8nyMu z#Tc_gFYLPSkyywgAO#dLn}Q%~k|Ux{;N)9o<{eu`9sBa#iXuNFZgb`xC}{3 zv z0ml(~m|jK!k_}1aGsyo7F50+nHU%rcx;vnT=)BFv5kM@moKaA75Nt$s9`ujc6!ZbF z*$2P;K|h}pJh0#LCqH6;NgRr z!|jTzcxDlxwBXxW;QO)?xw2FMj3!7$KNJ0l;ZaPEKdWcLhi9lYvPD z{6eqRbHB~tV3kdD#b0divzV~s%-1%aS}T$hYj|89;Fi6KAFRZO|9V9D@SnkeerAJ1 zC!}29j$u9>3aN>CKf@P(3Z+A0F4MMImXniXaJbWVxD|4^MRM?sMD%bQ4e@Ys4V*f$ ze|-9-Gq=9(DBu8jffC3I*il0Lq8n?W;wLOA_Ka+D4?SK!{M*~DUCv1lY*N~jDurp-d(bVk#4&of@D9kEHXzDV zE0<(Dt^T7~itEgE0%9GK*=s@@!cAm~!YeJ{j=;b|wiiX3@v{>=oh?68r=! zB{!%g`Zb z{-?gi`~x5|6L8A7v|shv+nnGi_5vaK#vqQcW^al|Z0)PK zGr<$WBP@;ZL$|jpuE>XQhHQdvAZ&JoU_b=534wQu#L-!bRdfeUO7uD8%+jw z|6sHBaFR`|W$dH3IUYvz5eKf_I13M$u>Cej|HtfKDL^B%01t3q8h>-Xn;=meP{%?- zkwdGL;^1_0N6UZO*v-}W_e!SK5Py=LP?Rop!?j>U6P#GI44Y!ep$2>&_fwc zEL{GtziFlwho>OpOAe0P^t-|IL`R>2!0mw^1ZW^+c$THgTn76ViRkw9ye+6V{5{H} z2a7KSd;~-OZ~xFHbS#2}DVHX}S2kZB4TS$ZSm7HZb@z?uSF{tM1d~JI<<`Ra)u2}0 zu|1i7M9@)h_xMTSIl}HN_l-8HX2`#<%f3A-KphQwl=U>4#R!iSIs50&tmE(<40c=9 z61ymiUNlmqTFf@t?ayk@(NB4ys9n7w?~2T4=g2v*`M{Y;nir!Tv9RE;_YDHvns_Vt zlEnuOb)Fnjy|Xm;@I86_*V73Ukq%#Qj(;`g&S}QPMFv1i+o}@o-IH1736FHSBH>tMn+t7(Yx#>Na-dOjO6%IOMI zMY*n(z>aPn~y&F_a~|I3VE)2?*roKkeM%0_gnBphFp;{^M9>$)7bUb@C|7Cp9e;Ti&`WICzVz0^-ag5qqhiyaGi>+mV2*{bE&A_yBe}sc zIJW?4O91M(J7ChhyLh~`9=ZVyxBt-($2~W*r*?KHPe9kA%f~7VYYUCQo^Z6(j!1!* zey;ET(-B+aOFrl=f>ApR93|a+yOs4yXk=PUA)^q}2uk&A=6%6Voz z2X-$ydEGaAwVgAiMslB@>mB#1@G@DRzOjMtY5z&8p3NzMzV}N2z|FKjf=VCy{&v6d zjd#n6@FHpBonaq|Wvb!bej_J(e}-)0l6eEB*BP3AHt)p^lZ`}Ltf)=}9P(X+($jJMx)zPE~&!(8qB>$1`lfRV*`9k#eFO32xibpWq7gLUgM^pBx=*W z?YDBp{oN%>?3FC>B0WmW>*`EFjcYsv^BbA0>Ze+>9-S|pJzJU?ubpJYLmVzN6(0-4 zCPm&cS7uocB%Lf2@a9iUH-REnULI9-K$&TOU6_kh;l^wA(_TzYtWMV*Nu53}+zlu7 zdnWR3E^G!|giJ#FPV)U^pfPBe`d|rW)DsDRtVw65I@6JC_8UYf(jRwAbKv0keSiyA zum9im4}tt4^k3;8B7Oq+5NjBm1#J>vgOvZ!^-y|MUoU4#arT#Hy{EDn{0{<>f1K|` zjV4p;-z)v}+yWY-6ta6qolU$`%c7ao)Q}&<9L=mL{a)zgU%{rL2+ta|H^fUceyvh| z+%26rCZTfbPDJ)4%g%&shA@f9ev66c)oJQeJ%moEE58d;L|YKl6Y1<*x+T|$yR1Fd z@N1y?vS!~nxv+a2gaZxGwQk(QrkiTXPs=WpV%1v2F(<_bMwPN3-Dq6Cte2MdpX6WA zKN7H`{0r>H<=^1l$R-$p3#>1h%Rph{z&wUP50wMOnO9TKOx%Mzk^dGPA6c zX5_+ca2DQ%F`yt9=D$AoQfiwE_C}9USFh5Lgk}+?ZONX?sow-`_1!K~^EGMV{(EcU zU-S3<$f`Eu}8!1y6$~dt=o7x)uThe?pw1A zJ}@NqT+Vyv9mJ%an(OHg36ye-`a8#(S{Yld{?z8KtXzKq(MR9bJl?1J$r&o$Od9--F zHp{vJ#tgQE9DG{ZI%7|*n9Hoz8uA%BFTuf*w(izM>XrCaK(0zjEa3gMKm}^KcZL1 zB4y2H%6W7dd*&$C)RPycwYnkOh~Lsrfju1&>PCA}T(@3x|DgPuLl-Vv8By-W2^~dF zU=;z`sjo@c3P|S*PgL}SgE*rW2$BnF*9ThJ%|yrH+dM@tW{nZqgQ30f^5fMP+@g1d zj>8H3$MvzV(bXIzw@KP>{EIx|zo;YXdW?0Y$7#tLTRDSOf_Umq4keeH%1lIyQ%Ay@ zE^s@`p>ELjUh=c2<^BHhRD>|4cy-L3un39R+h=}8oIk2W?l*@FUGSF5(kQ$l5XH=F zuAcE8HPlC@Mlh#-wN6hd=_{0M+sA*umrj7+L-gQ41Ngq8FxpJ%iR$Ax zjsPQNY_^{hsR&1>#T4Ar+WQJm-!+2ASQS^oegg2OK(r1**sB+uiJrLOL!$pyn)FnHEPTbTB#_gl`g!Sy76AQN2I3RM{eF$c4)4F;z|}3rQHPnsb6EN0=)q_2$kYH)Ap| zj>28@fJAzH5ppE|Pu|J&Hf*J8sf(4rF+P=Aos`l_N43Wz8-Fc$@e334A-cClEF)^( z+2J-lk_mZ{!Pez%Gt%9yvX4P9f0G;^%p1IzqpC{){5c%kD4}*UF(8U(l)dP-hiE6a zL)qj;L!C!Hoyka%(};!dC@0FTl=bPTf1r-bwo)<$YFY29jO%|se!OI?6?3Di@e3rZJSP^* zCx+&Ii``jfSb!sKvPQ2V^gw@-n(%mQvsV>9Pu7(pBE5`w15rT(EN;lrsi*pQp(7uB zf(XhG3)F!eqpofprtw))>$y2PXw?_@xTAl_Ho1OK8wE$0x z|1YP_znfhkoc?#e`p0jMb=&qpKC4jU76urf+uM8FIWSPoS{QxxGqn{zax0YLKQMhseGl9sT|1GWm7wLSVfAt7+@MU%UVKA_-sQ=7tcA5(4?{!0>R%KW}yu z^b|p;D6bxjA8BJ@AYR_>3TpGOEF6>v6n{<~e62tc)C$-Xk$XKEq9&lWK=5a6L5wEu zs3u1S3SW(lJ|hIt3`cueNa%sF71HH!e-jeh9CiSOi|pf_{C35?QYXCn^Ho7QR+Sa39n7>;oq!*dCd@2kVe|6y4>}q5J5?1$Og2xZ zli}m}3}ks_*3xj=O!Rfz4>jAalMIQ{!c?6kID8D{MD4Oh8=h(IEhDNFPmaDqDy(R? zI*G5oA!KDCS!c#47Wk^o&K%sbZc!KTaC1h!x4)tTMBMiQpJe|n5%-vf%bG5(E3c9> zDC(Ro5Vn|uw|I!KzsNYR@W8;L_(b_rRlWR0BiWiS4I~otk}#DUrB*x&Nxh`&Rjres z4%RK_p^Nb)3*K03E30AXa6fUUCnF!|KE|C$2hfC~BN|MHjN2+V-?#K4gCg4zgqKfE^|yEW_B1?0}vpd6J&|s3VI(Z z;7>`AQW%}`o|@4?RVYd>uSfuy5+${gmD6X9jCT82uU+HkkkJUxv*zN{x`VRMpZqbo zn#`R{#eOwwBzrO~$ESqeGFb>UPnn}ZXCW{(rRuPoSJpJLQCxA%FDcZL3W% zl8Rom5*x#GnQVO`Po`;uyt|Y!E?0xI>v=2CFsdZIEHb=|SbEJVUv~SwJ^vzH``Y7` zs-oICCB#`WJ+^BE$Wqten6NUxl5vAFj>xz$Sh-hUL0+R9o64gQzWgkqT@oribWhUG zpb97AnKu_SiV;mRJn+g84JXff1Q@q0LG?3$b8E;2IJY84oZHHP8hl z%Of}nhjw9+Wlp>6?FCzl@M%y516DO1iP`icpLOp!k95qZtrX2O#vI}hzx&bMbhFi4 zA8pF-7m>e*HjCg(L3VO~RrPj=Iiu59a-nV}Dktp6>8X~8aIx}w|F&m`k_an5I;bq- z-2&Pudn5nuMI_9Gv9}Bb8b5Q-UVOWsGJGc!ovA^-ES9W4v$Tq|bxa2S5W$*Sw*a&x z)Uch86|%KUVomk_ISfmr3qRcOYi-+obZ)wEUcphWM{jRu`n&A0 zaKUbWx4!R6Ml}h>ed!eh$Qtc4?s=7DLt+y%LRJ$`J||rVUJ@*)lZJtp#O+E_>PoHg zOS#3T9nQ3kwref$gD=V=E)!a5G?WIXP5^`JXzbro2m4WW4I=vGAhS*MjcNQCIk#WU zpL!6gX^Kmg?}07m>jYLzv>`-@&fKD(;C`!(*?yR=#-z z`l^HL1((Wy7&2AX5&QeU5!Gd2|IYv=|G<+#{|!J1?q=y?;d>pc=mjxCaJWe@3ZvcA z)opf>8O!ZUE`6GPC0!KJs1>QcqM+%NI9eAM77^!uZMGuvd_bFDw3&cYZ&yBHeMAkPL>kiX1Sz9GOd!rRhdkA{!9r_9x-vZdpFFE?THt7 zzI>9RQ{K9b_@Z9}d)4-x&)I$smlCRPC%+cv6Q|9s(hU1Y9(mH<-u7CsfaVtjT_BCj zYAE*f#pP8X(J(YnsE-Qh@@su)*fEYi(r1ttbzEakTLZp0RgRd@GNYW=vV=U(_}94&?T#FHBZ?;KBLlXSDNjUf_~Gey7txjvi`>z?o3O-8(&mw#Bq=V3cS+&* z@04TCxj))hrhPfG=IdAe$fOo38X4oU%o1B?oQodGshm0Ri7gcHVyA^ngOb_qOpW*q z5Z;nV#(a{{NO&8#qHtRu6DDBMdwme$uzd#|fp3Ct;g+k(hR-|48}ZbNRv=-+cCZ{g zBW&7vX{l){sRY}wJI~I1_nnYC$;(z((r+~40x-v|8KkMtBe@<~d3h_vTY9^NCWE`7 zOS7Kbf`;vN?Cx!TkpA9Gg&J2)MF6jTn=CR*9>16t25}bU?f*Z3Nh~HZZPp{HbMHA3 zwmV$KZ>bf89A^BJnXGIF8fgD34%`S;Yg**#Y* z=lu`gEtVao7H7tTrE|H%@^+C9I&he8~A>~Nc++{6e z|GaC&eLC9ez?7yObuwA?WtQ{(s`r@MbhbGmM@d^_Z_W5RIUZBF4*ewJZC-bY)8obr zQ_K=<)igSPENNrRb7{pmEFxGHbopTPs#w0$_|SuA*;-w=ZAAnvBffH{dCy7K<2pM8 ze6EU=C8-}XUFVjdM?bWX&6}3F0Hify1CEaQx|FQ(oTAQ#Q%U9`y{XgU9FP42PT!vF zEg;kP?HT*yjox0fTe6sdM`oA z;7>#dd)q4}{1N1;59`ckLXN$jejq57f@QQ@(K(HtKM$K6lEv#5gD_#9Tb^f2ib~pz zfvVO75$(eSj_M2CfOWepCRU!R7J`=nnwUHTs&YrM^Kqp_W*r>z@p$7rJdpV;f>_Du zt@e3@V<_eC|CIJTmR+$hR()W!3CHI? z?}`Af@yAyIUZ%F+zxyB9735>ehm42+)3(S%OZ?flzgqQ4A)i}sMf-7ud0KZ2HiD3X zEDKb511M`VT6@3eo5Jpurg0KPH5)X(!9}DkqWbu2RV>F$s@l4sb`qDS&cpzVTin5> zdWUk(o9rV`Cx3gaC)b3`Xix97-WbN^3p+2LGnuP)!niY{3^(umCw-RF;Ou|=i7cEA zrgAW>!e(PZz9lws7ysyY=iyzxm8e%hSk)4XS*>>~Ie+nymbG3>LtOFv)=4NX8}5mT zQ_HZUSuB=C2ex0)zmEY*kGl(7scOkaLsYq&!|jHG{<Bv=gHkkDA4l?};P<>phD?PzB!{qtKpDe0fNb3qH4HhQi^SRew zMs`u)t^kG3?H1qi3T?y_f8zB9NzMh~or;9jiovXlI*;2Nm*DisgExvYR|U&F>bBsE zj<*sXaX;y4aGZtjEM?gsH$nt4{6$ttW`-xZRYrQUUsE?MeW*-lpGbJKsKt?D z-b26O(7v@i59T619?)R#s-v?~*wS~KQR5wQt%_@&C z7tRtd5&FI4xY+iiHJeqTmvsU@Y67!MVdlJ`C>CD{$rYu`tokyb%I;!{$ao(&`2^3Z zV|;hH{Q1}lUd+)=Ih`Y>@aJK7bH0ejaC`KO7&IintSlx+1f8y%^$~or`Mb|HasQrj zsssxmD@TUL^~bc6o_vq3V|;ZQF7taY-3Yk$Bjf9_8>C1<2ur`T>b&-)8K6R zhd%_1bii;aL-f9Ao5VGv(?+B9k6yN>!)j|rN1=1YAlK1gTLFX+!={sc+MeI(x=I_J z+4ZZJ+O7FMF(^af<({ZnlFRP?t)7R*s9J+w6=+VZ=N1a))VY7robP zwuvF^N_5RHb!V*aQ=1R>$Se4IZAu#1j1@(qpelIItcn+f<3>+? zyu!V&jtEn1##isOZ;=Jb=ud->J!mjC^N3(K{lXsm4+a%-?03RaN{KQvG)H9mdUEnK zu0Cp-kF1IwZOLYmNSrBhN^#NZGPOu|Ff{uiYAkyI7d zl~-~TPn>oJSz9cjDlt}XGDA?*8&u9I{>}Nv=3eG!)pBpI7_3AeEp2u=cphuO87j*Mv z&?*OC_a|Bc**Q@r^^}yT)GT#>LcyuGR$Z2F48S93R%9&&k6^|$g(<;Rf6YdF#I`*$ zX(JxufM*ImxjuA7Cc>{_OJrhm&nr2b-_@wr}QMTxhs8f}Wq^VeXY)%Y3%UtyFFC(m-dtF|L#^By;+$i3)ZM z0JXFV4Um$KCE}-PWt#QVifesOcE9XONYEs{aTJ}6iar*LB}6h@E;6mdxiv&IEj6q< z0$He8N^FDX27r^;sWaS`XcU2lQ~CVRp3bZ+;00<`9{3+3l}Kl zl$Dn+@*|XaZGoIMp%h@N0MlV07O6o9Ir6Pi7o&TxE zwFwZc+4z>$5m5CV4I;>wAF3Li>ggS+>;3-Vd(R{QY`wx|cs=gAyZapuc6$f(OETxC zjB%xK<=v3P76YaWr;eJSf^W()@uZmddROgcRxmGZ3Yb|JKsCq2-PE2%xWIg_GkKlU zvseCBO4XU@Bm7tQ8T63)Mm?@%;7(;b(tQ*>8u}!;>T)RGZP^I6fJ~1!EoqHaMw?O1 zWPPgm;>Bg8?ek=yaeUKmgF%Ag?^e-cE~&TL-1W+<^ag( zqM{g@h-4rdYq}wk;obog2&GA5p(}JdM0r?cwcuK_0!Nx}B%O=worxknl@g4JwKhcd zJ%96TC_dbEG-i$t^}B~W7VkegEHm;S(Kt&p4G$e((UX$V&r3f;Q7i2gnBU}@>ePr> z4=XBcplN}24z%lE*f4lUw~F6TAY16&IJNdvt748puT1d8vJqPV%hXMg)cTTb)yMNQ zjZeki`G^+AR;J9W-gw}QkhK5+MliRXqV7LPRR?uHjyD=)Beh!*HLcGAs597o&Fo4h z)IYr8;(jf+!ILT}rDHMIbHhy+>V(yCr&S7$-mF@rLnn5SZ$P~4hPRZ@1{3>Clc z%Y!=ea0m!c`eISJB1*$~)k7~9Lam}2Xl2yNH=T>k@oXVf_-RSLckwdeN^v$yfvs5- zts4{fD^xqO?%91CJ;jk6HyBAzdnr)W6=&|Fei{3_pu5SV^Kc6vO?V;mU$%!(Zj#jc zibdqV!l zJ{x?xXIs==-`t3KsyoF;oa6F9cFtRyFy|>4f>^CD_M>gA2pW=4h);8Sat#^pucDkF z1LM5?78^4@u@mI>z%AZJL~+ddRI<$PzZkm?KW4eJ;kT2bcIMxQ4qa9+Kyl{Z)n@oG zY!!Fq?UeL$T^A{jl|S?)?U+>>&#QJbB~)6?M*g^%q5)iD?}(kxJHG=u7<^9llrGJ2 z`5YAV{Yveuy3)Xc`C>|kNu9BsFpnG{Hlu>)gsh)jJUeg;#Bwfo{z7vVTqm3#-X1Ci~36qn#qvk1GzNnAQebGv6`zd`8KoH)SAe2xuwor+y>w!Qy1$G&WZ zDvNAI3u|>$bn_6y`J-|HG|$Q>-+2oiU)GU9qF!`WU!au@KB4rZsx>+s%ods=!&MS^iwR}20 zgAUn~NppWBS=nA!XQuqV>6hQ7(i6d~RN}g?qt4xE?nN=D5E=XY*%o5k-7r2mwxnJx z|2gJ6?_6*A3OP&Fy=>eq@+L>If~Z(Xi5(Ykdzk%Ze*%)@f+} z1d{I{-W)QVl_QYxP>CeCe6)r^^A=P_m;m~Vs_n{oaMaxus9diCd=MpmQaqM1MimQW z?~nA`0EGkCNokZ{IuUIQ9O0~wx*Xsf_{Doh0r)9F-&c-AUHWPdO7~r&p6CL#mXQjF zrUPK{^zIBk8AiH|ZftB!8B~=%w>d~FW`nj`%kidvG^W!XHSgcMZU6(k@E-$==TDqC zVuURuV5>KImTStkaJKP#Z9HO!Y`(~fkOdepykolhf+`X{QrR#BKk>&=?FRz5f52d= z*_z&7KCqgWMSBW9CoVF81IHWFj@s3gCdMH~(i11@@r6O45C~)kZ|KJ#?vfc?5Pr4b zUbC~8h}7R3z}pCh0Jk;^{K1;wK6=GgZ)->K(C7)Z@xx@bmLhP28qekw6KU@QM_u`pn< zYe=TVIHOhX*-c9VL91dhptyMSw}j|8Xt_K}Y;VNIem3fGcWpxUrJS5Z7t-bVhL3xq z5R|%5@b)Ek|3`%FK42e|F#?toW#*@GJZ zEA_CGGPZA)q(?d>*Ap|o7*w9pXH#_hysyC{+6LE zh=L-TGZO%op@68%r9`+D-h^!bbQL7Kv%#@LctH)gIeZcam$`L}t8F)4fFq1x_E*zZ z!fEWh{l^JRZ5Jktu|Q$$3|=FDsKFq5*`d-Ca~tUUx)I;iAl49Zc{`G@d-|7atPSG^ z*9JT$Z=m9D-Fk7SZzb@{4Omgy+!sc66;zsv&a3?2bqEnT;dXWhOYb;xLPo)JTA*#P z(x`q4y8xg-$4y$xv*;_Yn47hn?-{WXZ3JwQ3=Ohsz8ZBJrLu98)m^lLRLRcGi&R!ub?*i!ZQRg#9Y#%K zKdK}XbcK1;U8C!JK%15YZ?-F9jyU4o7Ov5^ZR0((W~Zl_>iGNNzWJQW*5~%XK0j;= zT-_r{V|}yinJa46kv3mCxp@YCqX|@x8;?ao`EVb@Tzb~Gf$IhIi|qv*=uq#>8zzar ze)xoeepYXh^3yZN2bL1%zR!_Nrkz8Nvjb*g4Mncm=RXt=FYryj4DmB>v+M$Be{UqgC8?N2htc3 z^iph-ZG-dBtXfwet6r+-X#piK6lgAlXmkg6EWU-1Z26k=v$6Tol~NI_%&!-BfrkCh$Mgy-eWp+` z+5+HO*!Y}{JUqoYVzF>HDNZz}TPrc9Ipc6b^Ub?N)Lj@3IcE`F2?T$_! zOT!h#XHEz`^zc}qI{yUVF7d+2h^36%h~bHLG;LvfCEU*jx*g>{$)wH z>fiBZ1sbz!+P$X3OWa+cop6l`R{k{gz_;{Eg+Z92?=m{V_fpGC&N;@k8)zrOdt zbn=vKmLd}`VcTZ|bFtR!xj7st0Wqr;7Fl&A=n>lW`;1&+PO1Hexr-7vv@8UJv zDpX_ww!JyS@RRZjWgIeow#lk3aQbPS2b~#GdDeQ9vXpvh=X9+Y7TU>aE&`?oJ25e{ z245z8!aF%TF>5N;XHe6bPy8F-c`9e;zB5tCZ+&C2R<)zm!`X8!PtUm4OZvn6B9GW# zCJz2+(@Pw|j%SRy&ZV(=UFly-Cnq+#(kT4f8S@`i_T~L$pi(`5)w@o!_|~${$PWua z_h#ZS$YfEr3v3NzEvh*(GMd$e`n9<%q~uw(i1O^a7JtA$rTq{B-DR>7>?a3NL9VE8oWXuMGxU(YfGw!AEl-dyC1>SA0{O2-8Xc zMOTgov;DaEdjrwpFG^3Hnfr3pzWXYgIrGvzq9Ga)=d$HWDA$w zq~a4n)1rN7Z01bsJl4h#osvG44?`CQLs|_5fly|2Pe`E?F;xie+ zKVo)(2Ks5mNW(rC2&Ra@-`gv|i4Oes2YphF=tdx-pxpQF!04!crQ`UK#`Vubp7jqr zkQ5Y8{wHBTK@Oc3BVOi+HiIt^=R$y!^lB6dtZ_UQ0X&O;C^7yrZV)V9Ys#OLk+Eav zog>6Y0!H{qpeYncWL7gAdTohj1j4w0Woa@NxB)!DII!Urt-JQG{2f%R)!`bydnI8P zUo^%{wc3WKLqW?G+7xKqV;#lC;q~VOD$%-AfiJGoF ze%!2@(eqoc5+$nr{Ph(FxS<&%5Kw}32_3yJ__t=ExgFs@fz{W>Vsy5#QJZ79_zyE1 zt3Hckvu#L|z)OLjJX?pLS!NqQR~M~{Ku&JctoF8hk3g zBsHtQ6(7uHE2Tah4i4tt~f8PGukW~YJkXLEp&S9w_yOq z{&TB<3Sw&9ki6$X)Sz}6``m^_pJ@(`d~pW_6R@S=4SOyROoMDg|2g zd2H~DuN)NPV{;42PN9oYZduN#MMsYDAa!5IFvD>3FlK@Dzb;=ugT(sxq}Fe&abD4T zj_Qz|yur7f8Hb4HWD*y2n`1&l5R5#h}yD{OAmj9MvLQJ3}BVJR{;#Qp_WWv{}>JrMGW)T1+w1JBu?;Y&9GnzKP-^m{v3tyxc&t|W)on|!j?m(G`kzV2bv zzS9_99WC?gEMOML)MGZ|St_k4lm|NEVsjeQRk+-SC=~P93Zt7bl!3}Cy}bBH!&^(k ziCLw)f%{qMTg|WuN!@FECl)+@2vh&*zVW5Roq?&F0TG(X`Tw*_MP6@EHelS9_^sdl zuVVrItK~61m^k_iL~S1RSsuW<{eBwZQgs#NCzk=D)BaC?$6o`CB#-8ay^*@TFrWqn zcnv>Kw%I%^#oH2KQfH}^Xoo^cnId7ax}bCX#-^FF+S2{agIg?@k^CT2iCom1On7Y2 z^~O_>?3W;*+X0OTd3Ws#?pY)rSU?ERhFaawXh*C{M$f|TiZ0iWDxkU_;LP$)9BfDp zO}G<+$94GF*;2ey#l|;sB1NT`ohO&XCm($9KQRj5^3oahNopRV$Hy!{R4>U27Gxuv`;ceLdEZ>h!0=qht zqukjMj8&<=p&zGbJ_}#hG7c1?hx2(ccREp0Wmpxkud;%J;AbL7-e-DHJ*I!;(e>nXay2#r)$196bo+n_eE2B$UG!$2jVoV*h_P>TQEwtM2&5B-vec#H*tsOD znB?21N^?x&{696?-x{s(bGYE+I=?B57K-Y5JJ|qRDewWo##2(H+0ri&+<)9``&lzc ziMB((5WbG|KZ|zo6&A{>-2OZjswCNyWZ1`vA_Kxzqu(#E^TE{op(+P8yLoAYfOl^M z)VNdpuE%Mse8G8jm(#zcSPSJo_|zo&OQMO-_MJQ!1j}}QtdKY(mcQif;o7=q;ZrQh zc5o!w@1VzfGww-wkgoq=J{ z7G7A9yf}Id5^9>ioHq5>0Dh6_^vQ{We}X&6zKoxrOlm1gHd8`&HVw;3NglgE52WK~~^-&ER=9p;sC2 zDcnUL8rAdMUl;Y|%pNV;ixfj5W+T>MBFsrgc%F)0iR~$;i_WDYDmh0^Sa%toao?rFlO*P$O=5KncjLHArlglkfmtM}2ODws>lED>rX2i?_OT}}@7h{JZ@=0%m7{6c; z_uaX84l~RNzKJ0jZ(!a#rU{xf33>zyYKdl31Y3{@3JtJ8~swblam{|w>OLd0JP{UQE;)Nwq+DVRFe1f19N1D*#-f#-$kp6B&f z_VzY=>*}@ef2z#M#`Zj`jPVeD|EeEXYd)DB2kQ8`cn9g~g-1;i(NS)^m zm9i?ylI_89t7L+yzM^S+UZ$JV+)bQ$@Vr*2usiw6e@Dqur8UVyg?6u^l3(2%*E?K6 zeVy9r=`)@KR`fk<@H|KgJTFW)_w!0-V|ku>2AXe=8I=(ggiEQmrDv2Cs^qwr+NIMC zHnyU4DS*3P~ z@=oSDe|TOyNI4Q}WO)+A5LRz)Shx;eJS5>)qEU#D(*viuK@9u+lvLjZpaB5PYpnN=x`Fgv%a cQ~}&56eUNvq8eU@?f?J)07*qoM6N<$f*2SP!2kdN diff --git a/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png b/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png index c6e1215e4de188a6e4009a1db9ff594254661d39..8a01ad0dffb9aea12a951667fc57971f7bb5670b 100644 GIT binary patch literal 14617 zcmb_@1yq#L*7ks;bPWhnDxffwbT^0~9YYVGbR%6#iijxPrF0G54bmx{0@5Yj@V{f- z`_;Yw|E+&5U9*^(^PauW+56egjtN#$kiof4ej5Y=;mAIbQ~`mIJ3%0%=NQPqJ0&;T zkAN2>M->@yP+|Ywb>I&aQ?X}aAW(4_)}y&2)7mSAF0DO`#A{2TPQ0j zrsk@@oirV$z8bf3W%@n5NB5l2zFkjdqgu3EN_#twVE7$lh4iOPJcq4fZ4M2cV*hmR zIGd^Uw%O0?cPQv4V%uJGlNrCuxkVhghsn^U*H5gJY!MRw7%2u~*XN==@80M_X+b?! zSZ`4@uNanH-mrUx>!F;xI%&B(bu@?uNG2+Q4*_0M+1+o04ZMy<$wx{W8mL&nz$ZaD z*x-|$*^B3Um5v7-rKP2$CIczSXLPwk0*&xcP8E_SLXzuv5V$yz7@&iAF?11Q;jLB6Z~rH?gcxk_Vi0!QR*uVx#scPbYMZ-GGa{It-ST9@7JYMv@h_S;FxXUkJl z@s0h!#u3jjz`I^mKm3R;BJbOzSFacGWa8z0G2!}7r~_}MIy_`O?$?X+{_*W~;|TC| zqIWo8mz^0m$Cb||tH+Fd2J9%{isV01_Nyoo=8S-a@ug~ucoK5-BS$i@U&&#MMLb@B3QU@tYC_ zTPoHI`mh_Vk8s_AJk4^bq+7Yf=TkHc;yLcgUZ8j;HnmovhH;x~JuOo%xY7<8BueVq zc_rML(2dIT@yOf$KCN52Z9Sg{Wt-INUYCG?i#Ig-S)B!XxO-i#tda6Bg8ZGe?nmyh zO*GD!I_D1u*2);s%kNlo5<>LdF0z=Im=W{)5-8 zowIuItO{WtBI&*l6LgmOMxGz}=wqe~o#S`Eu3&1W`UON-6T7wJx|p}hvBKf|}|Th6$*Z#MA7>|phro9;n$Vzq-4TnWjj36@6Tc!78Do#G)5Si|Pvx_IPs z(41d;FqTN8*M)P{2EsDldK|25aWk%_joG8H!N^tJclmU4GUYb*j6F

      UpH2OBs{wgb3s?@YAz>=BB35PJi|X8MsVQIRM8>3f^qPD zF9RRa?HoJN_yk*es4MIt}`Sl41+QA3U0-nRa=(vu@BbZcb+ z7gw9(!`WJwD-wh{Fe^CQOr6_Or;dn98(ti+Pz^0)K;-7~%2LymwZ9Gk z+x0kuil;Y6DWum2X(wt+6HdU*Y;A1;C+~SYX^KZBh%rt8V7y!;N{E2Vj;?m>Mf(}) z&3Rjjh__YPdBQjA!IZko-RtjW6g(z}0491n?=X}ekZNdZwxS|H7MmXmnZ2Binbd!RNqCfjxV+7;9o|=6<#t+t7Bymokaq+P4%b;e$KBM72%HY!Nv_|Yqtgffy1bB# zghq}WajpC0D)c&b^MD>T5*T2Y-8nDIW8xD==`_uOn*-C7+5Pc503elMHZSgvh9E$$ zn?U)#`{JnWfNotA);-`XQLW%mJv}e4^H>0l%WtNJ$0;b3d&a3$QH?)Nj~*HhIUo?) z;O=CRw$0Z3$-Z$`!w+<~@i#BO7f{dExwRVD1ILZ|1uZ1Z`>GjF(Oc1NA+rQbg>!NE zae2rz1cJYIEa}W3m!;4VeWhu=GsLX9+S@#a8j|Hxd@>xR<B?RDxU22Cg~U${DIgtgb%TK=vTv7b8)~sCZeuU z4;t7OY)MXaFdBrSWwTf*nJAXTGoox5CckXa+isoQoa!eI;gx9y8q$@myp*d1)A=Mww^E@2$ClFaT*&hEF9(H!Ya7}@0J(h*`@cDT4zij?v38=F3Z*-b&C@! z!~{p>9cB=bdV60SZ`+L`PMG*)rLQ^;Ntm3;O|R*Wot^F#L?m|)rtEgmw7U&Ibhn7| zH7bK~hdJ@-Y@Hs6iIsJdQ$pHo^NG==={OFvsgp0~WE!uV{u&rM9#yYy9b1!(miz}# zxKe1}+JOF9Yo&?e9zOg@%sA|K;*n#_dRZTR-ryVZw~gd?N9XF zZAB#-Y2iZnJsMqe3oO~x=Wr9xWYt7L_w)=aD_KftgLKs(F)o4o<6?i3z=8_!z?Z@M zFoJ5Yi({3G(}g`I>4neFJg?7IXEFdsV=0w|n=yo4ewX+JkOB~>;Pt;py?+UogZTvo z0eEX@Yarn4Jb!!>JKaGCk&*ibm;elDfdhTSfK8x3q=yO~ zZMcjWh|8F%9Cc5N&_O|>e!%-ESR;=JAfQw&3^2Jb>P94hyMquEESzR!r>B4zW?D{y$A!0;?(-a9 z_;?iw^}CmjOZFDW^?kA!ttSn$NMo^K&sP0y`@B}-j#^T4I9r6jAnjcCN5}&S%nd2T$wXUw zb{M@pXJx%k0+uso=vTZs6K$j?oaatc=zC4AZ&j?)oc=s8+{LO>wJi9jX4AY-&zGAg zp9XtOSFfjwWk&D})E<%0xZ{AejM!c*s^d9r-eWE8;A(DZ#0ZyT@!ybwgI<{|2!YAx zjE7Rt>Wm5WOL=u&Ed#9BbFsnpdR`sKM+|>&W=)lw-M>=OKLK4>apIVaz)D!j)~j=e z^Rt%Nysc8R(bp4bs`t+)(n8HJz+OyPC}Zo}_I1h&B>|dU6pRt6G}_<2-Y-&y@S57g z)E?i;CH;HeW$MDvY-!H?zZaBVa1Z)U@~?#qX%Il9@BI};G>P!<(o}_Dz~cMF;eZ(` zWl1750``}O^Lnl{A^a&Di{EQO6Y(T`-+(WdAM}vd2m$z9sHFzM05JiV`CqdK;GsWB zN5IPQ_Vj|^d!(A?tBaG?KR$6u@Ob3Wo=oR2>%X?*--tXdUH>=s|KF?jjvLzh%%`5+ z3(A#_`L*KQfd02@7~_F2ikNfaTY0z}t`|GKM;(lB8e)JvCP1XK);%Wa`F)G^5p%u4 z#`Ea`4DN60jiG5Q+KPlXJ?qAt7JA8m=F5LZXeT*A# z#!se}@-=xs{F86(2dJEcH|T5I-i}u2JL?F4W<$xD_fqHSioAPP(TZbW{9BwzX0-}B zx2XK5+ja2P&z1X)O%(=7n@dI-SFBlK>>6W&ER!Yc!W8%j0bWp`hY+kEo*jguVVPn! zQ`ISB-gH7brouSi&D^(+tJnNkV^Zg#{G;<5bSEkxJb+O=ct%vcex^=!GBm=o|9q|` zXF}94E!Xlzk?i8&c}e6p?QTK*Shv#)V{6SS40TeO3Wke;v67BBD=|+xrn%1_qt>&# zOQio;Cf8j^WM#W2jjyjNCxw#*?&S}okSKUuoAW$vz?gQbW<^~0c@@$moqno4 z;YH4FpF#-5Ll!l+f-MPLxzE%6V8%&_Ih_-O5Bj}OEhqcj>liG&$($dcq}<0T;SkGT zZliyDi1SkAjYE;E_Ns+O^%-VqF;yHcF|HaBY-S#)8_nfP3W>hSD`zc=s=$XtNY>a{)8 zR!GXza?295y6(fyoG^ND_u)}XRpHbtrQp>&>SLsr`rX2J1#&(6-_GqXE{b!FGj3@F z!`b>xR zYtXiRnW!nDKApx#6x1P=<rNs8v%FD?NYTCA@3YT+J*7_^8`+Pm_2XYG*jND4l zhnCo-IhM<$PggNHVs>b?DlN2q*h{|(Lj4PQP3QFY8m-2=LylJTt`GEfTx5-G-P0I* z;(uD^FW0d8sKP3l>=9rpYuKmOmQ7{|*Haa3u%QTfDxy_+P_ds=0!^(Ba@nuwA&y zSM{fjM>>iZE*S7~Aiqjg%#Rw2U+?s5Ke|)ETjTS2@lZWymexFM6DoU%+uTB|?tY>esrHO#0S?%EAn-Z!bi5F* z8#bFX1~@({D(Z(=2WS@NyK6*J$1|$hMdX=tc?qaxw+QF5)t%9O=DRz=pQ&alIhHM`$E$10lr=+EVXAN3mEjpQ1a*D05n+z}{=uzJ=LoTH~Io!)!5$CtdM&n^52BGiw} zru~~ronwK=s?#GdDOBInUlrxbC8Vy~WpSxuN|sW7&{P`ZFTL_$nyqSi`7Pa7Br7fy ztUiDA5DrTN+k8s3&}^4yGpJia(8zO*9jl#AWmkIr$tV}zlH>TC$89FVZ~0x04xSDi zGs}8$i*1*ACrWJ(j-lS3q|t*25iMaGWr$AMz9}6qz+eL-?xj5fYcqG{+v1n;JSN55 z==Ka5Z-=YX+`qy2>Qq^8P}+$XC`KG2BTnA+`&xHj+e!?J`BEiwOnd#D9{FT~N|KcUF`$3W%5ea0Z2h2{rrgOd*_?n*!-P^Ue{pmz0*SGLHhnw_g zcBBO9izbWWak-Vbtzzri$16cr*c;~gd<8YHB7Tv>-Qq#{DGx{_!7(}H@jTayMKr$} zr;jm{OYtz;TmI^95T#qjaz`3HEnGIIaw)eB@s{RZxFv ziG<$Q7tmsUr=nX%;;ub54nUrIIt~r(7&v+CK>n(dlNU z77hHpS=c95{?=oaoEApR+v#-0>IAq}yBQqz{fkZ6Y<^@+>e%2kcI+6PP(0?8te4E} zf*QyC6)VUJzVz(SD!g)txBGHx)j$RD*JbM3xCpPcjIBJfmQ~}H&k}&7r>oF+N(h=g z;!FUs2&RtJ6H3x!_D9u8T1K7F5U z#9Vs&IVb}3_X|12=vY_8!dx5g%-S=jZ!#PuxO;KC?5uO#V)~6KvJ~1r(qYmtB(XI2 zQJ%llnqQG7Am{g5h9lf&U_Oge%b(qGU&kuY zk}7JHyisV3|Kxe^6{asDyGvEbL1hhic*{8`z0a_2HU<2w;Q`5asT#rLY1IAqi}~T* zbDvuS(6utD{aSHzv~I(YX%M+cwyH&|2juCZzoU6T>5@u>i;Xp=a5CxozN-ysr@&Lw zP_@Gvp|{7~9jMDbGx=K%jn7=HArL|)p3&iZ=xgka;1 z@MRS>M@heB9kb`7tS^=q7qaZ`gf9)4uPF|J@KPA~Lq+?iVpF$G$Rk zfynKK`vP5KWr?vRJ~q#yv_R570b5j0mAbiwU-RW-L*wqD&o}B$ z=0u#7J7xcfghL;h)rO6_wDS;gFuyo5j9q3&`ps@|-h>gmIqEv0vt3F0)SV{RUq)=X zAq3@RklPc^6jV>vaEj_(=C{Zse6zCF_x`QB#2UN7<6WGf^$%P5?o(yLBI?`gZrn*{ z7LBnDcF{2t?lMl?N^&EG7;G%R_(QxqE*N#bq+v~$jmq`8p?Zu(*oZtGexI|bzOu6I z526(O(RQ!|x7ZP&?1)^}s$m0>s(1Ff{QT-ikg+ddHTq#!~T}XaqrYrm6BI zKXyFhrPIGvY+H^mCuwE)_%Xv|U^6qTCL|6QmItKr^gwN?8eV9D%VJ}dUnrQP4UVBY z>pEJ>yQbOQ&~pw?JX(@*61&;36`A~$ZFxt2U4ld2BzBYi|4T%V@2WPof4Qt-bRc(d zytf{G#<2ohgMAEjGB-K3D(>=DvmvvFD`6e|Sc}*8>KW-s;6Va$`vGwz708Q)=C!M+ z6!iM502{wXli2vgp8rmX&O3$NO?6CP*wKAFD?3wT{xKrFiUGiJjE0qPOK`J;^f}ya zVE0y3k=KL=W{BLi!MtTyss2KM33mkdH*hAS5oEN-&kNLIxMSP>@_E6Qn;tHII+JuM)h+iAdsJ~jqS>$om?N?TyJcH zfjn5DIlFEXi=n4?fIO|N@bXI_bLk0VTLG@>-CcbQ^dlCsI@LPm`&!xeB0F)^Mtk}M zqGox!R`Yk61)gbl?{**702?*XH+U28_H}l@RC}T2fk=1JCciWrNxEOQp8(p*a=ka` zrZE=A7i)ermHa2Vlj$4zyVX0dc~(&-L|A8*2-}D{2a}p5ws~)O$SHh{4qvF>E#P%5 z{*uRN{-~?u7?Bj>l!W@Va};^;-=_4u;wef_3KMahzW1}v71tH_*wABROiJG*%n~T~ z#6(?~z3|FmpOy~7U^+`Ys;8sKrk=Z)drB3LO=ppu3sYA9eJZYD0ht-Q#UH#)MjYWk z6hGp{`*7qjRght_%KwV~*==5-jGITeM3X_rGEoCsLzap}l@)km^BHX2fhP@>i`@I= zTMyjqmnlOwe#;5)gR-N(gs}r(E&ihJeShmPZVmVZG`~cAD%>^AY5DZ~9JwL1vpkDs zQ~jkuR_^%}%!+5DecpdwOSy zFY3=S-fXUrcF<61uiND%AFqV_)700oG`r61u75UcS*+018YBN>mD_uK;QNty;9P=d zCG;%+1I>sK_;$da1`Im@1z%sOaiA+okLJ6vzGXoRnb?5vyfL1fv0FnjqeWDHePKgf zdn!*zXbC1*qqJyti7{IV6-R$eO@in_KuzHQC=Dwt;eea#TI0Ak-mSI$gIhc--XC_e zS{e!FRoO`u<=68~5I9^f+0rfVXhQnKEx1C@0B$jBRyO36VJyd5F`95*2H$^9#WRso z<;<6pEJ2g0+Swiv1<}gd?97^f&i=|8?`H<2_qEF4Ho?waJgJ1%s$vo5c+X(v)&ImS zmeIB7sr;CGC(4<;%s>%nzZXu-8!HnsB+4-*n#aU@9$GIfH9U#waI6)bQ|7n)oIbv- zT&7tVrP2s)Iu3%RRRcZJ!!5c9X8eseCaWtgE;m&euf=1%%&1Xw81+&v$doRM;$@M(|W3^Et>_*F?Z|=SWWd=-fkJ* zg(>=u;{i<*-8)^$Jz0=DsBGqlj2so(p{}sy$=`88ayf<9`;du{q&n+_81j=-gwvvA zSaz8|Az?fFkKNJ#!Xo}{Q#Ibe;O6G?g##t zv>F2((YL=}B1?uRa{1#ur2tUVkZF0P3^3hab>KDJkdTl8p_4>eGN3Cf=)46rLp1~1 z7{A&LQs{AUag(K{1HejLN`B&aP&|Oz2!a_58`1)kk|IWP`fR-qzIR2WVWwgtVy4vQ zOA~8j5+^C!`Pn^K$`6KzjpzTPN;i~94ZQ61T&P(Akko}Rjcxg%vW`HEHIEe zo`3zsRC(SFjv#?dRZ#n)x&rNDgiJC%hcX77P<0n#$`6i?@4w{ z=umRZ3QsTg@qE5ebOE)|FFh6t1C6gveX+qAN0~!b0>X*k zX{~Canejb(D)@WpZigCGQQu=)CZWi}0H*>MHc{`vGl`65@+T#AH+60RnhpsO0u|B} zSMp^P8H#Iig2DpjdTGNH$%42|$C!O(?xLOa-m<5Vgul8ctdn0jWoz`xdosFtalSFthnG8B z)z-jD4vtaecly=Lb%FQXOAkKCdJpRN^48L8_3aP3kMBNo=~avXMfSvbJxDMhP0*`W z9i^&NQ!iq9vi>Qrj#zqeYDMnQIoN$BoGhJXc0vmNN<|@A@T|brizyLw*jj;TC%POc zhUxmOlq<@l@v!Pz$ikoWP0%Le#KcD{XP|0Jm2UNMh34De=EecLx6@py%~9udQ95f{ zgu801i&()sD;bU_r|CBA<&56cyfg+f;@pW^7uH4w*U*@2P3SCVe8_T0o?}(U(;<`?$)Kpk04ucv z1`bRBP%41j0sk?VgAYoZJ+JScFD6}iex;}}RcN-*z*EXTG+Jv(FP(rA;z`2iH~U$4 z2v5;hNFk5M}cg>IV9{Xf@P9n5Z$+3vN&bV&V{#NVLZLkeV z$}La&H_zod&W>(D3Qkz4#-G{HzNwGWe=F}ScdmTs5NuHyIoe5kE@IYu4=PH6f<=an zF!>bY*X}ACi+)|_Uh5&`L@d6jYGUwL%|A)>7I=U@vK&xA0VR!kl~q8{L}-r4A~b|bo$rksU!gKP61;p zXu!-$!7CWjAos5$HA6+gdR6gDJ5eT}TT_PfQ+Q-;q-Nw)>pz=?*m@0&o(@+Rab=0?uSD>1DF-^SfPlPfcn6(}%!LX_u2wW`p z?vdxz%MOAS*X(~55vp;>o3~=uYBtinp#A$zUJCB0vFg9 zCofw35gwpYN{niM5QPB2D}9!)W)+mw3j6qN4$GF4$i?+mm94tzgAW5QXiHS|{R@C9 z{x9`ai!SrdUZ0+<+SGZvW!PI=!|mP^zH3Veb)lKuxvM~?Z=$d>L2iA>F=X=~c`z&4 zT8*o5MuJU5#BigeOWeVs`~&YOQ~ZJ~+%A|lf#VVQMM?d>!#V;9o$c?G)~|;ya~&ho zkB`->eC?o{dMW4dq=MR`F6z(0O&(X_sn3Dh#WK1nku;+_er_>M?n_`g$LRWi(xK+ROW5*0u?c zs_57y^=g=b7TzxniCBG%ylE6#D6y6;_R9LVBdG=2N*9vl^Bk_{bia0zXTiS0(lpD4 z2bM}@55MEqGI7ZY7UWWML%$0U>umow5By%&Aud!D%B{NU99*om9AWhb@iqeXRgaz| zeQ$c+U$Pi}T$PdQ?j$x`0^T+&7QG7H(G2_-(Y)|VIkno1ZrDebdal3w49?%y5-4Ys+F7XRpSu zqf1Av!|xMTxUP9vHQ)b+<1Cp;&9R32 zqsNna>oP+BhB-VWMGFpVD=$!E!C;Z9jp+2vjuXPH%=q~(DZ_M|^$M@lffDw0-@ znE~uEV!lx4@=JRRu8eIWNZst0RmX1~KeV6-fCvECh#j$0+FEIspwUoE>@eoo=lS4o-kTfMEF(Sj2S~ZzbF|X$7 ziUTF0x#M_fA|q8#dl<_acM{n8@`{D#CF3Ebt?5Q1cG9##iAJtx> zTe?fuTJ4;a(o19h_7*fLI2jTSS_m1*mmvcL&s;yFeI6{XRj5LDM}2Tp9EUU_0_(l zn&x%7_Z}h(;#+@d*uvIAd7+?}Il!D=hw~@)E1_VmHV%y!?A1iHy*AD(Qpndjl=9DD zIH+pAZY%GRJ-Um`t`|sc6TB221u-&pt4=oi%NvwXLVS^GC5Bem=5`cA=ncYe@88p- z8rVj5ld;#3EgnY?$hoy6x8`VFA}@j#l$2+Z!wirpfE%$p3su7#04nf2&5Lbvl5h+c zY%#bd31^c;?=P4TaCuw0G>q|WW{S{Lkac)@Z-(WAOJqN}a=nf1I<(SeS^LqEr8VUQ-8?MP8M z(BDSzo-ZuE?GJ)s3+y(vmKIN4>&urP-xQQD_x4DA6nb}SOZLY(t*=xKm&*#nGyZ+C zOg=oa^>6kPKlu|`En|8UP`zAuyuxalsD*`tCLlTH@2bo`J$(7)e2;^v(rWg6@6*P} zcw|8~`nj~)BVVZ|)K??+N$9Jm4dN(2ZgF(Km6WphVJ`bPk0ELLL#QJEzAV$&(;m68 zI{>#dL-kqoZC_X)&~K<4u2RrH|L&90aL;EeJ-s{q)zRr0#{%a}1h2(RecP1W4iuwA zR$iE`vx-JBR5!PCrPwiW&WJ7-5#})vJkI!L)A%T&SWL+Aa8`nWHBb6;*?I`6*6X8F z9jtM6TU*wEiDLE~Vuh=E{5UEju{6Tbw=g7Qf5b%zfQ>cXh~Xy;C}~Yob@v;c#NcL8 zKv)AB_=C4y!`dg*2~l-(-#F{5z#K(8!6+dbz#P}FrNA9qgCY6lF(hwbwC?EGU~iH$ zst`8J=5!H&dcON}1r(?c`e&t<&i4YiED!cI#XnDWkUl#URlKI^oq`dN-*V%mg&qR) zYd|;RC#;C${1p!N(>t2Te$h;tk<>qeVSq8X5G3{gVF`fNJ2TZB0z9VPBgilPf$yC(ddS_lE{u;W2i@JH#&;|LJo=T3T%#NDngh*vrIJdfu`ue_Yqotx7TQg)kbLwG#l0_lyCm1db&hCP5ow|?s)y7 zB%DkmZrPOe4V1)2>OnB=@mS1qbNXTf2D#`T5pEW!4*?1;1visKRDf>slIM&KLuU1Y zfL8Fn0xl;o3HyuT3F|lTTutAc3>D0WiKB#k`R*;$Htiz|$8QugT4#llRgddJW@^ZO z=UK6y7~sCHFTVS*1r;fI?5p`={F2b;Az7Bb|4?rjj^=d1CLguLYnT`;s9!L$lf`B>R z3|hbTmX;PoiIVhy7juyGmmt}y7U5h-p>mIi5x!kz#} z0#qQCvN%QIv2k&3rwc(TUdNMmxNInY9<#v&g|M*f0Cf#ufPTDC59=AI6`-lV_NMX+ z2qp%)ud~I*9l$?vB2gm1ruTtyoITQciR}CCOD)UiFm?_OpzKFQ^yqKd4=G|Gh}s~< z=fumOKb=Wa1ZohL@+iEts_JycaX{$uM=MZ2{LX^<4i}htY_CjT-y&?sXbP&Hrfg$s~T>H>PWIB+HvkKAy m7%wn6`uhheIK{<#H%Qf?I#08+KkWkVgJh)?Bn!o1zW)c_+7Xuk literal 14550 zcmb_@cU+Ufwry0JgpLHHiYN$#B1loHARq#Q)BpmZ_ue~#h!_!--lQnfA#{*tsM3|* z1nD*O8ru5;>bd3Icka9I{-OCLWWL$6XU|$|?>z}sc`QdvNJ|I;fr#ZFK2QaLE`9@n zE|?Hp1U@M`)nNx-E;y^oNrCda=of)EIOg}2?t?&u;ou`fT;Tm>hlkqEAP`9d_TPmT z`%DuMNZ4Bb!F_cPeRR@jxW;_k+yTE+t0}i{XvI`M%g)nlv)A)>I|wXgsdPU+>BYah z3(LEjlLwP}lAtJrcA2v4*?t{HVWT)DN%#78bKf(ytH};hW3!4EX0ysN*(n_^KeMjw z#S9$QEUO$M-Ow7|$9`VwxjVjV?n4Mwv2K0u!F=0gz%UT;eI)RIK=T4SY^=`TpUO&G zR~JkT27yu<)bSABd#k=*)<-K9_=}5+=gqs5;ty_S|EO{{?+lKw;XO{6@GB}RqTs#` z0!g;qx(u0X-NPTuujStx0NWph*NN^fjBA~Mb~4!v4tFOKJuqR5A7cviE4=sYDpG)1 zlkVdq{11%|euC{!cQz!nqC+t~dj_Yg!^3K)^UdayMSy!yC^_se;rm9kX^UcTsSw?F+^cd}YONpT4TQoP3u8>@0(OR5yA z)VfUwm_EC-lwH>aOdO#^09o_Da~d@59mQgoQn^?#m_eG=Y$h;6k$`Mq-0tAn?a+(! z+h0$u>jS<{`I;EwzB=Yq*f!KAS88axfJ6vGEIIcBtQx~t#q4kU@w&sZan=XJrtTc2`zpYW_lexy; zHn31nZO$@+P1$qJ9baB+wN2VG6aEg(tBhyGQPrK!LoIX7foqV_y(K*Ph_7#O=2JX( z)>_@k&vq@IeNGY(h!-^kzwPaaSsbkWSdG-*t@K+rwrqY(TnoD0sBRQ8euB2etLf$; zWuh=$bqgkx*KEKCe~hbK#3yCkM_|Wi+3?$$iz-+ClI823bB-vRKHtSbovRTVBj+tBn;u# ziF8WX3r}Yi+h&BmNj^P5kCr!R;DbQ1Dq{&k=H^l00eSCgwTfOiz22DpcXw!-tWQfC zQrhq||3p?_Kile9k|W14pcjn(+|n>FF_D^eXzdZUoBADiO@LE$uzd8yi}2eG9$Whl7Y^ds-;= zm`^U2Eu1G9{-ms-@kGXmSJfRVwSsK3enAS65Z$N=_diapoBAF8dutOC{*y`iCn^tj z!1%ULMBF{xcKd!-xgS$u{Q$Q?@{Uz|POpzjsJg*ayfRY5tfoo)9emafnK}=biGUCr zeh%MQpKNGf>+Y}Zy-1vvVQ|=WfG}U1s9P)G2Rvdz85oT6!6ORP`6K#1;E5T844&7DUC1fz=xg#?uhk6y-6bXtEKD~EC0A{p z$ml~ZfC5(E;viDyyv{`6XS#=#I06%<@CV;rFjr)4<-q_=iO&#ny-kMLI*c`kH z0>O(eqoy|d!4v++Rc+)?SiCk%?Yo}}cZ08EVZ{as)7JJh#$*CuT)H+gHMqR|L}8Fo z3)lGFX#Y0z4<{@@1K^yYW4AJT*fz~pw~g;P_|jz`&GfU{v*GU{0RnuIRM|(_bMi$I zgpv5LZ!-OdIRZ+yu=~J`4FKb&XkRVc)gN41^Bt%;T!gt_;rvvT_Fwci<583VA~cHH z4mgna~%>b-Ob=d9npVj|v;D&ahj0)xHT8*6IeGl>pL2v7uUxc=%q!gE*o274S9`z10~c$4qjVFzEq%b@yVURQ_ocd;J|Bxs&x_Dq zNh0>0i7MPfh{VGYhm_>DnCf;^@(Ay{;P5*)A52qU{+i|WaF*j_D4c_vtK9|p5+2f&?LmA$ zweD++Jn za!(yn9dnLmUXcbLX6dDyV==~@NAd6vix!rYZ1==n0vI`x5W-F0$hJ40@p1Dz@(Gf_ z)G#G+;uaX+lJ@2M@_X-7uIZSBkwB(|G+$l%`2MO_9}r4w(+2(v1;T(2ag2kS8bV0T zxf7XweT1?;6o+Ltn{AsHoJ@`uvw1S$0O21%40(|tWKZvRDAz__^@$u0!IX^2Sx!D_ zHZTWZypc-3cf92{Ol;K7jGw~h0%Af z=c;%s9rj!?0#L{(TH&)(kFXcdAfg~nIX&Q+NT@vG{sWbwbtl^+fQ<9^nDV~lQ-RBe zJ@>$ldz^msr0lB~z#e#?bBGwkl_d%P^w-hbCw z5=m3}cXp#&JKL%+!@vNlk!En4L#cEgbV;&Y`TLY@u7pbib-V5i`K|EDRiWqkZG++~ zoGe1S2L-i*jOI1N*4O8TI?Q@r)YVK5v_;6xN?AysEwju7xj)S`3g1{+P7agmruSU) zF7VMhUYF^AU!dtRxHrH(swe(7I(cFUX}YT)T+wg%YWgSQ4lGt)>I0d5-$TgzRGgjb zSZ}mLYK?E-JC2Dtc?=AXQsvQY^hq(G47E>C$(Z{}%2Ni*fhJvdjd_p?)Cc4OUZ0D-meJ+nKH}8 zP26dFa#PlXGU0`j-cXgge{5N86z;|4?OoyVOo!q6oEhRMc@;9QO>w!6H!_LE!n_=D z7y1!EsCG&rf%qBWV1lZ%&}#k-i65HeP}ws-oJEC24grLP{I4k~k3;_sRmpgO1O=Ee z!z>6OnQDLLXNA$o_zuyA-`3n_CK#Xr&hcy6h1%tLv8rs50n5x#>Ejm}iMWdnatk7TRLLi;sNAdBf?n$fFi ze_X^^>aiKgy&hqz5st0=4xr?VLbttaFTHy`Hoku1A+EQuTC0fKVkWE;4D!J%mW9}`C^QZ^}1jj zB}8keEbk^HpHx)E%A6fMLY)CBrQmg%l{uC9rqAz?zyf${fMg9mO|p&tJh2LwHNNP5VPz()HPev_>_NjP5+80pK!FdX{t%;E0ya) zDjGaOYwB*(HXlQg-dForrzJYb3T_k=?%k1sko*3o8F;YPl`)d z99ebA3|e0aS(=#M%Pz_#|BZq=#Q5M@+uKYpQ+{3Plue4iBvCzNbkl~lFu7Vk!CHLm zO(|p{%Jy@SxSgb1D78gmqu-Kuaqkq~E3k$>=i%E1ip8?x;77Y}_XdusKT-2*YU(9s zpU&1xyK#t0W@L9{+-RpgKPNF#cZln*q>XWY7^sZbu=A_8$(8$jDfm)94tQ}wvo?3E zhGSU){ax@&JUnMHai@lg?iRPYZ(dqEM->(Sve-nW}Ps=hnAJvu9^(X!PzlKp`a zj0(!p_Im<&s--aOA@%K7(Q5Nnn&a%GaRqUxE4r_rUrN`f8PuR7vXJWX)w+}x5lEbRRcvJi<>*wzGlr;w>%~v_vcLRw zSp4USYD@H^v3#L!;hNc@T?@v_;RnG+hW1U-jn8taW!Fk}DIreita48(vF@zw+FyIB zZuV}An|DnMJYvrl<(}8E*b}yxe&c#%XCnIk_JE=;In;{h@$hNUc&Jzyd839|PDQ5) z-9te&y@8j%IimBHKc@-it=JpLf?|D6BL`NFWYhO~8)CsLdu;3Zqh)kQ=!9-nXSK{)e+~{d!|-R{ul*VJU$AW0Wk|^5HUEtn zX9Cyz8C|EZ0MH}`@OG@$*PA>=LDXaYn$O-P5D~z}01W>3vnDL?-Ra!OvK{^WCL|&< zK3^4+H{mlsUOE8L6;X zI`-mHLJ4tz7uMfQ&EuaxTm39)wmvMK+{B2ZC!*WwCyBm%pPI9_MXq}b-mo4XSaJMj z9B>;jAIifMLV6Ex0S{2YlT~%pxm&dM;L}L8>C)p7hq|5FPp$PyXlM!1LTl%W!zC#T z73(Zp(yd#d_#k*{T&2Uon!mtlgRvIbQsBw#SbFUVL7V`Ox$VX^c(<6y-Wm_az*1}c zhpz7%2Us2XDA|k1yVksB?ko8F1^K8_lbYd<(%zA-+?o)%8}rJ0*BRxXw!O`drbLJ> zl{k>_LIB*SgfgCHkRDMGC{^qGIoBq`C((k8vX@+5(B7+-mJP~TdXIK0iqCR-9{dGk zgS6#wo%N9{i;S(OZ@#bX+*zU_5{a&55osMLp-&#UYkH%tqY#?OJetU+-Q6<{1${h| zIVq2`>fnY+ocH38w`VPSPP4z1T#hGk*Wr(nyfb>iQ%0s{;Twd*vd|>2zgH8jG5~99 ziDhwTY20hnuqli!33RzEBCP!cO#~PHEz)+VpotOb9!zQ{G;vp)e%AI+}tH6HW}T#1P-~CCde$+&4dnu;?Pwi1@Ze> z=arxfA6@Yrd#*MmKz67JE_~1kVP$cCZ%Z?_>D2Uo5hO?lNZIg5I`EvWK>abP*Y2}p9Eo2a@8G6RQ+7Q%IpizMZ~I~ z^unW#o_M?6k&v1gByyn+qwk%#L+CA799J@FZ(mWmIrF4eMFz=>Z{70vP^?A%75_KL zUFAicv>%$g0%da-9|xX6qOLIP^+UFaN?vVLeVpm~<26iuEWdIoBhN9PzrJ1jN)6$L z;?FBBRn(S9hk@m^0FRHdMJh74-qF2H*v=lyPDEw7aEXmgP%ql%TJfyfw*R%dxWHeK zux4kqDU=YhWQvF--R3&>XpsCvjVr^n4y{BO*9e~q1i=$We#cbBe%=1b6c;Y@HeBk}!`YZIG`AFJ~FJU9Ed)MMAlopNNxx#kr5o6I3$# z0%N2iFH}kYnByH^RYtHHyeHheuE*GozUV3Es3~u1-!oYs1nmt+8HV&had|KNhPTp5 zG008F`pS~}VaKdik@7Merf!6br)W8Nh9SLJmc#2Oqm1{g4*QPv1sh*L5LY5%COq~w zL!GfS(bf5s<}^V_I)%)PNoUMaDvxXQu?PoG&+LZJKHN|@f-750OYAwO6jUaT1MbAu z6EA#e1d0<4?x*{_c2&++k34EhXZcR^N@qLTW!{OszO*90j!6v)j^$(-b{7A3XFgaX z91M2?3YC&zqN&bF7mfiijFhZR*^2dt6cOUy+s=&dzQ3H>ZviI>hEc} z@EIDn{rGgM;c7{FhheqEjN_R_*`>`_ue^S|<5KT2YSqcf$Qwz`EsPAmEw?KBaxFAx z$mq5u?jnVoLs8nu)vq4stZKa^1`}pe*bx6Ls_{Y7HL7Fwp4DfHmval9Z(eyxFWf#g z8K)!ZWggbvDY5kR%O2_7vbncaaNM#TTwL8aAd+4DOef7vCcyFhBn|dCBX8|T@5syt zZhU0{=X_E3{`3#af|BZu(X#`Bp6hiFeTenx{S~hF+ht7xjTuHxdey8+lW6BL#$F68THh1 z?Bg*WTdbh3vRJqU>Pw~bx?6({S?yQL3Aq|3;17N8yoe&tZd_Aiv2Pn`HwP&6N`K!{ z!kN|wPE7AO+|W6|96eMGp!tDs%4R94H;NF|S$#24v%n9#nu&LnjGN?56zFyRevYtUh5I)M3500^ zb9`(2r0!(Gpr*GTKH0%e6XotZX%cs!%@R2f_3x@v;K`J6+#vT?LRL4x8qX;zpJjVh zdS(>Su^j+eqiKe`!hv3#{+?#y@L=O$_*BhR?YKADQ0s84Xt;JJ8kDQIPdGDpvYR&) zu9|e`i(wH%%D(okmLsZs)q6Em z=G+4w8aKIaY7a1C)9CwU4oHvPoo?CGOZG=|rTj5d-D71BabM~O$(T8PRvh~9r_PnS zVLB_WqitZ-QTBtm{*kyj@Jzg=kiFXS_aUs(q460UF!jh%Ic(L5Y}`22a?u<5Df#LS zJ@iOz1|WYk*Cq(dWUwXj<#IMLK~zP-6VsY;!|R6*E18>jIla)9QvbUAI*diI)sMiLtP49Z!9~brt${!L!JT!UdBD|dzP`t3baOasqC3ofahELylEns4GOk; z5Rn@S{x5XK49UKa;sO~~0tdo>2#`awL!YI1-K)|e0GHisC!T@{3ekIkbbu(AMqY!t zC{o7@I{>;CGwVQ7Yx2igWi2?9>R0Z;s4kyE`KbUwR7DsYjQHeRW`-eBpE} z%1^5j)w`L=df8{DS|3H{_PWmW+9PScMu%WEO-jDy7*8;P` zkQSRkP|9!=#B60OPW(=QJdjYH4P03(ycJ5>l}^=FqM#&>DO-0m_|!gKsdsJdR+50~ zkLBH4Bbo{+D&VP5V$@lc6Oeu@_+hVlDR{?q+~cr89Rv5ytue-vv5=zq_OVSw{TJrfO$Ffxp)|<#X5VO#ZE55vKHy@~y1A;tRG zC9{+O>k&%QS<&kD_7hD3Ds^t_j+2^Zb`wu>GG+@eq)@C0x$Rwq6{ zE|7r1;BJZ2YIzzFw-sTpZ3_!r3!sm2-fxh>kBf^N2DBP566od7#GjQ1fZYU2%RjUs z5XkPz@K&e2-&SKNW$NXW%h=$OS$6Sq_4VBeuv*c^hjb`^m+60*MgU=$A1Sq-aDsAi z1+xZB0$i;_4b9Cf8>1~?(jA6}D0dcA=Fn9L`0G*ig~D$?B8Pr;m}(3K9-UClcQFj$ zm=Z1+jX`zE_mE<{H{qXiwjof>=;X}|xoG>HC@xk`Sc$C!4tPB`H+N;Ycs~4OA-oo| zl=B^j7dUQ8Re`}f@ae39N}eR{?PyDSl#%gGRNBNO4&n(=?s*?$;OE)$h5-zo8@&RT z1n@``7rflk^?d4?T0FnggsVHr^;CU9S#SO75<4@bLGdoE3`kK6HaJLlv~LP1Jb5di ziI3<(2UpR)DK*|Yqa4{{^uELU5agszndA!B=n`+ttvjzK{a)rqYS|=ShXok<`S}66 zX9A{){o9cEIjoR(88V(YRwyvCV4n8#mamk-)W&cYnlNg7ea11C*LB#0`L6SqSEBu# zm`Qo0Ln^A2ttm~mtUYgFz%p?`B7flZjUB{oSw)WHx%Aa@|l;?4V3XDTMi8NBS+DGqN5?rwF;Se zKPg#h>=%!d^0aG(W%%gJ&`MiU_HIRbwwLSuM@)LN>AVz!f(B{j3VqYjjbyHi&D?>w zkxtl+^Ig`R#7SYowt6;(6a2mQG3P0)>xq#B$%aiuU&(6@uJ0W2ruO-kCShtw zL*#c(yv2;o6PVH}vPw0gu{RrI7$j3GR@gnx{UltMLb@-Vu8IJn()2;hdtZ#4CV=ZI zRQ8eexbZuh1dWp!kK({!=S~=_qE;1Pv_0QD`UGX&C%L23(b-G=xbp4w;~YG}qETDh zexY7N?`hJwe-6nY12}*KS8P3)?{M)uKM*Urfx&`OEXx`vZ)$kimi>!*++@IeHF05~ z`Qv*0w?}TkW^%q=U16Pl<>x^G-Nbx?eapY8pYW0tnLS==j%PopO5I43_2o)h2L=AF zTc}mJ`c-I8dJE87QNNE2Kw$%)0!qQwegoP&{K<4Dpmcmpj-TyKgK_$HF{55@!GdF5 z61n+9EqQlN%??@(q(ja={V)FeH+1iH6)?dqYuq;~?3}>&SMs)1O^S4T!qZ|D)T`2S zWl4UV-ZzGzE@oeYeT4(k3XP!$_eH2uGbs+NDH!y{I*>zC2m^76@UY}E6liq~w&2Z? z1QZ1R48TEfWljbKCovz|j@toU2n{kQocDJs3b-5>brJ6z$+2yv|IQ!d+qbmL4SPN3 z=C#6FYjy{k97qzrVec%tO9TYKF9ZSZ&|C*PfN}7Rjl78vXAq4L4wwdj(~^sUxRRsi z>qwyjx-TQZjTK<>3wgk>?}7vnUI2P6aB;u^W#=xH?2_rUJCwzIrgju!dgi1NytX`UH^ggsg(F zL_vuOY=KQZeUf|dS@6zIuuT8ZeR3$gnhc6vd#;URd)@}7FzO3~xIpqz^mN|AayI-D zIW(ROb+H+Y!Y;S|+x}E~u>P`8=Y!s0pj6D+u6)o7$Zb5m4k%N$ZvBmefopA^pIoE5>O3re zcEIb*(1kYWA##Ih4SM||6|3m9Yj(8&^4S$kw42g)mQ6RvGX}!)eYkY5mBpalVim5? zHaSQ<&}>5>um16c2d3X&K!WV_WF<_Cn@1?WlNi$VB=DU_@dn9_(WHjU4ecGR47wk~ z{8&fA8YwY-#bMcVG2R4o^K6QGg4z!s=R+tmykz)AFGIL*n>e#Jr74za>2vEP>oJXT za~qcl{l!8ptAB%qLTW$=@L&VT`(z^?GdYwZC;+=rDEZ)mZ^Q&G?2eNV$1WBNJ++mP znTZnGx2~oGICvn*6`7nZw=|O|ew}r&$xLgtWXVaRKL@OeSy?@2_anq#&NuQH7b7Dj9C%% zu^rl)PkR{4)inyZAL>AMHQlqOvl27*6#5#@5L!^_&+;j^=aiOJr_8EQqpxkl1&z7b zXpv{g=SN}q*bdK9$MMCGE}#EeejJT01+-Dh2(L=MGVSUI9K@0lbCu@sY<9LgIu12D z+nC-So%0_NPY6gD&fQFj(PhrTUvV^oKXcmayb0xh^T-^LGh?hUzxG4m_!Z;c=vBuT zE~zf%Mlyq$fx)`h#oPDduBm!lTe=WE=uI8I%vw&?IR1!7hP8_G_?B1YgHqi#tC_d& zPd|44IRmIhzc;v6uq*^A>+)VYkCh@&G(10IK)YK=fDF2A8x`972^TS~Hd>~{K+480 zpqIX_TX#_6A0j3R;E*Izvc?i9Q<;DBOK|5aZ3+x7?a|?9@I+SB`kOQLUdch{itHJX znn(Y~x(`t;06SQ~l2Wp?#swSOtErXR>6|rLJbjaQ?b}V?IN<47IBt~+!uG}J-j~`~ z?+VX2)}5bjGOI_r>@e88z&PZDJ>#sg%gdql$UB;NDyDFdpbj8jkk zG2|8uw&gScA-%XeR_uIwl6D&9Hp@`cKTi;{Lsv*__%N;*&)BWSFW_{E_Nl@^Lg!PF zJaos1x5opg6BnMTca7;pi&l3Fhdw?A&(}zwuRfFAHtB!01#=T??&~|Srxh+uCg6Zo z2S9nQ|CGRCA%zT7rbS$)Q+vaDT#&7hkh18If$gFcGrZMO??b$?NqrAd7|;>3?I$q} zOZRzw*GWjqNBLA)Fa{YELDk=d0f-dpGqyI;rpjwykl8Sd!MR>{LvDhc@k%DmW@A2BJQIo<=h3> z?VLAW3;!?lWJXBO;Dz+G83!@Tvvx*pKmp``r#sWuFN9tF85IJARFZY~pVn_8SNVR; zNBJ%5zQ@=Ej#wTGBSup5z*l_4^q^vt(?mw;k|Xvni(?8bbT31YvsnHNdspX4S%$}| zwN1$huoJ~^>U^<$=)Oz+_mc)31i;~^dy^ikmGfAM&CB9)>7Q~oPcT-9{5J`l#u5qB z(?cWxQ#5m!AAmPfblQgX^_`AGk=-&hqHb(Nn=eNKUm3g#HXIp6LiR zwuW4PE`z9j>F(+t+cAxINIA&O*6&P{ZT0@{ET&M_=GtAmvq-=JKc~Hdx-JcK7L9bX zy}i1kj1Xk_DawW|j*oG_b-!X>s@|u*+R0=;TB$bkCcCl)Xf^}!Xtd&GlD{I9D65 z^`!9-m%z)*V8lkraBLuk3U$5ZOW}r*;Y?~116$un3A*ItS#O|8=f$QrrxnNETveHp zQe0bgiqER!IXch)nmgh~U~pr_8aA1p9#2E~J+XSpExxy_J4;XrA?GxQd1Rk>FXGXxOp8!=jn>LJxIdD7g6m< zPQ2uhK|Vz8=8TOTxB!Ly2OtUFkGT)kXYeExk-U*BT;Ws@T`oSwTq~f5Xo2fL71)%z z*lkc*Jy!Af>Cv`-@|WxWD`{zMX#qR?3KN@;72ctxF=K^fCK0hd@VAclKhRdH zzw0!fC#q?Bqz+sYeN7HTZeYvlAlnj~agf*UH*b99rOHVU?$GA^&0Fv_Wdf;ZrJizr%RpU+15j_Tu@SS* z2)N(|VTC$5y86@Cxq!D^1du%764UumV0T9VAh+h>BtuDUlh8nqI5x!~h7^G^{(yX- z`Llh3gbx#|5Y2!h%NdxPEqMO0IGiVb;n{~HvDi}7^*eZ*7E;IsWq@m0&NVSM(*DeF z5gY#4+W=<-mx+~?XNHkM$*ffV--ZB4j;+YJ*>xRd;w}(S7d$1NIF<&e6Ub;JIf2s) z3b^nu6+0lfj47e368rZOFMS09^c){z)eWya2BqNsQQ7|!$!=t8YfF{FKUU){AgJh{)Ri@nQv1}W$E>@&Tb{A784Pwrf_ zuS<|M$oHNXOaeBr?)>F{?M1}r^FqkE%Kv&QNyMfkjXb-Fawg25oj#*^9RK^`=6PCh zdg*rJ9b%Lbj6u7WDt{J}-W#mn$M;9=|CzYKa-#=>0fheQJ|O)2FXbP9t;b;M({6EU zg`1x3;#qR==j+m~ z>hQV+=#RxmA^zVb=;^MY(#XXG>gG-gyu8ALx!l|tyoe#KB6q*5{1L+YCX3_S_NNnP z&3AGrZN%XYnf>Wal+@AY%XHw5#*Dsmp~JG#t@8)NH<@8~*yzA*LBR@Cw{LIzw@7^x ze9wiarG}a+Y+>}C45qHXEZGh0CGbTe7CLexKC))i#Pv!F z`Rf?cko69ZLKD)^1mY@+;~AQ*-dc!{iA=Cq_g+=>j15!ECe(x-;n zn6$RqTc(@{_#i9X&?9dcL^L&L>~}!hgs6+GKrXcu`GN?twY62{hSq_7o4z4waBfJ- zW6M~$K zx^37@5?Bv#X{7*Oh(scRU%fGixIL|M [Policy CSP](policy-configuration-service-provider.md) -

      Added the following new policies for Windows 10, next major update:

      +

      Added the following new policies for Windows 10, version 1803:

      • Display/DisablePerProcessDpiForApps
      • Display/EnablePerProcessDpi
        • diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index d4124e950a..229109756e 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -65,9 +65,9 @@ ms.date: 01/30/2018 -Added in Windows 10, next major update. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device. +Added in Windows 10, version 1803. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device. -This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. In next major update, the MDM policies in Policy CSP will behave as described if this policy value is set 1. +This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index d05d2cedb0..1a7ca48cee 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -237,7 +237,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. +Added in Windows 10, version 1803. This policy allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. After the max delay is reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from peers. Note that a download that is waiting for peer sources, will appear to be stuck for the end user. The recommended value is 1 hour (3600). @@ -282,7 +282,7 @@ After the max delay is reached, the download will resume using HTTP, either down -Added in Windows 10, next major update. This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. +Added in Windows 10, version 1803. This policy allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. After the max delay has reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from Peers. @@ -447,7 +447,7 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this -Added in Windows 10, next major update. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix +Added in Windows 10, version 1803. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix When set, the Group ID will be assigned automatically from the selected source. @@ -1050,7 +1050,7 @@ The default value is 20. -Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads. +Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads. Note that downloads from LAN peers will not be throttled even when this policy is set. @@ -1106,7 +1106,7 @@ This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryo -Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. +Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. Note that downloads from LAN peers will not be throttled even when this policy is set. @@ -1151,7 +1151,7 @@ Note that downloads from LAN peers will not be throttled even when this policy i -Added in Windows 10, next major update. Set this policy to restrict peer selection via selected option. +Added in Windows 10, version 1803. Set this policy to restrict peer selection via selected option. Options available are: 1=Subnet mask (more options will be added in a future release). Option 1 (Subnet mask) applies to both Download Mode LAN (1) and Group (2). @@ -1203,7 +1203,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. +Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. Note that downloads from LAN peers will not be throttled even when this policy is set. @@ -1256,7 +1256,7 @@ This policy allows an IT Admin to define the following: -Added in Windows 10, next major update. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. +Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. Note that downloads from LAN peers will not be throttled even when this policy is set. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 6606c038b3..933c3fa2e8 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -81,7 +81,7 @@ ms.date: 01/30/2018 -Added in Windows 10, next major update. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. +Added in Windows 10, version 1803. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. @@ -125,7 +125,7 @@ Added in Windows 10, next major update. List of exceptions to the blocked websit -Added in Windows 10, next major update. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. +Added in Windows 10, version 1803. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. @@ -169,7 +169,7 @@ Added in Windows 10, next major update. List of blocked website URLs (with wildc -Added in Windows 10, next major update. Configures the default URL kiosk browsers to navigate on launch and restart. +Added in Windows 10, version 1803. Configures the default URL kiosk browsers to navigate on launch and restart. @@ -213,7 +213,7 @@ Added in Windows 10, next major update. Configures the default URL kiosk browser -Added in Windows 10, next major update. Enable/disable kiosk browser's home button. +Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. @@ -257,7 +257,7 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's home butt -Added in Windows 10, next major update. Enable/disable kiosk browser's navigation buttons (forward/back). +Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation buttons (forward/back). @@ -301,7 +301,7 @@ Added in Windows 10, next major update. Enable/disable kiosk browser's navigatio -Added in Windows 10, next major update. Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. +Added in Windows 10, version 1803. Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 616c8eb992..3081faa8a5 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -154,7 +154,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow.. +Added in Windows 10, version 1803. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow.. @@ -585,7 +585,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. Don't search the web or display web results in Search. +Added in Windows 10, version 1803. Don't search the web or display web results in Search. This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search. If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index fa48adfe0d..dd8bc02aab 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -408,7 +408,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. Configures the use of passwords for Windows features. +Added in Windows 10, version 1803. Configures the use of passwords for Windows features. > [!Note] > This policy is only supported in Windows 10 S. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index f45d4b3ddc..c0cc5dd7cf 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -853,7 +853,7 @@ ADMX Info: -Added in Windows 10, next major update. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations. +Added in Windows 10, version 1803. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations. diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 7071a57f68..97ddbf6bd4 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -80,7 +80,7 @@ ms.date: 01/30/2018 -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. @@ -123,7 +123,7 @@ Added in Windows 10, next major update. This setting determines whether the serv -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. @@ -166,7 +166,7 @@ Added in Windows 10, next major update. This setting determines whether the serv -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. @@ -209,7 +209,7 @@ Added in Windows 10, next major update. This setting determines whether the serv -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. @@ -252,7 +252,7 @@ Added in Windows 10, next major update. This setting determines whether the serv -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. @@ -295,7 +295,7 @@ Added in Windows 10, next major update. This setting determines whether the serv -Added in Windows 10, next major update. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. +Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index e55edde857..88a19a26c4 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -65,7 +65,7 @@ ms.date: 01/30/2018 -Added in Windows 10, next major update. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. +Added in Windows 10, version 1803. This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index ef51165474..18075100b2 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -627,7 +627,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. This policy allows the IT admin to enable the touch keyboard to automatically show up when the device is in the desktop mode. +Added in Windows 10, version 1803. This policy allows the IT admin to enable the touch keyboard to automatically show up when the device is in the desktop mode. The touch keyboard is enabled in both the tablet and desktop mode. In the tablet mode, when you touch a textbox, the touch keyboard automatically shows up. But in the desktop mode, by default, the touch keyboard does not automatically show up when you touch a textbox. The user must click the system tray to enable the touch keyboard. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 47a34b96dd..d8a6cbbf3c 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -821,7 +821,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. +Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 65c25b116e..56be2210b2 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -832,7 +832,7 @@ The following list shows the supported values: -Added in Windows 10, next major update. Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. +Added in Windows 10, version 1803. Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. @@ -882,7 +882,7 @@ Valid values: -Added in Windows 10, next major update. Use this policy to hide the Secure boot area in the Windows Defender Security Center. +Added in Windows 10, version 1803. Use this policy to hide the Secure boot area in the Windows Defender Security Center. @@ -932,7 +932,7 @@ Valid values: -Added in Windows 10, next major update. Use this policy to hide the Security processor (TPM) troubleshooting area in the Windows Defender Security Center. +Added in Windows 10, version 1803. Use this policy to hide the Security processor (TPM) troubleshooting area in the Windows Defender Security Center. diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index 5f2c4def03..27677b6c69 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -49,16 +49,16 @@ Supported operation is Exec. Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command. **AutomaticRedeployment** -Added in Windows 10, next major update. Node for the Automatic Redeployment operation. +Added in Windows 10, version 1803. Node for the Automatic Redeployment operation. **AutomaticRedeployment/doAutomaticRedeployment** -Added in Windows 10, next major update. Exec on this node triggers Automatic Redeployment operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. +Added in Windows 10, version 1803. Exec on this node triggers Automatic Redeployment operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. **AutomaticRedeployment/LastError** -Added in Windows 10, next major update. Error value, if any, associated with Automatic Redeployment operation (typically an HRESULT). +Added in Windows 10, version 1803. Error value, if any, associated with Automatic Redeployment operation (typically an HRESULT). **AutomaticRedeployment/Status** -Added in Windows 10, next major update. Status value indicating current state of an Automatic Redeployment operation. +Added in Windows 10, version 1803. Status value indicating current state of an Automatic Redeployment operation. Supported values: diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 7d411543b5..215cc85669 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -17,7 +17,7 @@ This topic shows the OMA DM device description framework (DDF) for the **RemoteW Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the DDF for Windows 10, next major update. +The XML below is the DDF for Windows 10, version 1803. ``` syntax diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index 0b6de467ab..d2a2fc6fef 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -15,7 +15,7 @@ ms.date: 02/01/2018 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. This CSP was added in Windows 10, next major update. +The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. This CSP was added in Windows 10, version 1803. The following diagram shows the UEFI CSP in tree format. diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 01af9b2577..5e471e50ba 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -76,7 +76,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **FailedUpdates/*Failed Update Guid*/RevisionNumber** -

        Added in the next major update of Windows 10. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in the Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. @@ -91,7 +91,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **InstalledUpdates/*Installed Update Guid*/RevisionNumber** -

        Added in the next major update of Windows 10. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. @@ -135,7 +135,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/RevisionNumber** -

        Added in the next major update of Windows 10. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. From 16760cda84bff00f447ace196ddd4c0ea254a6df Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 26 Feb 2018 22:10:49 +0000 Subject: [PATCH 037/119] Merged PR 6025: Fix broken link --- .../configure-windows-diagnostic-data-in-your-organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md b/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md index 6a85eb7c57..9529995ecb 100644 --- a/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/configuration/configure-windows-diagnostic-data-in-your-organization.md @@ -278,7 +278,7 @@ Windows Analytics Device Health reports are powered by diagnostic data not inclu In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic. -- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/eventname) topic. +- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic. - **Some crash dump types.** All crash dump types, except for heap and full dumps. From d7d58fde4318847339211dff37a4a6e2efa5167d Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 26 Feb 2018 22:35:35 +0000 Subject: [PATCH 038/119] Merged PR 6028: Update CSP - added new settings --- .../mdm/images/provisioning-csp-update.png | Bin 29242 -> 35583 bytes ...ew-in-windows-mdm-enrollment-management.md | 10 + windows/client-management/mdm/update-csp.md | 40 +- .../client-management/mdm/update-ddf-file.md | 1133 +++++++++-------- 4 files changed, 673 insertions(+), 510 deletions(-) diff --git a/windows/client-management/mdm/images/provisioning-csp-update.png b/windows/client-management/mdm/images/provisioning-csp-update.png index d98b7fcea15edef9a182955137855564d588f107..e88466a1138353c125d9ab5a122c4116491e6580 100644 GIT binary patch literal 35583 zcmcG02Q-{fxAsVrkPtyc7=#2Ni0DR%5+!b-(+s`)4gH$~)&h=e&FGv!7=_`}LER7QKaa9}5D3+!7ZPmWMztX+t2F zQP(el-|X&6KLY<@*vpFwLh`yuSHKTfj0L0wAdtdf>{H#V;O84QVrupf2u=g~3!~XO z!vF&D4-*#_P;}N>uO7FDHor;F409DsPUkHY0|K!qpn^bNOJzYf zCo9Xoe&yuiWt7hiQu_P=UxCdwC9gxP#_b@l;vEDct9l1TTgB;UwQaC|m>>gRCmo~P z9ys?c-8{kWqhKQS6r9N52jI58B4NhKxyuPG2z7>0vT_3=N%WK+so_chO z`k^mMPwu(3Fn@epQIQJm-y=iMrLI9AR9)tO2g!}OK8^<8P53cEV*I}HzaG0Utbx2-uK5Q0ml&H0R)hv_N&WsAE_qrBR+ z{QMLbZpJngD<8E!F|V&Mkorty(A+fDF_Mm0nhD&ua%5K;EWEa1Z z&@%z{vt{IPB`E0D1>!Q~`MJyUjxl}Y%K-jj=BJv8B*c4H7cKAkQX)&jOHua%pZ3KL zhLbMM#&b!TYPEK-TWcK33|c=qX%cNHaK8efy^H%nO`~IS$YP4qZtzQLGRb!d%xUA& z-f(t7ZJl>|NaNt0t{+ypF=aL-l1%-0uo~O>QEY9mOe-!3WIh2iPb=2LZT^KhyY;;z zEoRoBfp_~Ny(Qk~*PiXhJ&DT`&vji$`|kEB@;YOmx>W7N>#pQ0@g`nf z?BSVrlXhDtJ`%T{UF+u$=?%9?ZrkHl@4%ybvod$Hl)=z7TdDVRVH@fLG;!=g7U=^_ z53AvFX#X6{w^Y5@JUEk{o5{m_Ll6r}rHGeX zk-B;_|B9J-S&Cs@AiM;d>P@C+GRDI(xh9e-FNUDA;Z&#^>=J|^02A1{=g#uZkVV3M z4MnYi7#S0BjiXWX=BJukuqKg=8y(sF4OwBeN&BAR%=$)g&UJTJgecWrh6Hg070Z*sAaicwn$BQPjjxMc+DY zSwnA|++&%w&N)+e)wc={q6^Z|8PcMtuNU*y5fKps449DD6I5O* zU86e+`8Tc0sCS+FriB(C9g#k$rN@LM*@(gNa&qD_5bE}>PZndCf?HRvWAb~L>*`L` zP6GG5J}|v}c-+=eNnUFpwU&BTWpn7~m&tq=0fBrM9F_ZdH0r0~<7FYWks6QU{JFg1 z7iw;9zIqopg1`sV*P0qWm(nKk=NpQRS#lY+hK4UDK@6qE34vZEAt51ROn|8${RC!K zyy)8Jo^bSYrcP!$CMv7Y40r;q57fhIx<(VmLQQ(qP6cbc)Dm-il0d$B(r&qVHs9<< zUfOm-wk6}Q;+x3lU?yXDN-*tn86saw-1qKBc_NxbRhzF4Ro@3r?WY^?j% zY$CyuQJVEsRe4QKo)smC0-=hq#Rz=u>AP_Elg77Wm=MS^>j)kM^6eTh49JL%CYH3!T4(4i<4M0JBtpB9bTJ9>~b?`+s+i<7_o*=74EjI6L^VeGi2f z&3#MxkLXICr|G%b?^Q(Y)aTiVWoPF)QQHb^f*=*DqN2i|?QslFfShRF;lE+_mCA?Bnqt2r>}sFC1bcURRd#p> zEH?|u{3qNz<>IZeH_2v;bz+MhV^)l}7C_PyA;#pNEp%q(@y-b=+m9BPKV7%W8qE6b z(c53)lBFqMggiK0=T;vLBGjQwV}2DRLugk@meF=%oick##n@$mT}EZPf?ZRBOi8aU z5brl{PVmY96{PswyR$ZnpZlH@5eZqlXhUzpJM&>}j;Uq~dmjx%H`hWcpj5Zqcw^0n z61+Fnu7bnFHNCNN;a1cb*S;F9*v5@IvEQl=U_C5!9n~~_b2qxq?o*bOu z=K&N(c3wjT{M`@rwXkptoWr%e=LbUsGDR3d*_i#ro=sS%vD=@JXecx%GrK5?z=1?gFW>+dsAzVe1j9>qwdcIi(P)cS%0D6?B|fft4{-T2W#Pz%DS)> zXJ4tM!x6li5JHHn-x@sbuxe}!reylz`0NOylE;_Xu+(je3|?gry4#JIWx10WcH9Ah zR0Q|KUukKPL17kBjX_j_&v>Uf#7iPPM+z7CV!K+$w%iUjGG%ZeN$s4L&HS&bPdAn& zhMr8&ro0P~#~l~h7)UoSOmUGYM;%tqS$A}Lr0{V;UNg>>KxxvOop3CXMl;ulqoQ}x z&utn4J}ykOEPr#TX4I}2`VJp?xc-qgnk4ha@T#|bg%%s$qX&;;f%|50Ov>B{H%zTP zt1l0UUR;mzys-jpYD(H%U3y8JRTYu+sRHtp>ge%aD+a_NdUn)y_mn}m+4w+n zilcnMNIEe7e6+4PM~#!$E zkd;Uga)mNw!UG%i8LK)%4#RV$$IA2@aMpEG$Ke`KaJ8C6#&j$5!BKmNUI?YMpL*ceq49YGOh?h&A2EMKB(*=pwplw2Op=rYi z@sLR?W#eh>D(=(Wa$;K*2*mYGKfG$cb5PsM;z_!^{az&@OYC< zs_xLL^xBV;CxH(blqk#CVE09l)X!ETKTdsiIubaG_P=kh%75RoPxg!+>rN%%jiVg6 zo};6ZhaCi>*<=dCQa{(^y0JB=M|f;%L#xty!g*wi16gLy8{gWPtZZ&ZsM^~G)FCv3 zRc8adYks@M8l1r0!*FpjSmP*&3tph_v{N~kuN_^T%EthCo$wmEFzp2V)XimC++3d8 zrG>tM|NIp7{x}0{+f{g2PJX_OWKcElb{TN$<5+Dk9*TjMM80dUr`|yc^{{FHOxh}> z0%)v0CPjR+*xqE#Z*_Tr|CJ&+F66m&9pakP=2U!CmY<7Sj(X#j$-Yh6ZgJ15gPGjg z3)q%+HqXVD^`UiewQCXF-Oe@6x&Z?nh463hY$L7n{BNkIs>>(%Hr$OnOx;J}}dfV3#dqdr-B7!zXx2CGykgaXjh_f?=6Y?S>@mXi|8D%pcJ}R-QhCz#-okJ^v zm)!wzjtP!4PA`l~_u(hP`^E*_)VaXcQTpLG0JOYcer?L-QGRvvM8o|n5tY(PA)V4j^HBh&P9fN_wDD* zV9QgA|F|TNPNzq7v0F`zvuMYU@X11cE7f9DrR4w`vzx_Dl?gLUiIXZ4ZlNTceU8-seDQW7oll8y3lQzzeS z{8f4Lu_=2>F(<<8rByuv1_k3pm9kz)EQm#up2>mMBD zW9BzX$a1-K$k7zm(-t+DJfNlboeK9Iur!_B)@c77EF>^!>A^$Xf@ZwbCGVOF7P44{Bge4i)?v(pk=h9hf_=)fQLo&&&DJz|tj5OQ34Z3nFa?oo0 zTCeuE&-&blPMTUGP0{y1e$Z=a^TNnld~Mj-kC++N5^uEdL-w735ikiRt!nmcvX`$f zy#-!_iEp<)5^|b8xr9hK9*Nm|_FdI+CI8j}oYkq_?0h0#Il);hwk>5;8z!OJ>>y+S zP4Ti;301hA8MIubWq_My)b^TW*Mh8X(A`BkaQAqa3fvfq-xVs|91e7@67A z7L?0eOEFQ+xjb(ezYPW}ADI75(hTHQrcXhrRpvrAh4Xb@u3%kj;OSEcc1L zOA7AAzP-^RVQ+80>UV{fVg&ELTy7BZWRA3Hwn>8ZBBnj8vz>%|+v#13p2j`FNM9wc zKsBqpODT;g+Vx}xnNX3zB;&b{Q{g!gRcVq4*22>5&|V+2n;liGqfccI7bB<5ruetA zNjR)Bny)9l))6&n1nv*=sG-K;mw_(Yk60sUx^#?&jgCs}9L0*g<3@${n#{WxR*iAH z*EW4Z;xp`4u2thR*a;X#Q4uMI&Q7MHR=P7n9>-3<@g^l_HDcyf!bS#jy$ zDaCwhbd#8>l!$`oJB;)L)LCU6j8zj~DCipgP5JQDpwSOi-MUbHi!n&4pXD0$2}gQs zyEPvShetjB#}f22K%ORzF{h8RX%b;SKd_xSKD3iBjR?QhZXa8J>+3l2>29vKx69s5 z3<7-A^;n8DF6L3Ser+1P8o`Mwp0dXiuPaHmtTPL@`T@{h#kfREJ%YzBAZZ_JY`*TX z$IRTc)=1sW>SHU=m_b>8J*X0ltoN6&BYO5?^eq(XrGPX#poFt z8Uk8wnD5w+jpWYkQZz0(pZsXEHvE0xYv^aSq2XbWR@#C5@d>40xRZ!BC$H!Bcr5fJ zI~n4E2@^D*sBp}N8=-_9ch^IRKoaN3C37*%agmRE5umiJs0HH zEz%m!MyDi57}$}IS5enxtqQ1~-%VTE@L&3Q!DlD6e)%~V6r%Qn>k2K$2p$DCk1u2a zzQ5cLa*%r-Y@!Q|7R4w8XE~7-`aCj#Te#mJ8*Ut6Gc8DotwU_Q24la5PTqt&VE$UhvQa?_3_ZD1E0m8j zPH;8XaFH<83(t%)<<7T;Dv+ue!O5p_auM@uo(se3qm3A>0|LLKJ6WzM~u;|Kk`gudteFajJd zeH`+1{m7BtDnonNBK_Z?&70pub7?co_z*p4FAwQ`W4hNQZ{aJ|hvWCDJS4^@S1Y6T zLQy&NStSc+lBb6jm2tApY|HNp_~@MLC#Vn7I9Z*vI0czjJE;XM`p>dHxlV#!n>h3W4)jJ z6TiXb?~OURtx9Bhcf$YW6_lt$@x5gbwNr1qY#wTi z^x^?a;v&E12tdar4fqcANkkUCe zHa0suJHP8ZsPBM!x*~N-!UqZ&O+h4UYip}J0D)nSFze~-&#iJ4r#H)N92pFwj}+~^ z2i2|ZLNYa8vnt_R3fR~?tM4!%%UmOJg%uU*Cso@gGM+~rzPK7YY%3m(=}!+=G(b*S z7^aeV8}b~t4)F=ZuI?uOGl1K3xng!XKw3V#+jwIOmuQa*1G0;SqOI+rP5Xi7`_ha) z`F`j&M0FUu6W@Wj-h}7KNC)pIHSsI~Xuk~@mDT=BkmVZySTqH#VM?EM#UR`gCwKNv zb}lRHnwf>4?6p~C7sNYMHAowS0DLL{hb%vm9=Fxk*S9#`wZ|kYT%7F)`IK#L`moB9 z$|)IZeS~?c6geeqXWgt#>gqnblXX1upHTaHDj@@52ZG^XbcK{0W_Pfm`3n{kr>{E$ zY86l~4Kd#1;zr&&%~CsS!I*g-_WuAz@Y54pd4gF6{K2&$gKX3B*6^}m9LB8Qz?;@J zmV_7@g)@%0HrNLX3=)_g><)jXxH6V>+V$hP>Xeoi@suZEIgaPSge136oWR5C5f@t* zXUE?^XIn0Ywi(Bt2_PQAUV2Lo4_Nu*HCT3Y2+Vxzc%?&BJ)xqx11AU%CouHQ(tU>$ zib)ESXp{Zoz=r9>2=-r3FDvagGUkEdAf|7_QDP!8@vBwP215m2JIQ-e&OX)yrMY)! z7_5istY-YBilN!P>Xhv;W zj#{lavilvtxp_Ph*uw~U&SW!&u(zK+-8duxREjivaY|W+nU3gAfQx#`aJZK5))%eA zX9~wp>^=?a7OX+HNz$C6p8XKUq`9ROfXdQ`Pk3!}NJvPmhF%7gg!DKX6VaGA=c;{; ze>ft?_1L+eQ^C|kv~c}D!R7NY<`pGlSKrplIBTLrQLKvPT7g(8hUVj3n!L!S={3k} zt(g+&RpV}%>StAxF&`udrV+}zTlK;Akmtd+lL&fxdYY`1p;xbx!|D(+>t4$a>kqL- zf&J!<%l-5fg@ zhoOjvGz3z83HFkmot^O&&jBbYCX8KtWP^ozzHq;*H~8T`MiP@w^9Sq2{Di!CcaRoy z7S-Y%T*UVhH5%7pD?yftMtXHDE!P3dj2NVANauHUn*Ra{3{zYsNY$gGH%kepXIj6Y z@*l=78(Ao!!nke83F#3n(7yzdEl^*KiH(JEu<&y6YUP~H{Un+_|8Swca1{J?d^RBf zmd^*Ol;>~$|3c>FLg?mHb>&UzdZv1Bkjb`WVo_S`|gmq>M9KDYr0g|<)Av(pfdCnm+QJfe`NMbe*>E~KCTm$ZZ_~^CD}r`#`iQnIgY}VWw}XMpS7apt zHL;unRZ&(3rI*~5d;{>{SUjw2v`^7nH-zx|>UuQU8<|s{FJY==_of>_ zUsFLs*Hm`8%Fg=t#WYIe52aX5J-*PRVKhA&Mz`5$GAx3Gnk+kh@kHfw51>bS)nG$i zfoGs#J~S~LU&6>09x;tiZAvwRB4!TmKE`QV*vsXc=VfSn*E)VPMi1$v^?eNV&8==O28Ce>29QM^_nfi8-hREc>S*Rw@ zs;qkViZQ`tOl0)4MT%I4%)Rzudh>;qcPn~RWG-8)NVPrLO9Z!p&Fsgk9cxeVGFi!; zjP8%ylY0$O!H$dJ1S=0#(#3A3eKYXrRvN?VCJ;A(7AJm9Je|tfi#9cPiO3Kf(N*s@ zD(AD)XfV~sxnpl^6QD@5=%((XRcq($)rUDcc?#?r6a(aOA3evYLp+*a?c8L1b)kS+ zWRorrv+Q)$d|9tDmnxR*GC`n9OW4VnAVyj1BhP%|cO*`|fYN1ixhtjq=6#%a&-~WL*lRU&ZCgqB?54+O+*zd2S<8>7#it+#v2?PL32ygHH?jM3upIszUF)^ z5%X7;$lR$xLtvy}17fTHi`vu7rQMJK?k2;uATIx^=WAUiDQwr$G}TuvdsiJePGruF zOf&WQ9k6@c3aD6Ikp z%YG&G?o8vrGb#$p4)v!)*i2x{&`iRXY+r8`GHtZH$}5IjQT+MuAISPtv1&Q8tfY921$4ILa$xCoDLH%>xv z8?+S^WM})eRaI|asLOX>`3+jX+MLPEa=F_sXZ;1B04TPhG36!rA2>UL_Z!6m;Pwl= z{@WJ_Vy=I^>8%W1qI?YxF2kvL*r>~Wwvj0F(+Cu1@f1kuPqs5KkHQl?$rQU;M zxbXL=g?OKlL$s9b|!qp`sgn-zQ;e{SwJ=a8zrjoh7YEhAIm9mElX|EXd@bb!)u%Q38^j8bKhytM^{Fr6Zmb8jL8EpK#fto z*oK^nkTB-4WHPjxBm2z~&zJAnt=#rhDW35eMnbT$@uM5RZ|<$xy!723PMi~8tz?XlWN4VWkct3;2J#o3tJA1jO7^kV=ynNT>025K zHeSW$(7~}@jVCc{Vp4I>-dy@ZQGI7Ras&?x0=D$+?O10V?Rht4p{vwY0zohQWe4gI zvXEa)fj;VES(pW?_*;@Xy_Z_Fp6I$T*PoePMP(qe7Lsb$Zaj0&&5EO;7xpf6$_<~C zj|RdMt-+XgE7pGqg|HDss=%M`bwoMd{f4y|unOWoSbU_n^UnkNhOoN!3-$f;gXT7A zmdO$YRL&#s7Psc}EL8B)z^UEianFkk}H@5l4)S><7Nx9oBYNIWWr`mYC`Q*GW#@jyZn?~J< zQuIi2Pmh*!i7m1P@tA&q^v?sU&zsw+m>FxmIPYFMciq%hE4G<>_LOCbt0)tw2im5N z^VMMYwI@3q|BV0j5Fa|lk$;RMQIN8qoBJ$xRIbs@n?7{y#lt^-N3_0N&M=BdxG%Jh ztbq?uV(-w4{jnIth@30qK@lBX(_O~8{D_cY4xgN7ov%A-=JHM^yEzDeW zrT7rm{gc=1N7oPRP%UJ%|0lhinEh+WA`P-V6m9hyQJZi;`{~s`9|*Np1_plpUn#MF z+iF3CbGAc$jj{*PY`KvF?r;Td3euytAm(+H%2EIZZ@?Gx3z`i4tN_3A+8xLv0SouP z7GTrS+K9q}f+SB-VuCk7+PF6(kcl?<ktd-)G282f`OnS51UPpcN* zFf^FK9u_{84jrtJlJ@D}u(aSsX}Ue)8;h#^8>op3#1W4{ zhV&(kqSvr}td%>^=Y#Z%e52v9AM*v3YodQPUA-)YiIOXlIi}c+K0nX7>~KA)(0K8!#~o61u%^4x>ZS*IqE2dle$nEYX&iKgX1{EAjy&*=OSBE8#baxOy` z#@F+)8GqdDitzyMBSq}Cfr|{~ZFjj&5lz2~AY7sRdrER&k~xl&2R7s^uu6=mT_YEl z>t`IXf2}&|-79YANsf!9mlIbdSv+td7?tAxBQdub~Gk$a2&qpw^7w`?h)1){OJ5+3!s~{l}ZXC}Nkwx%DrJ z$CYl8jTeue-6&dvS7~cceTn4M7kx~se~!SKpV-*?vDWaJ{yvcpeRreTgV_ufnPLCW zQMdCGOFPJ)rTqTQs6SdSUGtUDh%ePJJvkj_OIJz2qB3y56JC_UeyG+%ut{V8t9 zo?>xv{ayr#R3O?Ulrtl(9by^&@~J(sO4djM#;hvGRBCDBX)Im*++4#anYZ)(R=U{N zmxFEKc`EQg#))8+TQEUvkac8} z&Y1E{v?D(tf&#Csnw%syi6ncBkD(nqJ*l{U6FLFF2s38iF5~+)8l}_I8)v}U=T$mT_2c}O^->R0EEQb(gF2=6(D0`Pk zp0O-w!=?aX?{I)$WH9tI+Oqjgn-Qr8E7j12;M%eyD(oqlo@~C3#KPc;p|%F?+ev2` zp1Ts4CxDag;-ge^2&~qZ+m%i^>I&pCN3c$5!k4YHr|;#pjj=iaLWz;O>z~n2Q&M+LxNx+jeiuONSJ zP*MsH%(=rUZ6BZZ@G%`y-~Z)pxyRpR6MsA%-#zN!lxv&I@o9HS4V6F8^ zy)P9O6(#dkrF|^z)tp~HdH*F@($ZWsJUChZlIi0Y6!a2$r41!_FXhv?Afi_9xDGYn z$=-zglUDWLVA20c1>0-@7_|uA0jA)$8*|e(dw_P|B}AFnuMOn_7}jJK-dor}2@tQa zEB=L#in%_3M!gRqyF{paV4Bakc=_Cq->LYN@dJpqescbHmv6SKmix4%C-v|N(8{Fq zkw9Kg0m0k!)T`qXxC0un6;Yr0A3l*D;xod#0r9|qy<8+(LMZO@0vYVk6{%yAEx!*h z<~#X4v-xNM#rOug1|%T7%Fsn6Gd?Q5NPq(w&R_6CUc&*!2sSL-PXVp9iwP6=L`z%; zS<*S!*$0fTL3%u1mCb#jCz>YqsEa|IB>ZO8k41|AYFgoaTR1EW2Z^WKpgge30?1K5 z>2b93BGJ$}eXOWNT~ZWv&pOs{Ww}cx3k~CC*4cjraP}j$#=10N{$T_B9)K}*t`oFY0 zC$o~<%ujs4?MkweTac71B<9_c99}yxToe&`XVypWse5)FUx$%zq?pWxi$!(A`z&@= zJg>^b!A6d-E2x9jTC_Lzo@HN)0=MM-=h#Gql@A15>|I=zTQluLf0MpIhj!ljNVgd= z@8xmOo<4O!Vt&_(Isz($Y_ap2ihSGaj{nfAaz(xVv&}f4oUE>n5##MZt&QwF7nlfD zBy_c2V%cV=*HxU@xb2oHUoGeEVdIk0-falPffzM{0rTnVnG$-L4|FIB3j(uESSdG{ zvhEI+ty3N!z;n0nPUXZ<9b9|j)DIg7c8vLhlGP~la!&whR;eqCDA|7KkS=~oxHw5V*}4xac@5CSyZZIRQH?SV zth%C7_k0R(PCKtF_W^{B6UbBFP<#LYY23v(7d^LY$qC$mhQDX}#R z(L`E^dM01~GlunLvBH#zpVO3W!h~VgiuOQl1>LL^A^{oof!e)>w^_ngm07HoY{ zPi!v8F4^!pEl{2Usb$>EnOU8}O_+c8f~w;oaI4={qY=67&eOq$#9I|KEmgm&_CRy5 z9ch)(eFKuDq9f`Z^_D*uVQ{h~+7|>$60Sx2TV))Pesec|zm42Sgy>+rHI#ogZ90dvIogkx)c{C;ttY-RtFWFggtnup@~pF2ijC5*OS4_s-9UBd z1<26C?h}S}P-+JfUG@KwWbD6Jo$WRuK*s`riva-vt7YHbxJ^{KDDYffeFLF|qUqdm z1c%i`)M1rtg{v7@9MBD^)r!Y`4F$B%2je7l5yN(A&{syH4m(ek3S|$`iqh7Q+x+z*`k{$iG+duq z(cJGXm?uyPp5bq*7C(5P+{m8*;-HqAn%sYo;c*&YOD_hjb6h@tZ2aALfsbyySV0qC zzes33=ucC}`OGt1wNQ!&rY<0Ifa>HP1cTr%T8U=f48k_3v{^}cxpaN&m_Uoi3fHNh zJ=M&Y8P2Ikq`L7sJ&h+tKWVGUiZ2NdUh4t5k_bRipsWCBF(9}xQfF0e|J^lpdwPlo ztwAdfk*nm<{q~qmq2KIGnbKD!-&YN-g%uOawd3bYK;YPc1_!_j?A=4FR=_k&n$4$Q zo$WPCjejXGG0LHkf;o=2#P{4jhU15HWuQv2@G;}$S=c%Utzx?VF6ZA+*Uc4h?+4Tfmk8XZd3Sv{M{qDul zlHG1Y)8AJS%h3vYB!JOoCOrHl!~!c*h34}({lGIHGG~e@Y!nogY_@BittJdi12V3M zbJfeCYY+CuWFPLniR(P8hrOfP5hy=*?QvGRw{QBS^b?HvQ__f-erDvyG5h0!YC$G} zh2KQ_U**}Ll>~ldB5y74{%ZZD3mWfBXwf8$=5FKJiWq1SU|T?vOsdu>4iJ!wi)jen zk`xsc>TY%JuVDU8|Hh9`$oTzug4?Br7v^;X(z`7J>YF4fpZ%2soGxvd7>lo!&k%Q- zOA_0E?2Pzv>`_36>3bh1?eft=2$YD)>&suUS@{wF*~xUr@~8GV#JF5neO=CaXUk`2 z!G)I0SFxkjBmSSlgI4%BvufjRmP&C54>7|E=Lv+#3;d~_UHq3#epBj>a!poaQSTZj z9#1Sjn&CTKx)s|_|H-%S+Gt^w%kB|`YXcF4^S5+5|)%VK`I)Az|bKrNkRMwIOHvW}>jq18t0G}Nmh zW^YXFDO-T0z5sp~s-9Rtm(^oU`WEhsSpo@qM@4Np?{U}92_SD4vo!Clj;XtD*sV)1 zrDDp)mLlv#0e!c| zIyR)1W60d`O&(3vOH|tp42dUS6v$Y@Og3m%m7|6Hbt&#Yf1=AqY>8abt`{2+H;4>N zQ1F57Q{!gVmoSrr9I)i*=L??+GSd}85uN14UK%k~rxs|bE8vb-nSXQZ4;H_A9WJYx zZ%|S8F~)rSkbplZcP@`f07YF7QvFp-+XgkK(lq`he79+dw;#Nu3vJ$msp{g_RF^xX z7Inv9#0Q_5g&iJ&DAh!L z!faEMkE=4oA27c|UtM+BX6pA8gT7@q1j%qy*HRkbVKn18 zD_@4m2Uc6|;?{VIueWLN7K}#@tDuDH6 zwG`DBwqxYDLb>D_%%G8c#Gly{8L4uwM8<;TM`Cw&$--VzuBLc@pvr~gnZsv$_7ytY zd%C)^3Tv`t0r4Uhna4L8cDr*E<+3UF>p#N@{}4zqNc{{9x0vCDALL?mfluzhKaQ|d znmoudg*In-SKqY8yP$U~>Mj#k(Zw8lIu#IvdWR!FzNmTQ*q*x#7b}aO-m{x;~=QOgi6JH@@em zudM6TANIdO;{X9B1-47UoJ_j%Cb~kB#;8UZ6X4KsHd?M)p4cSH(VC~`rc?CL+`4dn z03pxWbP6SGDW9CH8}=1aVP(9jlHfNe*eC~74}?O@548AuAuk@aBZDemlKBh=1P?_% z85AWa!-9pF+`6JJ^HwMB##uXGM;a8(hdy9}S5@yScsXr;I;<6@7JyG84%XT$cRv-4 z6F>S9h^PLKSoWoPEdsxR)Ps$Hch zirh;iQd5Yu{WM>aaG9CIy18J&MDJ#U1zG9KYWI|Ji@$Dqe>@PNQ3%OKmwrz*X z*JDjA8T7@youwq5N=-$*-WS_f7wJ39cvhK#QX`tq2<`Ih&Wbr+{~mhRvE`?~X%0o7 zP*Et(sGQ^1r0N}10ki@3(e>!>#T)J_hyfq!2UN*p^{DN)Y1~5mx|f=-h<;J8H!FI| z?Pw3*75(C?-Ci;#XOb`c{wkbukN3GDkR_@(s*U@ z1;2GMT(KS2uc4dRUOC^ZynfFUH|s-}l`YC)+`^JLk`fj&m)}b>HMX2=>P2SmA!rqfWcVb+*0E5ie}9O;S^>M%&!KeSoS_QH)q57u(wLM5^w6;z|v-yIIo2! zjDK-atOx%-syWvK)^rCH+?Gdt`t*(LNa!FYt%?59#f@^aF zx+8QxIDUg`>UAqOKjy6j^}l7BdPMl@``Zs63-jelvKoqZvsVOEc_bDnhGkl=XKc$k zNK!C-xo%)6-T{vq68y3Eup3W7Q?UD3Rc}x85?B}U12Nj$;2c~HeJ2k#_wU;t{zWMH zPZZDprO{c^2P9mBx$yE~W00VMCp^0_gL=?9gjB(?lzP{>M415d&9*BmnBp@x7 z@hk_t%=p3C)fJV-GxF12hM5+0=VbRaNKzR9sjANq2&gCMG#QeVIwqWH0U1WQxA`hQ z&_zA~2zM`>xKOpw$hhwStpd25?s))`l))v?CP`nQe>NT~Axd|W;}ShjL#2;teZHmf zTSGSd=T#B%IdVC~;Ey01NquJP&(DPoscv+Hc{;At^Fz|4J`UT#R?UfetLI`z9pmgws;A+$JZXhdL z3bK0>s3_-}f(~R(+hRV=HW{0Nh6RcPElUo=4h_A^wWzyyseZ zCOJl*<_rmYIISOorg%oJ^Ot}7(Lfvdug+TR<`k)enz(DA6nXLtl&%HXGH=xucwTh< zc&)-h*BgWB9im@I-+Ie6Ve#-FjGG-D-bICL zSK`~b-#G7v9-Af`S946qf1dh;Netwe&hl33>YnhQg=5jozqzflbxt|c#mFW#EI%y^ zk$mDW>_7pKxlLh9;w>JgtnQIp#0A-`I=31aDn(?Zz~|1)A3f&PsQyx`b_>%q@sT4> zD+dF^U%Cn1y9q?9;8iBSy0fvHL$huR5!&S)Xx$N^7TbQW-7KLGqgJu%L#PWe!Q&~^ z#b0(u;N(uG3XBUQ+-VW}ghY*oGm~gkqrf%b0OhE+m!@skMiG>)JjfoJ2=DLPUhG}U@7Sha zfFy~6rdOc;Amc_h$9T{6rkzluGFrbCgv{Kr?i|R0?zP!L#I>O%n5Ku11BWdSpY@xQ zaX-#Ac7YEznkVQrn|y3iYEKQO2}GIU!+=+4X=y3{eLz5esE=$*s}Bm@N|(F)o)q zFA$@${>YTal!M_h@CgHp(~`rg0UAt5k6~PCijJ;sLT%T~cLJ|2N?w5M!bm+D#lnfY(y|6GbH>6X))DXlnkJ`m7Cv6)0?n*bHI zki-l`4S=75UXQk$-LOw14#8U`@DDDE$Na$CQCbsoF1_}A1GQ|_TWCWqtO^_EC=)|r zufA4!%zypLze&bx6;4Dsn=srJ=y%dh1Vo~>I?alW^@ioIQJEcnCsgOz``A|lUO-xI z0CEKt`|8et=&8y&c*(^YU~B&8jg0?SRw`&}WNRo_1N2X+O!Qd)Vs5eY^u23JuOiAJ5tW)sq8wZ9@X+JLkUBb_I0dfkwurrX~O+ zHxr!!VTgSiNhPkb6Cf0vnB(D&?iBL9mh=NXAfTzhizWEUCUrY~-mBtWINv9ReV_p9 zEbup5m{xT4F6eI6*r9mfhxe9%UQDY{@CLd;vl#wLO^r(qiZuFmYM^7Z0ch(tBXIS; zRo4E}6ym77;dFCl-KkHuAOHIFKUgbK=1#xXu9))}nX+8arReG9Nl_CYQNrC>ax2tE z?hgf(n`*0`JNXg2r6SBf93Z=8qZF zXe9fkC)w?2;?DNgOHv0-(=5Z@2Yh;)i5il)pI&~PdoeDUw;xE|XA>JoyZ0nlD=dNt zho6~QNg){TcN671_-Vsn`zE5sK*~Kgm2K_4=~(7*cCC@t<+MT56+*rG7s#wa>b0^% zYit)n;tjaEx>IpTw;2r@Jcs^~ZYDv^jhjGpWClFcqZr3VN)bt<9oKC2RzRAjS~LBw z)@&;h;rfX7PS>7Y+CKK?O+*Lg!f`ggC9J$COM$o-k;S}xCOpSXq$_tv@xG~~L%4f% zX3ERj5}kX!9ww}%QU;5fZeMSQg*RZB=gTNqYp#KJZFG0Wa{Qga&vn|3Zh(f(SoD#F zrJmp95?wrWGge@C0!w-BMI2)papY4QRYgEfpr}i+-98W z?SpixOy%sMuwnW6o8}!=pA`k;TTInsk<}x|A>k=5+OVuz=bPYe+1%nj*T-VsGFuS5 zsHG)bC&yTPTwfQJ@~P7EOeBTPiGxI=BYt}tKaDzp9IzI=4B~gkr6Ap) zUmLmyxmc^e*LYs`#j}WO1|_YU%cAyCY*Oufdr0Y?^o`GrZR$`jj;!brb~a|1y3osF zoq=LhUF|7Y)@H+^eyED>1c!b`)3;=d<%5ToAJuk1n#K6!rVV}IWu=T$4h2u?x~7gH&8F1eX8)AN zi<5)B7|XaHI8=cv71&7h)4-TDBTTG0)li2$k3ojNR5O@Do99o2@=vRIWP<* zNW(~jlHVFcpXd9&^Pcmb^E>~}?7jBdYp=N1bzj%Dc!{0qh<1qe=VYE}RLCPAJDAZ_ z9bl)1jR$^cVO(|7ZoQts_srIKlsZB5>yziPciPz9td7OO;)Vf7C%X4n%)TBX?0>C8Ana56U1CPC2#k=EUbzB0#NkfSEgJvh!sXb72tk=JYE~h%j-^dl%yg%5NpeaV> z&iTbl^!vMl$t3E+%aA_|NefazU>0-2jY0My5fcSKH{kXO7>{&?h2ksZxD*=e zY2G&M*MeQd!zDbuuoeQOmn?uU`bFPhZ>>psh$L|nY2B(T8I{B{Io(x$?|HU9t9no` z8$tX<*6mTU--^Sdy_%3|ffbFTf&Jqz@&22M$OJ_1OP?Z4VwPN$Oli15(2nLV3El~Y=7^3OP5W_o9e zvjJwRKIl9DO2hgWVGq#ks(}lPb{^e%*~<}8Cau@VVm%W9)`215kzBeTOiE7zXwrDw z?WaV!WXKtsz!QA!-=#PIj|6E9RW(0f>FwLZL@Fl9c8o38UnD@_Uvre^j^QGxy{vXQ z;5d>Byoq@{V92B%T*#UBt23HC?Lq&PC0l5MUkr4&UR7qKF#gj{2`FIC<0|*J-D3e+ zRLg&k4&nqt8LjUb>wSvFz)vTZy&a_oXj4^~(JE%J;tCj`lMsl07jqjB0eaUI>v4hx zKaXi}NAp(vkPPni03PNWWLA_=F;y^hb=qnmHM~jgi`j4NihZ?wJo2Wg?@)9!B)@;4 z1C8%B*A{t58LJftm;(q}1m9g%4PzdS=rXHfwmfmw>+b}Ys_Wg<16ZxTgbkjOt$uZf z>L=Q$^|s0cv2gTE*KB%ClJ{f9dPT+~Gv3=_^8xq7RC%+KdM_8l>(W9(8K6aFgg1Ei zUi(Kldy-}aY^dDMb{$>Nzu(9MjUUa9pQv;;aEr?h;?h9hS{ye!l{@>RU&J&yA+rwV zcaNDc?1Og%X#!oOYWj{7@v`6LY%^mLbs^o_{nSI(I1#G0hx3v{gQkh}0(tZIy1GZX z*!knHV*uJbHO|QeKE2J0vuSy&~2C~J#=PwgfLFDy4V zb+(>TxJpf=`}cp%BPYzHQ_fjEy!rA8fwxz=(4^>85{%(t{nJY^DI2YvOZOwiW@eD< z{udajnLz*YlDedpOY@%D#>OU786Tr;{||+_T!0IUXl`x>928&&3AAaX!Q$wy*dK#m z-X&Ezd<*z-1Hp6|tCtR_^1#w9vkvxi07Y^KtQFwo0&Exu_ZSZ8docN_ri`7AwH<({ z$a%uWqV5u5-2r<;;OZ!-3L#Z1Wz<(2yQFwo8f<_xy;`uax}QTB05oRY4h*IW^qkmO zq=B)-m&!QK!9YB$-t$ORz*)LQMn3dfuH$uu^wCa3v(wThHWu>Aigul=>0CwY@kG3W z>`ywa@M_}=&lvyGG4i1DetTyPmz)m!IhL9#j$hKo8L$fPt(?K?2X~zMUk)r_NaF6X zAbI}HVn>1^yroK1)aZf5E#O6mT3b5V!I)K9OS=_x;ReOnL{c54PJvAxz=X1TsIX`t z07^Q|$)9IU=~;ajEJ)vmj{=gfXLV4)j~|0*pq8y>`ba!z`Ixy}(?*fnz6~Hf3j;im z1>g|B^6xlK`2yDn6o#RXWAHg5uR!hW@K-Dz13w0K4vs7)EG(J}08w$ayR)7_*Hew8~Hoq(%oZ=2C!PKRfaA!AQf#*3dmTC_dIz%R=_ET6JZy!%Fg%Au+y z#%%0OaLH zxvtosufaAPnAcxOj~;YCZn0e_@MjyxSa5|BN?o&_$ZT3mm&URP06t$&4g$2HFjnR7 zvOn;!9B<(dQ%^P7_Ea0|?z)8GjJqmZ@b=;BT$Z)4E9G5sjc*qe>XEV<_D(0iA;+d% zsPQfGwR*-R8Qc4vm69}rTp`JC_Ub5sQfEhZePIRA$|ODTR`Zzz1UwgV{Agiwe#d^# zjQ3??gg8@{tGZ7WB+t!oR8dn#LpotWkz7Kap&+l^#>&_=e#uz(GJblr{d9w?Y)96B zeMqP?Z5C{B$rVS5zGpgmVJ~!Jqc=)@o)OV_9xL2;z|ckEzyUwvM<}NWtDHP2ml5?| z!(YO=LB}9z&y)wss@#^Uh|ihJST5fXpI=New(KeZA8GpmpsPUBo|1uM`#}zov z6L&XO{0r(dPCf|`0t3VZSo_*{zoTo1ZO!eKZnT{V&`o<#x}CI^C|FtvX%2Yw7MOLW z=2PHt&Mw2>J$u0zKi}UGW=pzS)esYBaQr^1U+Jy8o&wapaZTwO)E?DrCCjz&%Yi2f z3yY`05_*f1^A(8x%#Xa;Eg z)eaAM>O5~?#b1Q7HVpzZ1QFmW01&vQcs*H%n{VdedIyu1EC$gA%hbmEhXJ;*G8 zagruzpjw9_Np=RFc+)IZYuhmZ{+?OQyqEvW&ofZh85BZG~E0FozINGKrC1At!X5#OMNv;z^QI{@nk zzA@F+v=3iMKK=z{fjDqTq~M@Yx<_|_oEFlqiCbq>5 zkr7*WJd}?%f%i1x=A~W&%%eU+fceb^#)whT!0#y($mRg84WWLi*XfrY_t<%{WvT}| z&oZatH^8OLeVf|_fb#cpg?tu|Ypm$H@i+eXqN?=JVGP?$Q(wSHh@)cP#UJNuSVp)D zw~e)BKBSe$K=t`n(eS6%@Dc!mea<#A-94CdMk)Kg*tWK3%p0<27*f>xMZKDyM|9Bq zvh+0&hGW%WB)njKIPKbux!8Ri(~2LW$IblNBe-*ynChwHjFC!8Lt*oKU_%ujb)VSs z2@VeaP<~Ao&x5+{QD%(ym)k(`yUgeil*89PV08PpVnL3m)*!|lq7mnq$48tW5DZqYV!}{A> zH;^(p5HkgAOb!!xt>=|p?t1fP2;Oekz42jKMUrk$!}?3-gdf|yo$XHO2ge$3C)-9x zZq(hHMUhga4V7-E#k040QXybr)G!M7`($q5@nlkBi zG*H0i0d|+MRv!U}>53=mMxN8BU}irB!?%lYU8Uxmo{m1xo9cfRfjDC8}(P zTd8nO(G}LbF-o-tjt!!c)Enk1bS>fZ*Ec0vwkZO)^1HaS#T8#xds=s)RKlKF7N`dOn{&J5P(HPHqk@_bdMs*sP9(_Snd($Co0^Gd5H*(kKf)? ztiX#-Zl=iKt7F2~BwM;uI7kFb$Gq77MZar{uIQDCAKS}#l)6lERS&}O<4k0#A9GK9 z&V`b#SaqW*Z(-P9;O!heSK7uuxgbt@_sz88($Z4k%$+;JDuAN5XihSCktx{ct1P87 zGIfwMry~%C?>FmyxK%zu$1*hZQdp^x3`d-Fd;VertxgqUc{%FHY_^@BRWRfwjPBT7 zI%Sl|Io7qHTB5?ZiqVtoZ6C!8k-^gEZu}g%CZUQL;kE5p`&Vu`>Y2F{lRgLF@Vj>o z0B5>~4+Y$U-}{M4qnb;Lp}(`2t%R6dt3^{o!@<`KdmSe&k()zoLDn(8t=i*)r0YG! z9Zgx=+s@nUXSc`zhwN%+Yfx4ZSTY}V>sKml2^O(ik+Ag8eMH>2yZwohKR@RpVKQ)$ zLi+u3J=FV|F5p+1;3De1xXi}AM0g(f?f{K8i0dyE)3C{?{iybte(S_-n0Yeco&afy zvDtXudqZF{w&^zYd&&xMIDmj*f_PyV*5Nszb^&YPgBE3oVA(tX+o{cu zwlrz3+bDJeKYa|VWo^1wbNz+^uof#Lz?ua)_5Y%9_3wBYz(F*vmxjZ{Xti~9)qV?A zfjZI6&F$$*;Wj^;jNRs`uihzK_75Gx{z6y&F5-3grM9l^v-zE_ra47^!hN9S?0IAZ z<&cW7v8>60R!4v{hz@qwo8zCVoQXz@+5>Dyxmbg?fyvwPFM5+5imUFl1QljzM>_JU zt&wg`O(G>ZUbd`ivw>v*gYIVX?PA?vNEDkrHAG*-ADlOkFsjNH(Kv+7NfD6IdrN|G zb`XMh`V_+(@!Ls_UQzPs$I7PPyQh@%SU%n?TDe{&@kX9-uci1rvBqs%{)h5+N$f_M zF0+CJa~3iAZ0)>miHVA#KtJ`X+|<2mvQX#1Qwj5w=xQbNyGEs1(Zk_mj8D-khP>V< zs1QY#1c0|>3(1UWK6<+Bhe+8gx05`c$k&``O3=)cz`vu~BPD8?q4f!Zds?%GJV?|E zbBdP9o}S#OW}mz&X97|+XHoLqaQ~xI8?X6OcFFNzRCtRxI#x6U|7n%vcSPZiR?R=P9hsoscG02T&aerE00f|LV(OKAhS~a z9x@EK5&HSpG$E^_iWuQQ$?I&+lmfIbQRTP;G&n7>D)q0A8EN;+c)6vEoulBQEm|(#ta`6tIRp1?i7ZfJUc!A5uN%0by~1NGk5In;!N=|}RF@RY zl4Zc`0FVQv%~M6nTl^>rGu$5HA3aZNXrp^{G066&FIh_bkVCF6vU81Wy{?#P-!tJU zDJ&UJ-0nhmBf4-peYip>(>>;5quoIm$<{YjHi9C`#N1DRl^I~c?V3jH#T|bfbvd1Y zXJ);roT8q5TO0@BduLlTJ6gz4qvRKZv6oFsQzL6Zv6i{agCyZ>UR=;bxrJgjhHaUGVme>Z5T$}98v}^{We@yDUT!f4YA~pn@=L#QhW`tVEv5g3#!3T`>h~&)NcH9}Y-`B#a@o@; z($c+G5WO7&ay-*V&rShZ?>XccxwFOgR|996GCU=c=<9fzrg`xza?2_t0U2;X`zI5x z-v`I%Tzu6oS*}xA=ISN(6H})j&F^)N1xmfUwF3@j4m+p1M%AY6wayK=+Fhb2(Tv)| z$)j2RAz#&|T}-S;S+AO^taDwb^+ALcGr@(_;EJ#>q&x~Gsg-%zi*NPjqhqq-uZttT zM^4!8w26E^gL$DlY9}^G1zDqf|Hr$^_$!(nNDP4YE^Fdp#k!S)F%f z9d&!2$0k&mXxs5{1w7&-&`UR{?X#WB+{ZJ;bgQWZy~)FGMFQ5Ou^c_$Yf_YJyQTF= z-A-AM9G+}`ilyamiqgb{{zidJ4f`#B6&a}ipX9Fv*8eZ?>h%Hl5AX`}g8i)eUlSm` zKB)g8K+-wBf50KBdh{O4ke=(g+dr1So&c|$k^fxrdIMNqY{hlK=)HpWkQ-r~57sBo zH%g@&v#lj*q}1hkn|x%o9_W<>WZNxZ6P=s+iUZOu5Mh*ZL1%_ib?)%_<88f>gT}Ku z;#9cT?E0O9lgl*p_a+@QB&b4rUz<}61)_;L9WJk2>NN+zZi+}bwuBbWjf_eq^+=Lv z6qh8!OWiiz``;||czRK~Vdso%+$G)3QB!N7#bZpB4<2CPTx=kFh0oZ#)-Q}=8%NC{za}!}s)q=LmrI?yFqaG57w=%B}+}(T$`%%oMtQE3r00$szi$i6Z0jo8dcbjv8Ur3$2AF z4{kjkZG#{(2;Gir#K&E@0qVYD(GwbEIRKw?w+1Jl7$%O)*@i6E7DF?K<}omI0)f=0 zH~EG#HgAK0kW%{OAqq@rzrJ;+jBeNL~?0?4MZc4mRxyE7z|#@M44?(V#v;UJ#AQS+faV*{|3ON^;o*g)_f{NcZ4Ey?>6?cJ4FApt?kF#P6+71m?wY zamm8Am|V(o%+RlAUki6$bi8aJAAG$g4uFlj$(0LMRb-q+Ig;n#1T41QOiC0FO_p3k ztz|32n~FwuI||4{CCE@NNTC?jX^%eYNXN9vx)J3L;SrEM!wNQU1vWiRs3P@|z5Tip zvz8_s!6IzZ8HKzoF$R&&kT%9Xk|e8Cvu(3$!4W?`tEio?oMMSpf^h6HERFxeH*$G;>- zGk@Fu8pQgL)WMcMsEH~xCb{uPI1x6>r|!qnacg2kt&EXR3fxVk(P;)L+#kT~h-K(f zYTnXBkL*iuYs}(%@0<7`+CvS!KyFM7?I4b0d*>>v`<~QR28Y2IS^{arm4)aX7;Lw| z6UL*`{(QJ@5KlG}v1VrJC{5O@jzn`sTRUr1))nGv(sB^-5hCJ$R+%_Xm-otFfqsB9 zu`5@Grxh_w=6oM5it~sh0Ve#&zIWurHx<9u#Hg<`>gPSNd)%TPk{F+A)i=1hc%RH2 zZ`LM%X(4}ufnIHdV|h9I5`n*ySG7b_)P3#myH}~zP&AU2v_EFn7g$j%Vkz-ByV=)Z zB(haZ2^YW{!b;7h#7_G;J(v&w^$*X$SqXqTrZpk7Cj>kHjUDR^JfQYK9sw?45dwW$Uqc^eK#I{-xI5uBpOVW4+K+^PgL|9LV zGSF>?g>*q9?S_SCpHN{&o8M`J%YfAE$?*ICez?$qN$6BzpgJ$+KW8Heowh>D1XH+v z>|7U@;74TDwb{x!a3<1I-~xo@NC4WXWukQ>im8*aG^U*kSrm8rEaW~t{C|UV!Uh`h=*o&zv?VO zTu1D5$Qn2k6DW=T@Px!-62T0XZ`>7r5MW+5jG;ww|13)_)%B`k z3uzW3Ae(WQLZxG-dC)XV{l#5yu3ai?e6bma*v_bu2TsJ z?9EY zx&{f^xe4CkM-`ZacSPD-q56x`xm> z25#fx4-k%tJ;@2n3_GuR8I`KMZ+4^)mJiS{BC>Z1>5Ei0Z3J%LZzv7`Y^VDs1-rPE^ zs9+*Et8DYoeD|NOG9V`rdl9Dy!#6Iv`Rp6W@c{-b3*&vU>9`u0q%Z^4S9+yU!272m z{9m4G_G`razL;istkz4<_RQAR3^a3VAIzv^wFjTH~{Ce~jL(J3fpta1TnS-@;z8P!92X z3Di?}pwRs>ryd;Xql0--Lw$XXbSz-FjT)e%r9*O6yevyCOns7en_*dIfeOr7WH^NN zaDn+xtF<1B=`ly$bwBwFYIfpT&n__k{@33Ku+{c=&_HBuVv>C+SsW~cy6i5n?xE!p zr@5W<7ZuCqaB_sMvb12kYN5&V*toc#o1({?^Y1*A*qJp6?~R_^pyDl9mYv`9ZEuhv zM@$G=)Na(;u--4vi6i~xOK>Yi^0{AErTy6@)ZpAVZe@G{327S~e0`PPUgtevkbozv zT!F^V$>YLo?jVbjfgqXJ84=#dZQBMA)K&dXV8o51CgABl(%r#~aFFZ6&IfD)@ z{ImJH;oW)0PE;$}`nCJtKLt{IU%xMw05XiJ^T*7L1;;;*y=@Pd3a5W;dO7O(+9X#9sHnG&&p`Zt}nL3wwgN<6nUeLVv0;B)^qJ3Ua*N7`4 zZV=f^utDL2`7jLo*Ut2>TxV4&u#s%n-s{md40e61uo!R)oL$pL=zCC4;Qe`+hL*dz zB-Lo8qd2x2)icU8mnTr9-8TfEaKEK54eNzZ=-w7fZ1_I*iXTf>KhZzbRp?;(`84J$ zoBQmTABaHOq-fDdmX2NFoDM5AQgu~&(#{O++GY6V&HZp>(T(ce2@lbODFOukJ+|NN zM==*A$iseJL%zghV;F)5b@%GRG_^o&~l@7TyHvD8DOfy&u7fm4SH_6~(oB_*W88xzFO?=#YeoXMdG` z9_p+9&kF4a%F?~*QIHrRisU#(PaLZ#tMS+WDsV9wa+rUq{SA1BCD|pg`~OvT#0))> z&=L2fnvo!WYU4PmoUD>Bgtp?OO7y_D&~K~(Q;{OXN_^h1`Fw7}#4OUWrnb71l^s-n zh745Lp%ET~Pcc0F21uLSy~;D&KkDegIAAsezg|6JW7J`_-KM;*Q^)OgRuYPud} zsOLO4Nn=U99N@9FTNDv4wtJq^omYph6CeOQnVdbOD=jtY(J#H5g0=9G;(FtIorZN! zI*LO=M($Arif(AP+Wu``!NJeE$? zuh9MYR-5@I6i1nLzf#1R<$e6aXJdmo69R3 z%{qd%pm#XTkZ&W2Tmj_o8~3{O+=B!npCGIsigjF)Yyg^;B75HjfyH-QU>9`q9exyu zgEblBCTcskDm`W>kofC2No1)Wd)}6-q1|)aBszVSu|g9u&w_;lVd#yl z%r_I}@%CEdKn8iz6ThH}Mk983C(G=}z-h0v87CceMJa6w*h2FW{`J$}`tHB#=rX`! z^@#^!Z`{$3C#h_E|8Ii?QhM{=(djVykH+PHG}zNhU_x8X6(G`MNJAV{cpQrhi$4UW zxR_}M{I}(CGYzpdNAUF0pJ}9B9P~c&lgWb~oNo|r4z4^8jT8c7>m3+dgex)|S642% z1z_eJ6Iv&mN&~|QQ&KVkB;m#tFaZF!(NAWGOp+2OE&o~xc*hOd>c^W#t$==ZGL5|+ zgWFOT0VVfh90V$|kq@f!t5oD&WD#bT!91=>7-}GR{bA0nSl3E}X%`0hFE?=GuLs9N z)eVJRZ5FF?tAKwTLP$_m92(4+lDE*&y2{jMQ0G+ODJSa8eN#F24cO?maf3N%1GT_! zY`53GACot^5>0!&8)1FyDrA>h%g_#gN9)@F9QuYZL!FtREQ6m1%9Y)`!hAa{`bml+ znpsd)?R8!xbg&1}(AN0SOGrSL6a7PWbgY&`liDv`EZD|IM2?m$_08>M zT2i_g!#&?Fy|u+7Z8xcj@-4!Q3*Y^u1~6wvcnwO=W6j%rx8sdiP5` z*wz*?Tj`CP!sd6SqT+@!9&mKSEt!bczmP8UZtBc%6lj7o1MciS$g8G`TtOPmEPiX3 zKJ5+;U2wYE=VGtDg-Cz8P7+eMOJ=o2rWgT_xYuUV5i`W?eqM5=js@*;CQ~e32!p|n zyUqichvT0M8S(HL`mGKpqK*meuwhRlzMveYcCxpZXD?YY zS}*S+xCc$$A4@O32#{K+f^gOx8R3pMS$7&xdmcujqR!7-=9$apJQ&2@(AcT0KErkg z{~WYR#vFYq+^Ok&R(VxWY-)v#Wu_l?g9U=2eOvEoY;JyMZ;3)~(=ulTY^#<1_7?{E z7t6gBdS{^+GH=FJrwr5*l^V6Nuhwyt!nsGKOOaa3OeRZxqaL@lA|=^qBMFoWK@t%q>G0MCVgM7y^~IU+i{OFu?ZE1<_An}Or$_Nr&)&J@OGtYVwb9*A17cLMyM_mWb&Gc8}El;Tz*pIFV9=+%|; z^RKViyFCecsikPMOiGcAr(~3<-2a%9?^lKWV_zY(V!{XP??SAdig-Deqg+w69*oy6 zR*z#pw6th0zOQjJy%t7uS5+)XVwom=zLe04LwM^jGYq*glzJ4gMp9fnWO;dx<*~`P z(4n??-~o$iyM=N{%_6cXDU^e2;ge+`(cT6=&w`vd8~%lF5o(6X@R!Fp=TrE)8Bqpu zJ!Xf4j!vQr@&^S6)D8-0NzKPzub$THWLUVi%+5cspDEV30ce;Jz~|n@iXs7aW_|6&2^93%&oe zA8Yd?&5H2P&|(s(*g4Rf{9|bmWOu{DO$O|m;C8>(j!R9&r5E^(rTIY^2Us6ypbx=m ze{&35^~q$)N;n;QfcWnH!0)lV{gJ}O-vQ;nu>!tKfQ|9$74&@3@vrGDn#JT!G#5Ni z0~!`MgcHKkg8aY2J6m(~N0-H_DyD7jR%7W9;uWM*wV@R8aUQqMx;Il8;_VTo&6fDl zYW;d&$M*CaZnMqiqQg&a)z*LAF>|~CHl19I|^hu49OaGU<@2w_Z)JUhxquqqr*-e<$1M zV{23<9g&)azma$Wqx|Eaz>XDrd$!Vd{G)0qQQxa4(KiYM=kgW~=a=ePfC8HaU7x10 ziCg1D{!P|~%AOM3qh^;{N0~exhmQ^AlOmTvFYc_pu?X&Enl3!f$T)wWdxZWo8#mr- z1a8YS>F=u`^bHC+F%B~Soa7*j17-5Oq z21~AOPCSfqK-3qG4Yl)qEyK)YNnqdFE2F(M%y*Ci!R@Ply!DND$EDh_M*R~3Ufw6H zx=MN*^F-N{F!pRamqFlX9U|oOWGFt(F=hqE6Z!GTI`{G{r4yDJZ%)$<*^f(Qw`fiM z=%#4UB}o4JTQ+0FJxym3ww~dSh*n?3U{|ObytJDH32(aqQ$l-nw#}=)8!q2I$f@XQ zwC7WO?U^lGnsbfaolbSd`1hX*AE_2N5-uNvSCW7QKInM2S17+&*|mXCMUU+ zR-sv$*P$tLuI#TAf zZRB4fg4)50Q_R>kr)?>Dp32i?XGT609WgMzP?-ssZ&%7OwNj1a39H}(VtNe+esDyq}%9;9X%C@QW3rIpk zNo*FLGCko@QEcl$z!}--Qi>1hU93_CB4(4m$u$l%OFXmsX4`(7TX`WI08MUr};8O1-mi-`|t#oW`PFxQkIo)o6 zz~Zm{>Hi|ezZCBCCtm(fg<$8lz;hch`W_iH`K!LWBLkVKBqh+I=PTIUYbDiZDj0=7tZ-D%Ll3ZWGn9 z=@8X;^N=u*Jp!rnpY|+Xlk`cI?)X=_I()Nc*(cAgU&jk zqaWWu#hn4!P4d-5uAD6L&xT=L)skTm?C&#I`M5W*uTiz+5DRuunKONV75HdYDP0~W z5e80UCPbwK!W81))?|q$4t@G-2QgS{&67@?)3`RM2p94a(%p(^N~m!2*=kUf?su$u z)H-b7fyXNba7>F31Fr}0#99;op_SD<$E^`V%&wyDx?GV7DoCQ*$)9Kg@Wjg3bT53G zpiT8bbS%@h!||lv2~oKP7xr$w>8n1s%k*-Ebrp61@M7<+RBGGF+K1?KrDtG%KJq$gcmp>oi7f{~f7qBW8ak||m(SqW5b8?G}C z)zT8bSWgTcMofg=UR5&(aMqWut^AwKcR3<(16dXta?vjOCBH#@nuSAbNu1#AP z)U@PiEUraFDUpk&OJes{I`s4Xp3Q`4t;b6xN>d~*nSN08z93Rj)7}%Xy zUdlV^?iK(zuzs4tU_0IXlO%ABeav}iXR)xrd9wc~OD0=$bbQXok?*C#eeD=<0hX+! Ll0?3kk?;Qjcbz+r literal 29242 zcmb@ucUV(jx9=Nl{15>Z0cnC%1p(0q)Af(sPx_vgiu5f zDbhP3p!61cuXhIZ-TORypR?b4?)}5Z2UuAvYpyxR9N*9QjurAyO@Zt@-FXNELZ+lB zrvZVSQiniJi~Vy7{06oewE_Mka@A0{2PtT0m;*nYvA(N%7Xm4cAU!ZW3w|bfqNwKz zfsoe|{tA2_9^-366K zB1PD$s-ANcn%dgXjS4+~qQnq$6;;_H;F+Ox})CY0~+{VU&G}1ga*&V{WUO4g$F|T8Dr@BK?aPA&|+G`)GX_ ztkQR;zoB<qwXk~F=MwvLGXvOmKco3 zj2B;(Q|uf^b{yI+JwV&MWNzgO^maY<+W0DGi}|PVG0LU%bC739g<(f?^G`y4kFHqe zs))ANRSfqVL>w%;IH?cvReUcdIFj)Rl zGBlpCB(ZbpIQrso@{>X_2xL*R8xa~Bst`n>d$v-~E5okzbU;C55}CP9>gzY%QTQs_ zbCo5pqSup*llyK>mHk+BMsHuZm3u@si8F~$j(;PgN6S~C!vKLGuGwO^jn!&~$_KbQ z!&!CYA6%}yp2W6uP!#Z?jJ8rOnpD6$xwV=Y<=FnUU7%cL22DwubD^N1ppphWSHx9Y zOp9)I+xG-B9A$#6wh#V#@=eH4k9Yr!x3Y+uRyqd~@%VOKX~WQSS{&kotT^fC9PeOh zHQa?6FSp~0@Q(pQvntu`Mr3dMP2ywgWtn(ytxR}8Ah^0>!*sLQX^yCS-Ejtu(TeBm zy~E~qnq!_%Qw``3n>T(D-Md~uj-#ZNZI;!6O_lb=M?VkkKDlfB6 zK(*rSFWSEvZ8b^Oa8V=1BGfECaXj+;{OOM9-W;qP2R-C7!1!qyxWq3g#A_j0%|pM3z+y<+Y`6uz;WO6n2N3Rpy-AZBDWno|!)p5f zaF}6aXU32zG^fr&p7AonMa8978|SR^=kw(IeT_*z))42GGryq^Tb|YlHx&p*Bh6Wb zYhZMh7z>QdTemQYN5S}c>nx~}qrL1LItF{>FqQY#W3xVAXwY)Xpu*qM@>}&R1X5J5 zh~>F;i{aW{XHGjz2rJJ!z@Vio^O|{rVL_^Kqqpx1qGmFw-35E`10ClRJ0$+Am5rEE zPeL#X{h0SH$)1}dh9*Mh5$(hb9s;R+Rfat9?dI8f`;f>}XxcY;v+!vn#42j(wimd-;u<=^5(L`8Ec)8o}8 zEw${rJ;^D2S8yYuOYUHC6{I?FM#?-DMSKW%YG>n_)H!|p1m9Rz*#JTV`zb6*TwL7C z6(gzLGOZG&Dj%06{9Gbm?>8`lOQwTr%-T=;TGPRm&xTg1tqo@{r*LnN)wn)3)P_K2 zxzPAC@87>4^YO5DbJ&?(d0xJk>_4{?qkVJP%kRk!-!XbyLED_Jk`{CkTai~-$j8g8)}f-+s2uxtb>8~1y6=wVac6=Tl8z&z(Q&LIa0UYDzMqEg z{?VcC&+6cTAFa(D0HK`hKgCTZ2Vw|hml#U~xpVYC|2jnx3wLyse!B8=cr%ysv3abW z-XTkq+e(c3)N-?=pQAyw8gZYprE~t$X!ZVV7pwavA_z0%ODy=YVr|d{#Lwl8+9Gf} z9gMysdzQzzHVX3NDSxSrvAo8DnJG&35c^GRsS}w_hpL+TPf5tL4HK-RudlC9$=>eD zcfM=>Uvs8G>~-GL`&BiB8Ovz}`w_z(g>M|$I@eXVgNI7>7QZx# zT&P~D(aLy?w6o3Cmaq}d5CE6|DCFmCZeCyA3uf`UA~wIUFyal_G8Em))q{N-;EKwx zNN(h5i($lu_}tzZZo`U>a1&xfL>X>;e7x(|Y3=8uHH!)O@e3F!Pw<>$SEK(<(DzBn zPbW4?2?t#1M6k@X9CCAWFUb=_o-y7ZE)dWjZcZt%x4}rAZUuo@>M?3KE^Lsz63@7Z z+{RkFVM9KRATE_Za_S=9ruW#pIs5Aa1r7C%5fzw(KL-mmiXW__GZOJHU%#F7va*7w zXFC>%}k}a$=a!<@=_Fe;^K&Ttw>sIt>u>rax*7)7kD zZ;}n?@KzD}G-Q^=aIX@%dgT$Fqn}koEu*5Main}co*{fUsH_T&om+8-g0RyaxZLb^ zI62pLIG(h8eJ0m_RC#>?;eyP3<8uF>QsnxkBo6Uh8yVFmJf-$(x%mt@Z8rjXu#OOT zpyOCJ6JrOTQB-a;2tTV3OWp!^Pi2)aJXX1RJ88_=TV;OpN>>M_`qxS12ra{rAM?h( z;!m-dW!G)JOAJvYd4)f-u&^)@)7KFsGuoW;rPX*;>~QhP=Ex$>sm~IGg90;b z`_zB85OSvfH|v0eunZ)6~XT<>EhKhJ}a&t6FKocNY; z7_QozrUOKYa7Ao-VoJ)<{lTT-YJZ(VA_#=;1&Eo<$0kq+q)BEF%*{0l@L--D1pFJn z=6#7mp#lQ~o99AWbd?S-s|?aMPA=0SQ&MI;!cW~PF@Xkzhljr}cM8)C0`YSP>>RtL z3eY6q?+84|v_7malY@2Lp#oM-F2y-Ws$h}fmzI_Xwg=RV)pZ;6j_+QOr_9Ik2b z!22E$=QpZF?>ys~>5Ea1FfRCg*lR~jUtiycmQ*c$dU@>wLNw|yn8%y6uP3shv|L=!Pza_AlJ~zoup=;9aUUtjRkrcFQgq zWuKXlTNm`sYj@GLB(26t%L`%y+e_=7xy09g*$m2oDmQ3`lMdRc8A-YwANjgdLLgiw(eMe4B7Wa}ezY~q(2I$4OZHxE0D@)g zBAQEXrU>EsBLhvEXkAaVxkFdlaamYv=E~?<2Vsz+-r`-$)q*gSCzj#VBm8&_Q1$ju z>u;>oqOdY5tza%XeD}UsNSPt?Wmi*+_6EEIS$74Vj@(9_wHpCr;v5Z`)Jvi^3=01` zOb#)tAHc&7Dh-h-FSJ6l&zlQVqH@Wwo(i_Iw3(e|r~$0n+)y~fZ6DA1h#r$W72INJ zQz%2-$)dJBF>#%x8S5WJ%-6t!OBFEkB5dSZWFc_YOJme7tc#&WIqHK264(k-#tzE3 z#D>=0is(&-K3JA`RDex{)VFMuIF#q8Ue;Qm#+^;`;SImU3Y%tv5>6;^Wx8jc4uH?Y)k-y-9~hbq@6z^EIq|?(r;aU};pZ zO{MJ(LLkFwvuOK$kL;HXT7iAD8FdAk?5Ec!J+dKpIIrLkFA5!v_NNk4^iU|I2?kC< z3WdyGbl^NT^4#rKR5q?Ar9fjxfvU2%SR^R0y)WQ|#8{e6s6{qAqUXSV}ez8w1Rm+nPEAmcCar@$WG$fqOCbo4oVj8YZN zX@)%9U$4zFpffZy)MBE5+#xoBzW3gq<}y#OTg%>VuOj43dOy@77X4S(ujTS{@5&!5 z`+iE%YHR`7R!~a8>1SzQ5WjBm@PJXYH?zAHx|j5I+MlCtVW^10k;7Dl#M|JTpr#ObrM=+^6hJ|4-4#!XL8U%nEi5OFO#f{B?Ge758?nsRfgF~5*&BK>tL?Aomq zmcW)Ln@I<=+_9_8^9Ki#{`NH86yPjaJLoU*M?dAN_rdKj9@Ke6$5bKa_k-GNp&Hds z*0(_XC3BC5q)~t?qdO4g%Oh8kDbKcZd8YmJT$-I=x=^ECBlLBQ^=0o1yh{^e(9zX( zJv5gRWJOpm*OxoLoZ4jH)giY(@7A^-jHr0@GYB%!Ffw1MfQM5&HEU)u%Xgt_gE{JKgwaO zi6o;($?tb=)Jt|Ik{k?~Qa{3@rrP)Cq6}>6meo1$8GBUz)abQbDR|U+664h}thbdF zzFA=-Oa*g@4M|G=TxB$Ey`{@|j}X2)GAERzJvLT<&FlGbP-qZ_x*6n4Mi1sW$;jLL zrsL)1c^UJtu?336FI6;t_}dqJw+Wl2P3+$bvOy_L+WiodqvKu*8TNf_y1U8bU30iZ z?@mFK1|i&K86mHHXxYhS!9UU8i8mNwi~VP4kyaN?qk^}~{&sX72EUSB8K>=%pYA*G zYVyzif&GX1EO@BVsd#D{nh0{HqVsxrJ2|&&IoKvS&*xtGuzt|SSMmryS`hG&WgqV+ zdWoH6{Z>gpp{_OUr`1lN+oFHH`iuV~O2^wS8@&8^ z+i!k!eeI9muv*Xz1AYyv^tGVXMgacMesGWM^jFSri^hv2u)< zSh&U)XvpS1a^2FHxworML@WFP!6-MWbXY$HjmFTalzaji#m-@3XgH&M zoDZ=;tDbfwHID?ysYoaMMtMLL#l@Y7s8ib#AKPuZ0DU>;qV!(w+( zH16ww&#x$}K5Z+3Va@Q6L?_j2vo|Ytu}-2u`BZ7}l~}X zQjT$WV4Gg3AphYQWpZN!8u8hidfiTJ-3gB`e}9;nl9)jExct(c^Is61FISuG4rIJi zwKRBg7%&tg=SH~lsD`o-{_!zR$H`j)C zJ)V`?=Wu1vsWiS%vkQ4wddU-cDBUWCqlKzrHQ*XPN3KAy|Bgvx%AlD?uB1vpdVeh(v$bKT9yCmN1HWhgO zKFS-AFaPbOq~Ad$U^=g$z$oj2q{oJHZk9Xs#Ht}FK3jE~qpCW}xEP~>8yV5`ptvIe zZt}8!P3@quM0DAT;^^9Zb7pJ&{hhkgiXZ~REFJw2MLu?8#fI9?SsU794u5@*ZT)m0 zC!R*>KnyP`E7PRIJOy!RT=JvBt-1EMZ+xBIUuZF=Q9BUhueS^#ot$(UTg;H#U0)WQ zlKc?IbJnjD<0Fn16;h72{FAtrsGepX2ZCA2m`xsTTp;PQ^AN`Z$v%UoCVK5KLduCcN4vPBSK8&W41I18?zq=Ck)O-=5$ zB-X9nj1JMvq1tS|n?bmwQVRlz{e5*A^FuPm=wVH+LEab>=(B|2_YdU&(Q$~+H^GE~ z9nkCr{xz*b{3F8mE;8f~zzduwd~-CnRgvL+uru=4A)3=*!#T0!u<)DY=++yA+sH;E zH5K6?E<385p2FfmLfmYtug9wzvejEf^ZR5B{i5h@2MiF{*%e`ViC_B>W=HQv8A#2b zvlqZ!1$~=xccxszSAQ__xU+_)Uqr?qMMfv&^y5|a-(h(T>kzbO!6003LoXyIx@-M% z61%kap7H8pqK5iE-_ZVwy}Vrl(1%n@z4V(i;Vl{(YOU2$c4b*XG4Hz5B5;jE&l9K7 zJw`1`YFdZcuTLL7o?TXC8}DT###&whS0^4o_#eKvA9q~5&9|X;ywT*Bn})ckH`N!d z_TXE|Td$k)SH+m^;<>2|snpavWHs)Ayjk==@@Bc}>Z2Il{^=fblTjM zEJOHUJM;m4i&!9at}n)c1~Jd};^d*v3MdWpHZW+&)ai6d5{oI{skQC}xvw}+jY*nA zSz%B}{JJaqf_M%u51-3Ld~v22N_gfCoW^th%-_$G47W$Wr0+1&fDC&G&MSj!y@FNk z;C?LEUx}(I=J@H=8)41LE}kjx$ms};3V!Ut@O!SrD;>??zfN$q*}3(Y&=mikgR=sI zy!yYVfg6~hf2M2Y54E8;Y?OaKSBDrne=_c=ttJ?UvnLO?)AA*L6uSQU;w&?hU%w3 zD?UZ&3&*>Of<(~UYnpWPI?&N)u}Td&YFX_$rEKiG_zM3jXYc#InxG=|1+ixDPQ!IN zZ@xQ8Fx{MjNm`TXD&)?-31)a_ss$8O&@Bt?Gd~RoYuYYM1y!cS%~(bURT@9d@s0p) zuhCDa9gNk2kPOZ?lqWrtl@+}~q530l=4XiQf{pKj_SA>j|m%dG5OqKU^ zW37>-ZEP<&r4=;$Wp<7it*Mwlb~R{VP*8AT=$?~DUtc9&&YE3ZJXNBo?%6NO0)kFX zmlMw9i2qbi43fq^RRAFgVs`9ksj|p$X2@f;HgTMh>ssG*)%KLa!sldA#Q98 z;QI##6u4>fqlZoBzfHjEwpHKTL;1A5tMOI*NX2^3T<#vkkr>%IkZ2{~-!-d{WAoHo zf0uM}{yYI_-Hyd3>hV~4jvc4171X+`=L=$*roPN3f*47(5N`%l@Lc8>{`P01%GUAT zCL7N#QIfmc4QisAK13JeLcgbEg~j%MKL_dL0CT8(%y)f3MkH?l&e4Eq;UA5uPSlXa zhQJ5Z{VtGXQ&;2%`~RT{Q2wUT}fA;8)W_@&vgmdx4utC8bG~2i|I9( zj`LI9d>scra?oj^o~2GsyWRg71BKdNhadvw0dN@+OT>irfKy*Lm#PPmi7KLGl<~~CHZKKw?~1H-)iTs$M(!tVRej1$?{+U z0MfJchbjjPK{A!3w&$=@k?<0N?55G-1X<-VL6$}<1n&%VJlR|XLbexwDpCMQiy?AC zomZ1D{%DRu25rZ1-476oo$RPldSm}|N4jT1K=%XDtd=+bkkOX?Fr5`-npsQq&w8KX zT@=UB7~h#`&Y4m4Yr5+nE^$`@MOyQU*!DEIx&^$vrbZgZNX`C(%Wh7opQq+kJjuCv3q( z%X_8HM4lq(_D%%ghaeDYU&khw@$tl>Q(6OUnI{+d%X(X`!wcn*qE{DMUUJ4cV%wF! zr{smj_rm}6$v?H_KnL&3ygYjEaMm8J)u&xyUE56GhdQQ`EF(RFjeA(XKOzywd|-E` z=6`2Eg_3Yl#3bePjLW^3-ATd;Ma5J!#UOFw@8i>luw!wWTvYD#zm@yZytysZIaZ?M zgR71V-BVnS8TPV1Oh7GMJKV9F{3Tn%gv6Jzi_UK2nCeYfm~>QpD{1^k_nc zsf1lNXulOrW5W_kVxtw|(yPTvoAKraZEqv(XK`P_Lo zc%$eVe0aG!77$y7>Kkn3QiJ3t0Aqn(e|(%Rny~KeOco4j1J=V!*+ht|1qT+2I6)(R~T0P|9pktYr=g9i($}@cGC3<@L^!cW( zW19+Xl^>%17R-XxTm zYY*QWM1EO4j`AjH3&QD$r|J;jr0?6I-VvO5D($QTv1-Df;uw#z7)-u@Jnwbyx|I1P zO34;VVmodsoeM@Uj#|!?bZ!Up!}H(yT7j-qcjKo69E&aVAOZE|yU z|7uSUN0EX9#+9@n0>`NDySBDAujaX(+^IC@qZuZngoJAov>a(566UkK6qS&!0udXCQn^WxiZNZ= z`w7B(7I`-bIzU9%*f=GD4*FQ))p~FWSha_1KRWK`){nLMesa9>Y~wjT6@E?H=SGq! ztm3KL&KFR@qY*it7iLjcwvPTy=*@j40Ca-xHoM_b)Qb612q=rc=M=<^QZ+mFA@l0J5!pMOp&! z&k{M2CT#9ZYAWHrUQ50UsYx9FmD(E0Iy)|}Wk z3`x20woTpe?B8iUGlw|Zu-auKE;(^1AJzu8+iSJ@Gj)g}Rl+S?8Abrrw^UF!x+@o$ znQ{X;UH@A(p27Al&r1%Hqe)Kmvreu3aumo?k7V1s?-q89+BN&H%`tFeRJAs%b4o?u zNvl;R1^w2&&B#yE6WVQ(!Mn*3!VxXETfm`Q3xhNH%X&P2I?;dA}$Ky*;}{ z;w4gstVSmPzNhh`n&M4RCFx4*uGjv)QxqNPtt_6O4!N5u+3{xed&Aez z0mySe+P>sWwBxrfSQom~^7KK>S67(9u_<)W_C$vxeX?bmFL;{i(cBd2BF5IKfm$CB z>hlP3-Xsa8qcqz zNw0;!i&$e?g4@=0?t7sRaKh?f-U`YFxpRZM6^B>8oYrxO<2G0UIi>O);RF z2M6Ww(rRmy3b#&M88IE~yM?aGz|3!se*`HrM_>`sV6ct+!Z3c2T!5IsYMlEK8O06f z)ujgCk|5^rW+YdKRYlH4$mX(VX4c}}jh67v^pF3r7y>@2@i)0Y5)?AI?Bx%S?Y;7C zJ#t&}afV};mCcVa>}P!wOfZ#WI``lrMP;qoNQZ_D+K_WNxa?ye{5(!&>p0q|7 zXCf@gsof2E#SDtq7quKNMFy`oX>#C0CI8T$^VZPsTEEb)nltu!hbScVP=ehr)8C9p z;|x~GX}7Xll1(_npD)A|Y8^X`Ra>^&=`j4!H^jSXT>od~r7_z>=Q8)K!;V~)I|4^( zwvrqL+1V>99fv7fyYE&E6eBmXus0}g9clb!PUp>_X1|3yAYK1cfcWnwCdu$pkL$9( z(2B%gz0XewSTNYTz{R4^pR=UJo38w4^!8t7)c*~?``1Z899(-}Uvjoq{MO&NXtZax zCwfS^ob*{mAPT;d-|35~Eyt+C_g{+i_n4LAIoNw_2y{^C1sdxy`}*o@3zlLBPK%Xl z8%8zL_m7KDZ={PQRoyVk;zff$P3-P(KG}CazJg_&4S2slgi* zHw`=dbGP3m2!{#qy4FA2(qy~whC-^pUMi)>b{jidjNnwIS354>?Aax^70{d&I=Ek$ zDUv#(<3U%Pz89p@BUSEqKR@*8lsf7rVSGV=u*D+$^vYY&MvFK`)9~k12SoQG$X4E5 z#Faf?sNDUufu}x>XC0cc7kDf4OoXgrigC$lpV6tNdY@moa%7HT!ci`Dnc|JhMZW47 zVPJ0p2$V_?KdhG9^!(aJTWWHUaLZo7_3fZ*xxbK)#;Cg6>>nRLR%l*7D@9Mneq<~| zR&CxXk9yrT8KC4XSA4URT(B!h$a+S-kp1^?op)Jps2|?Z%XRkd$-s|jTuaRzAe&>@mLILj{E$nk9`weI$wOO z5eG-fI##kvmUOw@u@NQfnqBM{{@}DPcG@$78rLjkm7Lf0@Iy~0T{zsc)6qkV^WD?{ zWFd2c;o+Erij>^}^$FJv#b4t+YVh6N9mgen#UilqzPQmo{qyF~n-@P_BPJ`+hDvTB zQjGWMMfbStI~}FX3VYNCUVga1WSwO4;$zHId!uZidOhtod3t5^eCf8wZh&Ih=`+KM zr<{_vc3dFqpPvv$OT!xTQa)NG=_b#4&Rsg*{$X-7@=HxP0SGHqB(qt_UmMO&h{4hqM?d#6O86{Z3IsRIe6sLyY=N8ELWil?Qb}D*m?wm9xq5`pTVW6 z9dPmOe^%zTWEQ^{d|Fb5*1V)TvQ*59Zgx zbIsK^{@uTrF5nKw<{y}bx!FO#pP4@2D4epyW39?+{D3Sg=rxR~Orf+8Lu_Ej+>JmE@kxagVmVWk1N~ z`@BSy^pibev|=M->B91lrMLJOqDzf)ukf!)(Whqxn*G!>xTdzo?}rXsKK&{bNqLh> z_})GAWAo9zWPT0@=<#{E8eaz;1Mmdmhmw~yqUbu)%;elK-qv#k8N9NbjzXqSz0*6Czsh$oFsV+hq+$IP=>DjEmkPRq+>NX*l#-s`OMvqyRMx@~KGULcAli^{H+OK&hl6UyF?Z}|-mrv_ zBhW1nLy-G%!-v#d6`8|K>aOg_mWlhXXdP1XdX(SUirha4jCG6u3WafT?=27BJXLts z=DeWCLJuO_shMGr`~>QzSECF~NILZ1VT8UZu4d6>JUvr)sU+UxNf8fu=NlCHRu+Aq zZ8vcbV&D2Lp7+-$E0FVbS{50iyQgDR)Ndx=Ipr^AQ@JW)=xysovX$7f_NrgM?HZjs zbW-ksdLmGqo@S`du7&RJ)o_K_3bnOEQ_pXoM)}6Yrm9R*vTrTNj@oT?7I_2@zygH1 zi%Zqurf@=v<3?+W8QV~=avc|FmK#3erMj7m!}ul!E)*kPJ_nV7itj(^y+1wTuzP#>-rRV-_^Vff|ieVIiqM@dy?&TwW!D#B|=VxoH$0(RK(t_ibWI^Uv3Ps~MXM?9iP|Ic4q%olf6X_iO#pGg zVY|8M{x52M>Yiqw=)Ru?u##+6d9BT@rC)kU3}JkMXEQcH?qtdw3=){OC%$+4J7=q8 z_nBvEUl6E2UVAOw=$t>^&0bu8kbS7?0mW0W$$xw_K*7rDWn)ir*T!85~8AG^~u*gJ_^Kllzr zX4VM8s8ZHZr{`d6TLjF&)%Lg=tE#hn8DNPHV z0DF_j{>I)f5?hJfp9fwT^g*k!Ow&5w9c}@xSipkjIUv7XXoOm(+-A?G@^35vrn?;U zs~=k~DkvP$WJMOu0G5Uw8#Yz5lh^y&g_iBQTo zzE8xxloI-hS)TU|BGI5Q$t)6hREhgjYd;y7M`+5ZO`PWw8cl!foo+HmCQem{%uP3z z4*Q`jSFAk6pd0$SZ_-n1k_u+HWs%S8T3|$4y-`N6iMRG?gc*lr_idj;_t0zk7SaUx zJDebJj3w0R4yQ}b@O(>Bg^XJ7GoByX9CpcGWu)EO4Kk`bQBX**!Us6#Uz`C(Ex)GR z1gZ*o_56ar*h2C-w5!?`MfTvWmz}hou-Cg@F@6FJ6BlMtV&1sZtmhmgv3GJGt@pA7 z*@9tYcD(=T*rHiWkrxdQdJ4e`%gW`&YsB3O9JN! z*5_35BR_s2NW(d7AD9qNGu(b~6`oa$bJzy{?Cqtt?B6C!@8qq3l6$q=fl}_z=z_^_ z6Y31LJIyHio-A^LMT{2I(~AU*BqTR}9rbkRev4n!1@){AU@MLLexHVVDf^G7^dG>i z0m=qmIp7Wr9opXyvG&^!>`RCRRiHP<1wT4EO4Ck1J5z^$n*^S&1{Bf@cx4B9 zs<&4ke(NJS(xe2|hZ92=SRAuE7ybK?LMOfm${zE7C^Ud1C%CylYmp@X+FD3vUgdp7 z8$aO{iUCKJTnsU@Fu~}QhcECE-?bVu%KexwE+ts14?v1LmM6_RNBeyaEIhY^u!K`>%i(LXUx`cjn1H<#cc0)|nTk9^Fz8l; zx@vBudz=W_WV)roe8j}Cw-C+s_mL#!x#`sV<-5y}-6b=F=B%>i;rpJs%e!;5{CA&~ z5$XUMXnj3BUseZ`9{wojsfm@eq^xmn58>{KHi&n zx(adVoV04w&eWrOA&|n1O)l|y9Lw0f$)>Iz1Re4zvVLYUBP40^S=~KV#FkW!VI1|S z-w$A{%oWhq_P9(i_7G<5XKBXi7QFYd#9pG-H;HgZW}VA97Q`A|abi-B>x{kiaxo^C*qRpR<}b)o-uK5 zX?gB1i_3}?u;IbMhrbE3_++7U&Gh-g`h$aYK540K`rMc9SM{{2xfV5bjoE7MS=jb- zp(ypmOG+QrR9ElS-*LhctY1Iw-Wqz^1ss7S`pGPV3lvv{ONJb)Z%$bDCRO)VJpA0E z)a3r8V}XfxENX;GxVb?4UOO^e-c6SEGx!e;Xh^@&})CUnTssg@Qzx?<> z-G0YHBWz2Q**_0T(K<{$SVY6m<~#TMd|fYMrHoYIVkBNIk8LimrCt7yYaTX{qmx() z0^H%%hL2)Ycu(MafFkJTIoFz*ce!70gUg`&XQwa6M=G}uNvVj?tLb`g=17#79($s?-A&(r=@QEI%WpWn>KUj>eZj;P+w6L@}W zL#pn~{J2L;TK$60TyDbXh+z>~j>l^Nj4q1+8;BIy!xS{%m&Q3w^gikubyR-k}o` zFS@^FwCkb)==&VOF}8$zzwfhSo||-O0eUw$1@v@D8%Uir5}hVWJMBQ+R)H|z1N~Pf z1gX#y=WdJGSJrS=ZTHOkUQRxTv6W7c?lb5BZBUH^n15AR z^71=ih@&k?KI|EPQE3R#I0yLpXa8eAPlpYVosNke=4maSPhj$`X|=m)LP$b^p&z)0 zRaL@QQ4)%RgXF{JuCA^i*>&;ysF9t-y-g9PP9^An19`L%k?Ft3XRhu20ZiMRuvp;Z zXffsr+6cfiOM^}xW%;QEZ;A%hoqAd0?18|S#sMTJ-YrvSPs5Ry-ri1G1CSH!&H&^Z z8fbH8@NbAfK8b*JiqMoY)Tx_cEd`xSX5rR0|CinGqp;XT^TR$5*er6gj#p@h@T5u+{nl zp-Nd?unh%+wkC1Ug2?%vw=Az5^jV!VyDsu)UF~Cly-!L)FpQZ(pNW}ZzGhfrE6k!$ zLlS&-lONK6R@a!Pfl|*Ms z|NLS!hFk0*`l*7a6v|Y#aRd9kqy0^;p*^Rx4yLzwG~@;K#GO991&*NZb63KTvIFYq zlSIvOKF$n>l)7AUKsd4v@{$F|8hRJhBOt3!;MSj4@mM;^52`SGX`FuhyZbe7=^j#0p`??a zr(Kw@UCZ3ETM*EMPUa$SGA!pnX z_%FgW*MP8?DK$sO$f)6#JcjheWTNsLZ~I$8ufpuN{eK$lcP;-6>MSKEkTc)~Y;GBD zk4@ik3g!>cE}q&|;cCZe*VgHw+-*icwH8tdNS`*W7&#qz=W5-Hn=3&!u17y}_jnAJ z9G@><-`*wVp5qPlDAUy57%P5!#)!1@iq%qoCSGGK+K_XQ!58KyK zGY@sVgwPZ~uAeyigK*6^!B8{1!MgyKw0){uOD=IBYM z+XTFFt9#?}qG0S4S$_FDDWQ2pQ^*caBdMzhZ%IJkTfM(m3pFlxMNaP5uf0~NHg0fk z@vM`6tT)PC-M9F`bopW->YTl{nKg3w>u?FlpAoR##Av4FA(po+sS7Y(SQ5g@xR%3_+Qb} z6Ch~ZwwG`KB!RxV67vdRTV7mToS)Cxy9$9^K7}2Ue7XW!u;>bs_whsJz!&KUyxL7~ zrrK(%naHZ7HEHw0VnMF)n27{(=er5!8894yu0~MMHuqp`pF)*RW@r4umk8>BJd8dJejfoZmeB)`-Y>;PQ5{KyC3C?MW<_!eyh=Gb0 zCV;Qy@YOX?Uv_2cu z3bQ8-uSGcys##z zW%b}Mz0%@~HI`m|tEIa@iSa3anmU#rcytzp0}j)czOJ@5)y-zm$S4ay29voqFHB2V z2)2u`>|xcW)fWJ+Nh8s0qVi%iY6Ls6aRF9VU)}hH_Gl-A^Bz<|Ej7?wR??zIm>)K% z4{X}o^wzhqdYs+HA}Q)P`Ssy?;P&bewLW!661X(~^j~VonseQKYh`(AXsO?3?zAd} z(LC8CU+ae95!(G@QG4SV(9rDbIp|weXUU|_wx@(EyImsvZsDG>&aap};H>mv;e}}e zld1R0&*yt9pa<e3 zR4ujs)Wx!VjPTNvsp-GWUm^_Kh*9y6-qK^4q4ewe=mP8(zr0LdnRn5L zH}&xI`GHcf3*Iw7c76IaKa^3+RSHom z#P1wkIq62+?HT`?9c7gJHTvyj4{7be9#;P^gcN}2G z!MhC70cQf9>=59=bjxsaFtZDju_1;iJ;&eE)zho+ozb?e(#+NbEmVMnm&7vp2<(d1 zR+tHA$guWZcdp|$Pp2=h@!DDWuy-2*iH2Z>O@XoKru|79q6Kkrkv4cI3bQTn-Z{fF z|Nrev#Gmvf0zWnY_Y(ZV94!77>{r5zqxa_sZxZqI6b0=mCq0E+vJ$KOiMah}0)&ygVTJR_ z;8h#!M?@Rn`a%dzix^1S1;UZ_2!EKt=ZCaSOJfJD&`AHi`iNFa)&m|=MNYu7*c>tG z>4XkX!rMNyMDOJV%m3{?bcbl1KA}}=2akO%7Eh`3DTSUiUUT<>kmY`&ALC`CQMiBE zxHf>t0byTJp6LkXdgKce7wP)js0a@cZw4xMtQwl>$o$NWfOTG=|ISPvdu}W|>i5eY z_V8J9o3>NBGS{8#iacsWptrM7LTV>%ibna<*1*=$SEq(5qmoGc9ODD%>8FW$$&Qzr zz()#B_&zz&D|gv5Hx3nxzBQg{sjx(=yOmo}!x)<-ozFneHmRy)`j&j2C%gxCymg$< ztYhAIy<1mR?TTj{V(e|)$;)hRW&Le8Jb8l&K-1P^N!`iv2W5+jhmZ8RBXA%0$~K#L zCsk3u!Ijh5U0yQ-JONxWujP6?Hvi2gz|dM^Vq;@nr~GnXqiEY$%%ZM8$TZ*;Qy+XG zz_l+H-YzRxLH#J=r`*9X4|gH<^9c0z3~C`_xD3D2o}+Gi2b(*c8bSHvy8+u-l1JvL z?EIQL*svt64gK|uO9nyrUF}&oXR7x}g@=YxincxrtaYPkS0mCMpz?kr3zuMf3@c?Q zW5#l~Xr_Y1-bdskB}1Yt7lwai^=md%&Uy#zagV<>ske9_Vy04CWAfLOFmdkPZv2=Hdb-uhHP`jSMx{y<$_4m2z2*Y|o{j$Jj4kbV87h7jE!vkmwG*CP@)&JAbJHGers)(YgE6({F z3x$LWI-WFVq6y8J@Rg&3LoqMCFq4exXJ-{X82lUKt1y?20RG@(-G|7q>a z`P?dvKw1wER#g`o$O=DE)3Z- zw)>2wbMC$8o_p`__4{{t@%?`1nPrm9a_6`GPWfO>n%wyHFQjyH1 z)|H)>t@9l(U@JP8`&vPkRj79YC*T)jID}_x+3}1m5k5SR$YIU#LXsoG&iE5w$tUs0 zEef1TQ>EG!!JKBIXr@7`J!$=kc^nUAsKE6Fre3&Amt~HKwWC_n5z6?{mKo1vu6o|s zLdS<{dRk8IYnkhAAbHmOHOzYOHS?QRhc<>fcnA}~D?w}S#@^^!XLd%}yKo2XoN9&T z9+@&NB$CRcbHYA0`wht=(tmju6wZ9xV2Ne)(0R!nXvFOxM{~i!LgQEW?(f)qED`>O z?XenTxOw+0`N!Qe9}s9#?pAqSyUJibL8}ukH7JOnWA)w%9{n(zmHE3HFSdsT=WZXw zb~J?r1<#((O5}uuW=db2$f9dYdPNjOFWHa#PxC6kLx#ujn z`TSO*FAloj9k)SR1$yJz0a2W%jZKSJ)EIPJ_cqnK=TmNqY2cfRn@`1YU^m`I9Taf| z$3}ENwbNg_dXTh0URoX|8U#i7KH*8!$p)%}xPp$WsUt&qXW(mHJNL!%u^ayV|iQ=+6 zTp`rT$zLsKzXGbHOz&c)#%*>p zoGmtSV1h#)DSMi;P#8NhmOwLXaO>jH@h*z)DB6&-y%kN2E0!^DQr=|wDme6H0SJH8 zyu$;Pp_ReflZ{dLh$?m5qmRJ6@sNeV#Y%>4Yt@JHPIHy88Q#ufq~=M?Rxls57-j~_ z75Ks>>5JjEqImXO!_U&OJFM{)sAlz}tMM7`fU={R5^vqlBR4~*KPhR}{`C{a^03jI zloGTBI(;;pBP`9jx#p0MP5y>D8@%h=^&%`f>ep4DQ{Mb=3IytSH0>lR$KO5{$9M{H z8gozPFxq^5{^(dhl6FLb5@INCA75#7^>H$C%E}Q`a~}V}$Q2N%b_|0u-op@nCI!oM z5T5_3KF;?IxA-~TqMKEwY!KOVY)TLs$q zeK5@NNL12C|A`>yNLYln^~cO-9cFX1aUa;(w8n!}0epi1i{|kVCJguHMkz0m%Zveu zHO8t0l)5qu855y%xlz0Y&j;i1P2AS~G90mFe{5plBIf z!Esag%T8BJDRFpHf}#TcZwsyK#C+DSDxLmXF_mjJDVs&O{^;@i#1-kLq&+To^L&(; z9TQ~U_I!Bc^limr1g6bekd!a|Dg7b?<<>^v(}^P#G+Z&q9rtrw)FPRRnHYhM>j|iw zwdr+=`ORpEbBQ5^E@%Ee?(=tsex@s!vRiTU100ys)-(&?ancAQiIt zhnLwkb|o-bds$}G#r6FYXBC^s)oL+!(|%lv+`B|AyLyT3s;6>^F~m`I@R~7^$P933Up4cMFe{8(wjV6$t zrYNfJPs=`>TmJ=B)L$bTadj;%Ep>GOJ>Xk=`E{O_e5wiWXkrr+-PdMAagPX-`v1lp z_2kZ;*ZO?>LpFS$3vAj5+wTpJ&6R<~2T%GCp8Vr6D93@Xs39eu2&x21jH-cR&&9^q_ zV||oWdxFQ*ph}OqoHBf_2u~a>H&d=xo%|#8din7tw>*U~0K2odqJhu^QX}`MH_ZcN zJPV|VG!tXhSY12;-c!}GF{q%+wHnx6!rw@`$DDMuV;;;vKqAqJp9v3E-y|u%y7_cS z7M72vtV%%2@`-jK-kRwni&ftn3|K!|1z!mT9>K(fXeEZb1QgyW7@&_M*%g!ffZFh# zdl$fcNwelM$^v%6lG+fM5T@p4r>E1)PZA_u1|5i%ZDpXa6tFkwRUL-6#mI?@ubnN< zAs=Wp6Qq9CHYkg1KV_r?kz5ylcvSv!O>omD@6ejY^_b@7*%-*FQ4+~`|_oWxxUD%gw9_{X z&gEa&5w}!RdYnESCFOBDp;^Pn6n%r$ixx&}v1U_D=I9)x(=EGAmQuo%Em|WIsKul} z=L(E2cm>s#@e~J*JErY`VcIdLe5oJ$5VN~E;pmliNdvQsljBmnSi7##M%MsZf@e;8CCmE_o@ZDpy8k*wreARF_0Y{N$E2Jz$a&jz)e#h>#>kW*sPpOfpx$}pUPX_8Oi-fanIlxv;s6;tC90+J@pp|UMJ6@ z{Bb&*X1=IPw)zkGukuMIy!tUgL{JOFR^%@nRtFDCw|-{6$d@0cq5|JH!;kG(-w2bW z^&nfDO~4)^Ug_M2^%Bi$R#!4agIFyvKnF}|$_#f1D2OfDoz`YMpRM0;Ut_N)W8iUL zBuZ+~gVc6)h5hu|$9LhgSsL%vRPTzfw;cGa3J8;)gTNVdewUly0#hLAu4pHVKbdSf zP=rcObzL8gKJn;TL40e4i{0D8F1@X87ZY84jB#VSw%uie&JAOJL({EuUkPMnzzhI7 z$z#0qz)yA7#LVpbM!Xili!@q}I=qFZWj6C%d*)mOKf#KZi6_YS-%K_2!(|C%+;#GX6IuLi_0h`c<|`T~S#rQ`Hl zl|7_mSPux+2k`n71nKD3#ztM8clj7W7`{LY>btK_@X7l?UMunbH7cR3BcSs@6ASkHiNJxv{&5vZ?0y^mjIbY^? z)K9SB4O_&6Fd&jaSXXx=zERY7-TNRB*YGB*j(GWA?q%SDE3v_j+$tE-w6SJ9KO*j{ zjNBYi(wraNGm6OJo4DxIIi8RiFX#Z4eygkFtAw)@;H^6l!W; zR=CikV*F5yK0uevTP}5Yb3}jtc2qW~O|rU#qDCTq)<^zik1A&-6v2a2?=AcGHZv}( z{_Y?1LFn0p;G1=i{zxT$%&jRcZ62z``S16 zXz#Dt^^`Q*e2l#4uKqQIxVU=}`DTz(%%?!{0mJ(|K3_YV9rv#dZF`a-=5x(x*;^X;*jt&RbNIbp<2-?Drz7 zYn#omv-Rb!A6LygXTGdU$B+n%D-n8xm)2Nfv%q`oX%RmkeIEl_nO*%|6?zh`5&caHE5hR zv0-9QnznAMa*sVfl3yl!H=oa^L6JRI626faOH=jYy7@<&rBxuQiabW61c3+Rfwn}5?yJP-Pmt1zh2{G zbl@31e21@v0ZFVrLqTiV(b6cl||R9dt@^7Fu|8Fm)4dld91 zfr=U+zdJYO`c?5k4^>oOt$ZmkU^$;B_>M2f{_6zQe`TSE2!VSH3#fe2nYU1fItvDi~tWSyKj5Hzx@{Ukijnh0Y3Ckp~rv9ukIgj z2CFI`$!Y^m9af-y_7jRwbZ0ih|}e+gb;sEggiwkBvnN26a^bIKxa>pbc09=(15AMQB4vaI?QJ zGvq@zUDJ@3n21Y;Dv|rKd0)r)W%h*asdT^)yheQi{p*YIwkE(@&aS4c!3AD zg*U-0lqmZ_dfUrJ4A07+Cl&{`Oua-mmBp2On%CpzCSE{{m@$4ry^nV#*N{{~9{|3e^}jFcpr|l#F-6{Eq$%7_FaTx21jyHe?0nIcOrS zAqk$|I%P#f03rCdgtotuw0=^N^#7SR{8YBjFdoUK(b%!>GZ$_V6jHUB;t*1RootMu zb6&;P7mKa<){lJ3(rt{IgK|j-d&x0hnLO8$98X1U)nva!*uewpszT)8YY zQSn?<8nNdY8#EUSTpS;@f1%O2A{;ofoLui*I%6k-b;Ce<7vGzG`M!^G6B%Wc_a=$= z9-Uq9J`=G$r@)L-*$*)*pXqJSbRf&$$wC3X2n3$s&m!ZW^kRz;)Gm$>)D84byT9x( zIQfzJzM$2&a@gK=S9IHN z8rdbogL4IuV=R?b26Xa|3piu^K^nRCg=|X%_kfL*C6e#c$gKUW)XA+^34z|1_VW|H zNBCw_G;2*)s@{vH^i!DnM9)gZd|1usqd%H|%v#|vjth@^H28h8Q}Q~qm%=&>1ZX&# zKAWv=mik1~9hG1~QSmLhvqbBY?ViO(xG$AQ&-G5Urkcb8NqWc4gFnSXSLQVS6x(%B zgbl;yIxkd47-?ZcVqwI=mi%-V2jwOBMbHlNvly|qKSoj|9c_c7*)8}%1-MwsK#RT@ zqtoMOye04%_g#pnTkxuKFij;Le(nSzX`)~g>Ni3 zpDnX5Hn&qR)l!V0FnOw4&T7_;Xsq5g@dAbkf5yKeSE{4PmA0_RqTK=fi2g8l&HOL; z;qxQokQ?@wu$r zlNTmtd1TNSf95`Qcb%l)Ca(usOp)=M>+av1Lk2 zk&IgfmfXHt0|0~$xZ$s1eXO)96i)3t9)uc)P zw&6;$wyr&kX%E9r1}m3r>ugZ9DH`VRwImLZdiM_QG6?m#twDY=uH^y@w_J`L>>MZN z=3=!q-t2o{zGX_OmC*ive8_73Y8+I{r%oPh(;gO6DKTcG#9m}K-koswy*+c`Q}$@} z)FM>_y=`J;LD-_w^9QmRrC(2BJw!BLD+sk(J9GuB6-1) zbPHa2-UDv1!#QU_A{FKn=R2zZ@pqF6CWyLx^soQ+(*e@=@YCHJ`OmwzC22F_sPTAW zMHjvayFt3FX;EOz3h&M0&gG89Q=K4heydt3E7@ee343BZR-RK5|A)i*jm9&sw2oTT z(cA(I7CzX#j!=XLvsBx!qAnC8ywNc{{t>>cB^f)|yTMs`YWq}|2#KOtWP~NV*@NHW zLMMgix+!lKiA9y~9UNP9&;HOw!CQ?o;0Ew$r|AFmOq2g^Z3MI&>&xG|xla(3C3T?C z?)!VvM$f^`-9@hPx{D<~<&O!jZG)`zP+_$oxW}+E$ErHMhk9#gr3(qz5jPt<48{pH*%4J|rP=63M0|tie8Pt3S9Cu65 z+K5?Adhd&%jqjGWLNBb0C7Wx!NbAS%9lFM5o|z}-wOXWhpSj2|a(8jL`P2SxD;DD+ zKI$v&Z)c}Cc8-ahNue2x0;ECh%e|kyLhCbD^!RIX(+tf(U%u7t)8}S8iR#d0-x?^4 z<)x!9YSLDzww$4|SXZJP_niuYB3%cb2NOyLbjo3b*9Rfm=LDb#>q7Kt^1MW)?ijf^ z{^!A=t9&D}HCKt_V_gwL2_tfbsjjbE?XK|Zw3jI>wb|7R*87#Rwc<}n3PjF=mAf*z z*h`IH8J=u)&Y*K;sAJM!cgtt<|dYX3o%~cBRL7E zsR(RbnvygT)Z9pTW1}fKpeuL1Q>IK6mqxiGalb_M6O1|mH>8RZ`rJW9VTRXt7R zhCq$N5!&Ge__Of94i?6*(#q9xBxz18d=5w@(J=Rf-Q#d?;M_xk$i9e zXroWIvaGi35UnTfUxQt6NG14V zgQFN&_mi#xkn;ciG!xLM213ALv}4bb--(WkzdpVh9jJ*C@$k$aTFHdA;241ThcS7K zcaH#EXdkS!^x+4zKgbIxmH+;wC@TydFi-W|2OF$doh*QV9r#bb0+SG!6LdH&XC5{y zTCiOPn>M3%E82FVfm$eFej|W`WeW|)?32x8->W)(FlitUXAvD5s|-!h*e;F?`OSnM zt4wX#Cv$id9LV^s2;270MY|!&^y7E8RO-F$F)r^-WCD~aQ~jib^?(MG>^_5yFT}U( zQ-rcDX18MF+sHLH26?lpF|ed7$1>p@1@Lc#VHdoe;S;N6pOf3(7Inppo59<%JQhm_ z*0;Bylvjh!eXIbiLzQ!zI!4mLu7^_neKeN#s_;md=jGnq*7k)^jE5h#YM3m}tht{# z$7(lo*0HY#Ke9r{kUBGDsBQjT)Q3t+$zm5?2f(zh);-38<)lMzkU-rgdcaeQc)>`% z-92pJ+pxp&;XDitWRJF$$n^@iUe%8}i;WDy#$h{<@nWSVYO&rBiTSe*-q_+cg#|)1 z+2MtqtCVGZB&$P%!0vbrwB41FqERqwDT?Pyr_E5124KU&R7r6qN>=vp+I`;%e!HaYsj{hwkoI&=T%( zs(l-hc>UyScn*1(?@HiEYas2@>^XIrI&}x(mDOO|`g2#b=civRrQQAV?R}c3E#|Iu z4SL@E@PB6&=$MZWwwXup^*S-_r8dNYl;U74t??Jfqk@X3qR@vQ%Yyg>@Cct(r-_Zj zPx?O$K(Nzz=E43t2vvv+nP9+*9l{P6YQVK?y!@>On+&5MXb^ji0#DSVI0f9DfAhqz ecunj+5gS#yhIGD^2kOTO+u;{4( diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 17ab0d9a6c..a55bdccdcb 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1590,6 +1590,16 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [UEFI CSP](uefi-csp.md)

        Added a new CSP in Windows 10, version 1803.

        + +[Update CSP](update-csp.md) +

        Added the following nodes in Windows 10, version 1803:

        +
          +
        • Rollback
          • +
        • Rollback/FeatureUpdate
          • +
        • Rollback/QualityUpdateStatus
          • +
        • Rollback/FeatureUpdateStatus
          • +
        + diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 5e471e50ba..67de432346 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/26/2017 +ms.date: 02/23/2018 --- # Update CSP @@ -76,7 +76,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **FailedUpdates/*Failed Update Guid*/RevisionNumber** -

        Added in the Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. @@ -91,7 +91,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **InstalledUpdates/*Installed Update Guid*/RevisionNumber** -

        Added in Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. @@ -135,7 +135,7 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/RevisionNumber** -

        Added in Windows 10, version 1803. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +

        Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.

        Supported operation is Get. @@ -149,6 +149,38 @@ The following diagram shows the Update configuration service provider in tree fo

        Supported operation is Get. +**Rollback** +Added in Windows 10, version 1803. Node for the rollback operations. + +**Rollback/QualityUpdate** +Added in Windows 10, version 1803. Roll back latest Quality Update, if the machine meets the following conditions: + +- Condition 1: Device must be Windows Update for Business Connected +- Condition 2: Device must be in a Paused State +- Condition 3: Device must have the Latest Quality Update installed on the device (Current State) + +If the conditions are not true, the device will not Roll Back the Latest Quality Update. + +**Rollback/FeatureUpdate** +Added in Windows 10, version 1803. Roll Back Latest Feature Update, if the machine meets the following conditions: + +- Condition 1: Device must be Windows Update for Business Connnected +- Condition 2: Device must be in Paused State +- Condition 3: Device must have the Latest Feature Update Installed on the device (Current State) +- Condition 4: Machine should be within the uninstall period + +> [!Note] +> This only works for Semi Annual Channel Targeted devices. + +If the conditions are not true, the device will not Roll Back the Latest Feature Update. + + +**Rollback/QualityUpdateStatus** +Added in Windows 10, version 1803. Returns the result of last RollBack QualityUpdate operation. + +**Rollback/FeatureUpdateStatus** +Added in Windows 10, version 1803. Returns the result of last RollBack FeatureUpdate operation. + ## Related topics [Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 00056f6fc8..b628189e10 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 02/23/2018 --- # Update DDF file @@ -16,522 +16,643 @@ This topic shows the OMA DM device description framework (DDF) for the **Update* Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the current version for this CSP. +The XML below is for Windows 10, version 1803. ``` syntax ]> + "http://www.openmobilealliance.org/tech/DTD/DM_DDF-V1_2.dtd" + []> - 1.2 + 1.2 + + Update + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.1/MDM/Update + + - Update - ./Vendor/MSFT + ApprovedUpdates + + + + + + + Approve of specific updates to be installed on a device and accept the EULA associated with the update on behalf of the end-user + + + + + + + + + + Approved Updates + + + + + + - - - - - - - - - - - - - - - + + + + UpdateID field of the UpdateIdentity is used to display relevant update metadata to IT and approved updates to be installed on the device + + + + + + + + + + Approved Update Guid + + + - ApprovedUpdates - - - - - - - Approve of specific updates to be installed on a device and accept the EULA associated with the update on behalf of the end-user - - - - - - - - - - Approved Updates - - - - - - - - - - - UpdateID field of the UpdateIdentity is used to display relevant update metadata to IT and approved updates to be installed on the device - - - - - - - - - - Approved Update Guid - - - - - - ApprovedTime - - - - - 0 - The time updates get approved - - - - - - - - - The time update get approved - - text/plain - - - - - - - FailedUpdates - - - - - Approved updates that failed to install on a device - - - - - - - - - - Failed Updates - - - - - - - - - - - UpdateID field of the UpdateIdentity GUID that represent an update that failed to install - - - - - - - - - - - - - Failed Update Guid - - - - - - HResult - - - - - 0 - Update failure error code - - - - - - - - - - HResult - - text/plain - - - - - Status - - - - - Update failure status - - - - - - - - - - - - - Failed update status - - text/plain - - - - - RevisionNumber - - - - - The revision number of the update - - - - - - - - - - Update's revision number - - text/plain - - - - - - - InstalledUpdates - - - - - Updates that are installed on the device - - - - - - - - - - Installed Updates - - - - - - - - - - - UpdateIDs that represent the updates installed on a device - - - - - - - - - - Installed Update Guid - - - - - - RevisionNumber - - - - - The revision number of the update - - - - - - - - - - Update's revision number - - text/plain - - - - - - - InstallableUpdates - - - - - Updates that are applicable and not yet installed on the device - - - - - - - - - - Installable Updates - - - - - - - - - - - UpdateIDs that represent the updates applicable and not installed on a device - - - - - - - - - - Installable Update Guid - - - - - - Type - - - - - - The UpdateClassification value of the update - Values: - 0 = None - 1 = Security - 2 = Critical - - - - - - - - - - - Type of update - - text/plain - - - - - RevisionNumber - - - - - The revision number of the update - - - - - - - - - - Update's revision number - - text/plain - - - - - - - PendingRebootUpdates - - - - - - - - - - - - - - - - - - - - - - - - Devices in the pending reboot state - - - - - - - - - - - - - Pending Reboot Update Guid - - - - - - InstalledTime - - - - - The time the update installed. - - - - - - - - - InstalledTime - - text/plain - - - - - RevisionNumber - - - - - The revision number of the update - - - - - - - - - - Update's revision number - - text/plain - - - - - - - LastSuccessfulScanTime - - - - - 0 - Last success scan time. - - - - - - - - - - - - LastSuccessfulScanTime - - text/plain - - - - - DeferUpgrade - - - - - 0 - Defer upgrades till the next upgrade period (at least a few months). - - - - - - - - - - - - - - text/plain - - + ApprovedTime + + + + + 0 + The time updates get approved + + + + + + + + + The time update get approved + + text/plain + + + + + FailedUpdates + + + + + Approved updates that failed to install on a device + + + + + + + + + + Failed Updates + + + + + + + + + + + UpdateID field of the UpdateIdentity GUID that represent an update that failed to install + + + + + + + + + + + + + Failed Update Guid + + + + + + HResult + + + + + 0 + Update failure error code + + + + + + + + + + HResult + + text/plain + + + + + Status + + + + + Update failure status + + + + + + + + + + + + + Failed update status + + text/plain + + + + + RevisionNumber + + + + + The revision number of the update + + + + + + + + + + Update's revision number + + text/plain + + + + + + + InstalledUpdates + + + + + Updates that are installed on the device + + + + + + + + + + Installed Updates + + + + + + + + + + + UpdateIDs that represent the updates installed on a device + + + + + + + + + + Installed Update Guid + + + + + + RevisionNumber + + + + + The revision number of the update + + + + + + + + + + Update's revision number + + text/plain + + + + + + + InstallableUpdates + + + + + Updates that are applicable and not yet installed on the device + + + + + + + + + + Installable Updates + + + + + + + + + + + UpdateIDs that represent the updates applicable and not installed on a device + + + + + + + + + + Installable Update Guid + + + + + + Type + + + + + + The UpdateClassification value of the update + Values: + 0 = None + 1 = Security + 2 = Critical + + + + + + + + + + + Type of update + + text/plain + + + + + RevisionNumber + + + + + The revision number of the update + + + + + + + + + + Update's revision number + + text/plain + + + + + + + PendingRebootUpdates + + + + + + + + + + + + + + + + + + + + + + + + Devices in the pending reboot state + + + + + + + + + + + + + Pending Reboot Update Guid + + + + + + InstalledTime + + + + + The time the update installed. + + + + + + + + + InstalledTime + + text/plain + + + + + RevisionNumber + + + + + The revision number of the update + + + + + + + + + + Update's revision number + + text/plain + + + + + + + LastSuccessfulScanTime + + + + + 0 + Last success scan time. + + + + + + + + + + + + LastSuccessfulScanTime + + text/plain + + + + + DeferUpgrade + + + + + 0 + Defer upgrades till the next upgrade period (at least a few months). + + + + + + + + + + + + + + text/plain + + + + + Rollback + + + + + + + + + + + + + + + + + + + QualityUpdate + + + + + + Roll back Latest Quality Update, if the machine meets the following conditions: + Condition 1: Device must be WUfB Connected + Condition 2: Device must be in a Paused State + Condition 3: Device must have the Latest Quality Update installed on the device (Current State) + If the conditions are not true, the device will not Roll Back the Latest Quality Update. + + + + + + + + + + + QualityUpdate + + text/plain + + + + + FeatureUpdate + + + + + + Roll Back Latest Feature Update, if the machine meets the following conditions: + Condition 1: Device must be WUfB Connnected + Condition 2: Device must be in Paused State + Condition 3: Device must have the Latest Feature Update Installed on the device (Current State) + Condition 4: Machine should be within the uninstall period + If the conditions are not true, the device will not Roll Back the Latest Feature Update. + + + + + + + + + + + FeatureUpdate + + text/plain + + + + + QualityUpdateStatus + + + + + Returns the result of last RollBack QualityUpdate opearation. + + + + + + + + + + QualityUpdateStatus + + text/plain + + + + + FeatureUpdateStatus + + + + + Returns the result of last RollBack FeatureUpdate opearation. + + + + + + + + + + FeatureUpdateStatus + + text/plain + + + + + ``` From bb35e048ca21d5625261d0b4788a6147e5429d96 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 26 Feb 2018 23:23:46 +0000 Subject: [PATCH 039/119] Merged PR 6031: Experience policies in Policy CSP - updated SKU suppport information --- .../mdm/policy-csp-experience.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 162e0d9065..fbdad3f72a 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 02/26/2018 --- # Policy CSP - Experience @@ -561,7 +561,7 @@ The following list shows the supported values: check mark2 check mark2 check mark2 - check mark2 + cross mark cross mark cross mark @@ -672,11 +672,11 @@ The following list shows the supported values: cross mark check mark1 - check mark1 check mark1 cross mark cross mark + cross mark @@ -781,12 +781,12 @@ The following list shows the supported values: cross mark - check mark - + cross mark check mark check mark cross mark cross mark + cross mark @@ -795,7 +795,7 @@ The following list shows the supported values: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User +> * Device

        @@ -838,11 +838,11 @@ The following list shows the supported values: cross mark cross mark - check mark1 check mark1 cross mark cross mark + cross mark @@ -896,7 +896,7 @@ The following list shows the supported values: cross mark check mark2 check mark2 - check mark2 + cross mark cross mark cross mark @@ -951,7 +951,7 @@ The following list shows the supported values: cross mark check mark2 check mark2 - check mark2 + cross mark cross mark cross mark @@ -1004,12 +1004,12 @@ The following list shows the supported values: cross mark - check mark - + cross mark check mark check mark cross mark cross mark + cross mark @@ -1055,11 +1055,11 @@ The following list shows the supported values: cross mark cross mark - check mark1 check mark1 cross mark cross mark + cross mark From 16bc0d9c7984c343ce49c6a7b01246d87dee26f9 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 26 Feb 2018 23:31:03 +0000 Subject: [PATCH 040/119] Merged PR 6032: Experience/AllowWindowsSpotlightOnSettings added to Policy CSP --- ...ew-in-windows-mdm-enrollment-management.md | 1 + .../policy-configuration-service-provider.md | 3 + .../mdm/policy-csp-experience.md | 64 + .../client-management/mdm/policy-ddf-file.md | 13185 ++++++++++++++-- 4 files changed, 11805 insertions(+), 1448 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index a55bdccdcb..55233dabcb 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1410,6 +1410,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
      • Display/DisablePerProcessDpiForApps
      • Display/EnablePerProcessDpi
      • Display/EnablePerProcessDpiForApps
        • +
      • Experience/AllowWindowsSpotlightOnSettings
          • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 3791a903e5..1d2ee6afaa 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1082,6 +1082,9 @@ The following diagram shows the Policy configuration service provider in tree fo
          Experience/AllowWindowsSpotlightOnActionCenter
          +
          + Experience/AllowWindowsSpotlightOnSettings +
          Experience/AllowWindowsSpotlightWindowsWelcomeExperience
          diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index fbdad3f72a..8d5e6e3703 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -72,6 +72,9 @@ ms.date: 02/26/2018
          Experience/AllowWindowsSpotlightOnActionCenter
          +
          + Experience/AllowWindowsSpotlightOnSettings +
          Experience/AllowWindowsSpotlightWindowsWelcomeExperience
          @@ -932,6 +935,67 @@ The following list shows the supported values:
          + +**Experience/AllowWindowsSpotlightOnSettings** + + + + + + + + + + + + + + + + + + + + + +
          HomeProBusinessEnterpriseEducationMobileMobile Enterprise
          cross markcross markcheck mark4check mark4cross mark
          + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
          + + + +Added in Windows 10, version 1083. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive. + +- User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. +- User Setting is changeable on a per user basis. +- If the Group policy is set to off, no suggestions will be shown to the user in Settings app. + + + +The following list shows the supported values: + +- 0 - Not allowed. +- 1 - Allowed. + + + + + + + + + + + +
          + **Experience/AllowWindowsSpotlightWindowsWelcomeExperience** diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 72cac2741a..406db3df06 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 02/26/2018 --- # Policy DDF file @@ -24,7 +24,7 @@ You can download the DDF files from the links below: - [Download the Policy DDF file for Windows 10, version 1607 release 8C](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) - [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) -The XML below is the DDF for Windows 10, version 1709. +The XML below is the DDF for Windows 10, version 1803. ``` syntax @@ -50,7 +50,7 @@ The XML below is the DDF for Windows 10, version 1709. - com.microsoft/6.0/MDM/Policy + com.microsoft/7.0/MDM/Policy @@ -58,8 +58,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -79,8 +79,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -125,8 +125,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -219,8 +219,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -265,8 +265,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -359,8 +359,8 @@ The XML below is the DDF for Windows 10, version 1709. - + @@ -447,6 +447,30 @@ The XML below is the DDF for Windows 10, version 1709. + + AllowConfigurationUpdateForBooksLibrary + + + + + + + + This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. + + + + + + + + + + + text/plain + + + AllowCookies @@ -875,6 +899,30 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo + + EnableExtendedBooksTelemetry + + + + + + + + This setting allows organizations to send extended telemetry on book usage from the Books Library. + + + + + + + + + + + text/plain + + + EnterpriseModeSiteList @@ -1131,6 +1179,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + PreventTabPreloading + + + + + + + + Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. + + + + + + + + + + + text/plain + + + PreventUsingLocalHostIPAddressForWebRTC @@ -1288,14 +1360,38 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + UseSharedFolderForBooks + + + + + + + + This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. + + + + + + + + + + + text/plain + + + CredentialsUI - + @@ -1340,8 +1436,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -1381,13 +1477,59 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + Display + + + + + + + + + + + + + + + + + + + + + EnablePerProcessDpi + + + + + + + + Enable or disable Per-Process System DPI for all applications. + + + + + + + + + + + text/plain + + + + Education - + @@ -1480,8 +1622,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -1646,8 +1788,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -1710,30 +1852,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - AllowWindowsConsumerFeatures - - - - - - - - - - - - - - - - - - - text/plain - - - AllowWindowsSpotlight @@ -1782,6 +1900,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + AllowWindowsSpotlightOnSettings + + + + + + + + + + + + + + + + + + + text/plain + + + AllowWindowsSpotlightWindowsWelcomeExperience @@ -1836,8 +1978,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -3508,6 +3650,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + InternetZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + + + text/plain + + + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -4828,6 +4994,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + LockedDownIntranetJavaPermissions + + + + + + + + + + + + + + + + + + + text/plain + + + LockedDownIntranetZoneAllowAccessToDataSources @@ -6652,6 +6842,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls @@ -7541,13 +7755,179 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + KioskBrowser + + + + + + + + + + + + + + + + + + + + + BlockedUrlExceptions + + + + + + + + List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. + + + + + + + + + + + text/plain + + + + + BlockedUrls + + + + + + + + List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. + + + + + + + + + + + text/plain + + + + + DefaultURL + + + + + + + + Configures the default URL kiosk browsers to navigate on launch and restart. + + + + + + + + + + + text/plain + + + + + EnableHomeButton + + + + + + + + Enable/disable kiosk browser's home button. + + + + + + + + + + + text/plain + + + + + EnableNavigationButtons + + + + + + + + Enable/disable kiosk browser's navigation buttons (forward/back). + + + + + + + + + + + text/plain + + + + + RestartOnIdleTime + + + + + + + + Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. + + + + + + + + + + + text/plain + + + + Notifications - + @@ -7592,8 +7972,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7638,8 +8018,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7684,8 +8064,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7700,6 +8080,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DisableContextMenus + + + + + + + + Enabling this policy prevents context menus from being invoked in the Start Menu. + + + + + + + + + + + text/plain + + + HidePeopleBar @@ -7754,8 +8158,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7795,6 +8199,52 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + WindowsPowerShell + + + + + + + + + + + + + + + + + + + + + TurnOnPowerShellScriptBlockLogging + + + + + + + + + + + + + + + + + + + text/plain + + + + Result @@ -7840,8 +8290,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -7854,6 +8304,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + WindowsStore.admx + WindowsStore~AT~WindowsComponents~WindowsStore + RequirePrivateStoreOnly_1 HighestValueMostSecure @@ -7883,8 +8337,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7910,8 +8364,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7937,8 +8391,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -7984,8 +8438,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -8028,8 +8482,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -8055,8 +8509,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -8082,8 +8536,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -8129,8 +8583,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. 1 + This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. @@ -8145,6 +8599,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowAddressBarDropdown LowestValueMostSecure @@ -8154,8 +8611,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. 0 + This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. @@ -8169,6 +8626,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowAutofill LowestValueMostSecure @@ -8178,8 +8638,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -8198,13 +8658,13 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - AllowCookies + AllowConfigurationUpdateForBooksLibrary - This setting lets you configure how your company deals with cookies. - 2 + 1 + This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. @@ -8217,6 +8677,35 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + LowestValueMostSecure + + + + AllowCookies + + + + + 2 + This setting lets you configure how your company deals with cookies. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + CookiesListBox + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + Cookies LowestValueMostSecure @@ -8226,8 +8715,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. 1 + This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. @@ -8242,6 +8731,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowDeveloperTools LowestValueMostSecure @@ -8251,8 +8743,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. 0 + This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. @@ -8266,6 +8758,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowDoNotTrack LowestValueMostSecure @@ -8275,8 +8770,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can load extensions in Microsoft Edge. 1 + This setting lets you decide whether employees can load extensions in Microsoft Edge. @@ -8291,6 +8786,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowExtensions LowestValueMostSecure @@ -8300,8 +8798,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. 1 + This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. @@ -8316,6 +8814,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowFlash HighestValueMostSecure @@ -8325,8 +8826,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Configure the Adobe Flash Click-to-Run setting. 1 + Configure the Adobe Flash Click-to-Run setting. @@ -8341,6 +8842,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowFlashClickToRun HighestValueMostSecure @@ -8350,8 +8854,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This setting lets you decide whether employees can browse using InPrivate website browsing. 1 + This setting lets you decide whether employees can browse using InPrivate website browsing. @@ -8365,6 +8869,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowInPrivate LowestValueMostSecure @@ -8374,12 +8881,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 1 This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - 1 @@ -8393,6 +8900,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowCVList LowestValueMostSecure @@ -8402,8 +8912,8 @@ If you disable this setting, the Microsoft Compatibility List will not be used d - This setting lets you decide whether employees can save their passwords locally, using Password Manager. 1 + This setting lets you decide whether employees can save their passwords locally, using Password Manager. @@ -8417,6 +8927,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowPasswordManager LowestValueMostSecure @@ -8426,8 +8939,8 @@ If you disable this setting, the Microsoft Compatibility List will not be used d - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. 0 + This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. @@ -8442,6 +8955,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowPopups LowestValueMostSecure @@ -8451,13 +8967,13 @@ If you disable this setting, the Microsoft Compatibility List will not be used d + 1 Allow search engine customization for MDM enrolled devices. Users can change their default search engine. If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - 1 @@ -8471,6 +8987,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSearchEngineCustomization LowestValueMostSecure @@ -8480,8 +8999,8 @@ This policy will only apply on domain joined machines or when the device is MDM - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. 1 + This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. @@ -8495,6 +9014,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSearchSuggestionsinAddressBar LowestValueMostSecure @@ -8504,8 +9026,8 @@ This policy will only apply on domain joined machines or when the device is MDM - This setting lets you decide whether to turn on Windows Defender SmartScreen. 1 + This setting lets you decide whether to turn on Windows Defender SmartScreen. @@ -8519,6 +9041,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSmartScreen LowestValueMostSecure @@ -8528,8 +9053,8 @@ This policy will only apply on domain joined machines or when the device is MDM - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. 0 + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. @@ -8543,6 +9068,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AlwaysEnableBooksLibrary LowestValueMostSecure @@ -8552,8 +9080,8 @@ This policy will only apply on domain joined machines or when the device is MDM - Specifies whether to always clear browsing history on exiting Microsoft Edge. 0 + Specifies whether to always clear browsing history on exiting Microsoft Edge. @@ -8568,6 +9096,9 @@ This policy will only apply on domain joined machines or when the device is MDM phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowClearingBrowsingDataOnExit LowestValueMostSecure @@ -8577,6 +9108,7 @@ This policy will only apply on domain joined machines or when the device is MDM + Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. @@ -8584,7 +9116,6 @@ If this setting is turned on, you can add up to 5 additional search engines for If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - @@ -8597,6 +9128,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + ConfigureAdditionalSearchEngines_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ConfigureAdditionalSearchEngines LastWrite @@ -8606,13 +9141,13 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 0 Boolean policy that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when Browser/HomePages policy is in effect. Note: This policy has no effect when Browser/HomePages is not configured. Important This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). - 0 @@ -8627,6 +9162,36 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + DisableLockdownOfStartPages + LowestValueMostSecure + + + + EnableExtendedBooksTelemetry + + + + + 0 + This setting allows organizations to send extended telemetry on book usage from the Books Library. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + EnableExtendedBooksTelemetry LowestValueMostSecure @@ -8636,8 +9201,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. @@ -8651,6 +9216,10 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain phone + MicrosoftEdge.admx + EnterSiteListPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + EnterpriseModeSiteList LastWrite @@ -8660,8 +9229,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - + @@ -8684,8 +9253,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - Configure first run URL. + Configure first run URL. @@ -8708,13 +9277,13 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo + Configure the Start page URLs for your employees. Example: If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. Encapsulate each string with greater than and less than characters like any other XML tag. Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. - @@ -8728,6 +9297,10 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, you ca text/plain phone + MicrosoftEdge.admx + HomePagesPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + HomePages LastWrite @@ -8737,6 +9310,7 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, you ca + 0 This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. @@ -8745,7 +9319,6 @@ Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - 0 @@ -8759,6 +9332,9 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + LockdownFavorites LowestValueMostSecure @@ -8768,8 +9344,8 @@ If you disable or don't configure this setting (default), employees can add, imp - Prevent access to the about:flags page in Microsoft Edge. 0 + Prevent access to the about:flags page in Microsoft Edge. @@ -8783,6 +9359,9 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventAccessToAboutFlagsInMicrosoftEdge HighestValueMostSecure @@ -8792,10 +9371,10 @@ If you disable or don't configure this setting (default), employees can add, imp + 0 Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - 0 @@ -8810,6 +9389,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventFirstRunPage HighestValueMostSecure @@ -8819,10 +9401,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 0 This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - 0 @@ -8836,6 +9418,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventLiveTileDataCollection HighestValueMostSecure @@ -8845,8 +9430,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Don't allow Windows Defender SmartScreen warning overrides 0 + Don't allow Windows Defender SmartScreen warning overrides @@ -8860,6 +9445,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventSmartScreenPromptOverride HighestValueMostSecure @@ -8869,8 +9457,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Don't allow Windows Defender SmartScreen warning overrides for unverified files. 0 + Don't allow Windows Defender SmartScreen warning overrides for unverified files. @@ -8884,6 +9472,37 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventSmartScreenPromptOverrideForFiles + HighestValueMostSecure + + + + PreventTabPreloading + + + + + 0 + Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. + + + + + + + + + + + text/plain + + + phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventTabPreloading HighestValueMostSecure @@ -8893,8 +9512,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Prevent using localhost IP address for WebRTC 0 + Prevent using localhost IP address for WebRTC @@ -8908,6 +9527,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + HideLocalHostIPAddress HighestValueMostSecure @@ -8917,6 +9539,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. @@ -8925,7 +9548,6 @@ Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - @@ -8938,6 +9560,10 @@ If you disable or don't configure this setting, employees will see the favorites text/plain + MicrosoftEdge.admx + ConfiguredFavoritesPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ConfiguredFavorites LastWrite @@ -8947,8 +9573,8 @@ If you disable or don't configure this setting, employees will see the favorites - Sends all intranet traffic over to Internet Explorer. 0 + Sends all intranet traffic over to Internet Explorer. @@ -8963,6 +9589,9 @@ If you disable or don't configure this setting, employees will see the favorites phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SendIntranetTraffictoInternetExplorer HighestValueMostSecure @@ -8972,6 +9601,7 @@ If you disable or don't configure this setting, employees will see the favorites + Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. @@ -8979,7 +9609,6 @@ If this setting is turned on, you are setting the default search engine that you If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - @@ -8992,6 +9621,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + SetDefaultSearchEngine_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SetDefaultSearchEngine LastWrite @@ -9001,8 +9634,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Show message when opening sites in Internet Explorer 0 + Show message when opening sites in Internet Explorer @@ -9017,6 +9650,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ShowMessageWhenOpeningSitesInInternetExplorer HighestValueMostSecure @@ -9026,8 +9662,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. 0 + Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. @@ -9042,6 +9678,36 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SyncFavoritesBetweenIEAndMicrosoftEdge + LowestValueMostSecure + + + + UseSharedFolderForBooks + + + + + 0 + This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + UseSharedFolderForBooks LowestValueMostSecure @@ -9071,8 +9737,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9118,8 +9784,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9140,6 +9806,55 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + Display + + + + + + + + + + + + + + + + + + + EnablePerProcessDpi + + + + + + Enable or disable Per-Process System DPI for all applications. + + + + + + + + + + + text/plain + + + phone + Display.admx + DisplayGlobalPerProcessSystemDpiSettings + Display~AT~System~DisplayCat + DisplayPerProcessSystemDpiSettings + LowestValueMostSecure + + + Education @@ -9165,8 +9880,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This policy sets user's default printer + This policy sets user's default printer @@ -9188,8 +9903,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Boolean that specifies whether or not to prevent user to install new printers 0 + Boolean that specifies whether or not to prevent user to install new printers @@ -9203,6 +9918,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + Printing.admx + Printing~AT~ControlPanel~CplPrinters + NoAddPrinter HighestValueMostSecure @@ -9212,8 +9930,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This policy provisions per-user network printers + This policy provisions per-user network printers @@ -9255,8 +9973,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This policy provisions per-user discovery end point to discover cloud printers + This policy provisions per-user discovery end point to discover cloud printers @@ -9278,8 +9996,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Authentication endpoint for acquiring OAuth tokens + Authentication endpoint for acquiring OAuth tokens @@ -9301,8 +10019,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority + A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority @@ -9324,8 +10042,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication + Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication @@ -9347,8 +10065,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Defines the maximum number of printers that should be queried from discovery end point 20 + Defines the maximum number of printers that should be queried from discovery end point @@ -9361,6 +10079,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -9370,8 +10089,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication + Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication @@ -9413,8 +10132,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -9428,6 +10147,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableTailoredExperiencesWithDiagnosticData LowestValueMostSecure @@ -9437,33 +10159,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowWindowsConsumerFeatures - - - - - 0 @@ -9478,6 +10175,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableThirdPartySuggestions LowestValueMostSecure @@ -9487,8 +10187,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -9503,6 +10203,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableWindowsSpotlightFeatures LowestValueMostSecure @@ -9512,8 +10215,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -9527,6 +10230,36 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableWindowsSpotlightOnActionCenter + LowestValueMostSecure + + + + AllowWindowsSpotlightOnSettings + + + + + 1 + + + + + + + + + + + + text/plain + + + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableWindowsSpotlightOnSettings LowestValueMostSecure @@ -9536,8 +10269,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -9551,6 +10284,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableWindowsSpotlightWindowsWelcomeExperience LowestValueMostSecure @@ -9560,8 +10296,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -9574,7 +10310,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + ConfigureWindowsSpotlight LowestValueMostSecure @@ -9604,8 +10344,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9631,8 +10371,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9658,8 +10398,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9685,8 +10425,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9712,8 +10452,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9739,8 +10479,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9766,8 +10506,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9793,8 +10533,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9820,8 +10560,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9847,8 +10587,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9874,8 +10614,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9901,8 +10641,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9928,8 +10668,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9955,8 +10695,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -9982,8 +10722,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10009,8 +10749,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10036,8 +10776,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10063,8 +10803,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10090,8 +10830,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10117,8 +10857,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10144,8 +10884,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10171,8 +10911,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10198,8 +10938,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10225,8 +10965,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10252,8 +10992,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10279,8 +11019,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10306,8 +11046,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10333,8 +11073,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10349,8 +11089,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryBinaryBehaviorSecurityRestriction - IESF_PolicyExplorerProcesses_2 + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryConsistentMimeHandling + IESF_PolicyExplorerProcesses_5 LastWrite @@ -10360,8 +11100,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10387,8 +11127,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10414,8 +11154,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10441,8 +11181,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10468,8 +11208,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10495,8 +11235,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10522,8 +11262,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10549,8 +11289,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10576,8 +11316,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10603,8 +11343,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10630,8 +11370,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10657,8 +11397,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10684,8 +11424,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10711,8 +11451,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10738,8 +11478,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10765,8 +11505,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10792,8 +11532,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10819,8 +11559,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10846,8 +11586,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10873,8 +11613,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10900,8 +11640,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10927,8 +11667,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10954,8 +11694,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -10981,8 +11721,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11008,8 +11748,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11035,8 +11775,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11062,8 +11802,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11089,8 +11829,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11116,8 +11856,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11143,8 +11883,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11170,8 +11910,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11197,8 +11937,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11224,8 +11964,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11251,8 +11991,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11278,8 +12018,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11305,8 +12045,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11332,8 +12072,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11359,8 +12099,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11386,8 +12126,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11413,8 +12153,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11440,8 +12180,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11461,14 +12201,41 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + InternetZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyAllowVBScript_1 + LastWrite + + InternetZoneDoNotRunAntimalwareAgainstActiveXControls - + @@ -11494,8 +12261,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11521,8 +12288,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11548,8 +12315,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11575,8 +12342,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11602,8 +12369,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11629,8 +12396,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11656,8 +12423,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11683,8 +12450,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11710,8 +12477,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11737,8 +12504,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11764,8 +12531,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11791,8 +12558,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11818,8 +12585,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11845,8 +12612,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11872,8 +12639,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11899,8 +12666,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11926,8 +12693,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11953,8 +12720,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -11980,8 +12747,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12007,8 +12774,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12034,8 +12801,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12061,8 +12828,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12088,8 +12855,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12115,8 +12882,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12142,8 +12909,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12169,8 +12936,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12196,8 +12963,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12223,8 +12990,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12250,8 +13017,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12277,8 +13044,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12304,8 +13071,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12331,8 +13098,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12358,8 +13125,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12385,8 +13152,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12412,8 +13179,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12439,8 +13206,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12466,8 +13233,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12493,8 +13260,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12520,8 +13287,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12547,8 +13314,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12574,8 +13341,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12601,8 +13368,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12628,8 +13395,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12655,8 +13422,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12682,8 +13449,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12709,8 +13476,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12736,8 +13503,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12763,8 +13530,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12790,8 +13557,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12817,8 +13584,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12844,8 +13611,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12871,8 +13638,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12898,8 +13665,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12925,8 +13692,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -12946,14 +13713,41 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + LockedDownIntranetJavaPermissions + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown + IZ_PolicyJavaPermissions_4 + LastWrite + + LockedDownIntranetZoneAllowAccessToDataSources - + @@ -12979,8 +13773,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13006,8 +13800,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13033,8 +13827,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13060,8 +13854,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13087,8 +13881,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13114,8 +13908,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13141,8 +13935,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13168,8 +13962,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13195,8 +13989,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13222,8 +14016,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13249,8 +14043,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13276,8 +14070,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13303,8 +14097,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13330,8 +14124,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13357,8 +14151,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13384,8 +14178,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13411,8 +14205,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13438,8 +14232,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13465,8 +14259,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13492,8 +14286,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13519,8 +14313,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13546,8 +14340,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13573,8 +14367,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13600,8 +14394,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13627,8 +14421,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13654,8 +14448,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13681,8 +14475,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13708,8 +14502,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13735,8 +14529,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13762,8 +14556,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13789,8 +14583,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13816,8 +14610,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13843,8 +14637,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13870,8 +14664,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13897,8 +14691,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13924,8 +14718,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13951,8 +14745,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -13978,8 +14772,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14005,8 +14799,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14032,8 +14826,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14059,8 +14853,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14086,8 +14880,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14113,8 +14907,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14140,8 +14934,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14167,8 +14961,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14194,8 +14988,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14221,8 +15015,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14248,8 +15042,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14275,8 +15069,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14302,8 +15096,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14329,8 +15123,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14356,8 +15150,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14383,8 +15177,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14410,8 +15204,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14437,8 +15231,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14464,8 +15258,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14491,8 +15285,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14518,8 +15312,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14545,8 +15339,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14572,8 +15366,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14599,8 +15393,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14626,8 +15420,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14653,8 +15447,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14680,8 +15474,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14707,8 +15501,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14734,8 +15528,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14761,8 +15555,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14788,8 +15582,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14815,8 +15609,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14842,8 +15636,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14869,8 +15663,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14896,8 +15690,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14923,8 +15717,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14950,8 +15744,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14977,8 +15771,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -14998,14 +15792,41 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyAllowVBScript_7 + LastWrite + + RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - + @@ -15031,8 +15852,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15058,8 +15879,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15085,8 +15906,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15112,8 +15933,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15139,8 +15960,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15166,8 +15987,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15193,8 +16014,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15220,8 +16041,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15247,8 +16068,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15274,8 +16095,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15301,8 +16122,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15328,8 +16149,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15355,8 +16176,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15382,8 +16203,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15409,8 +16230,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15436,8 +16257,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15463,8 +16284,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15490,8 +16311,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15517,8 +16338,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15544,8 +16365,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15571,8 +16392,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15598,8 +16419,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15625,8 +16446,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15652,8 +16473,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15679,8 +16500,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15706,8 +16527,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15733,8 +16554,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15760,8 +16581,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15787,8 +16608,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15814,8 +16635,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15841,8 +16662,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15868,8 +16689,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15895,8 +16716,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15922,8 +16743,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15949,8 +16770,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15976,8 +16797,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -15998,6 +16819,173 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + KioskBrowser + + + + + + + + + + + + + + + + + + + BlockedUrlExceptions + + + + + + List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + BlockedUrls + + + + + + List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + DefaultURL + + + + + + Configures the default URL kiosk browsers to navigate on launch and restart. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + EnableHomeButton + + + + + 0 + Enable/disable kiosk browser's home button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + + + EnableNavigationButtons + + + + + 0 + Enable/disable kiosk browser's navigation buttons (forward/back). + + + + + + + + + + + text/plain + + + phone + LastWrite + + + + RestartOnIdleTime + + + + + 0 + Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. + + + + + + + + + + + text/plain + + + phone + LastWrite + + + Notifications @@ -16023,8 +17011,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -16038,6 +17026,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + WPN.admx + WPN~AT~StartMenu~NotificationsCategory + NoNotificationMirroring LowestValueMostSecure @@ -16067,8 +17058,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16114,8 +17105,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -16128,6 +17119,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + Taskbar.admx + Taskbar~AT~StartMenu~TPMCategory + ConfigureTaskbarCalendar LastWrite @@ -16152,13 +17147,13 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - HidePeopleBar + DisableContextMenus - Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. 0 + Enabling this policy prevents context menus from being invoked in the Start Menu. @@ -16173,6 +17168,37 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + StartMenu.admx + StartMenu~AT~StartMenu + DisableContextMenusInStart + LowestValueMostSecure + + + + HidePeopleBar + + + + + 0 + Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. + + + + + + + + + + + text/plain + + + phone + StartMenu.admx + StartMenu~AT~StartMenu + HidePeopleBar LowestValueMostSecure @@ -16182,8 +17208,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16197,6 +17223,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + StartMenu.admx + StartMenu~AT~StartMenu + LockedStartLayout LastWrite @@ -16226,8 +17255,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 3 + @@ -16240,10 +17269,62 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + DataCollection.admx + AllowTelemetry + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowTelemetry LowestValueMostSecure + + WindowsPowerShell + + + + + + + + + + + + + + + + + + + TurnOnPowerShellScriptBlockLogging + + + + + + + + + + + + + + + + + text/plain + + phone + PowerShellExecutionPolicy.admx + PowerShellExecutionPolicy~AT~WindowsComponents~PowerShell + EnableScriptBlockLogging + LastWrite + + + @@ -16263,7 +17344,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - com.microsoft/6.0/MDM/Policy + com.microsoft/7.0/MDM/Policy @@ -16271,8 +17352,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + Policy CSP ConfigOperations @@ -16293,8 +17374,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + Win32 App ADMX Ingestion @@ -16315,8 +17396,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + Win32 App Name @@ -16337,8 +17418,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + Setting Type of Win32 App. Policy Or Preference @@ -16359,8 +17440,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + Unique ID of ADMX file @@ -16386,8 +17467,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16407,8 +17488,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16501,8 +17582,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16619,8 +17700,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16665,8 +17746,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -16705,14 +17786,38 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + EnableAppUriHandlers + + + + + + + + Enables web-to-app linking, which allows apps to be launched with a http(s) URI + + + + + + + + + + + text/plain + + + ApplicationManagement - + @@ -16968,13 +18073,59 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + AppRuntime + + + + + + + + + + + + + + + + + + + + + AllowMicrosoftAccountsToBeOptional + + + + + + + + + + + + + + + + + + + text/plain + + + + AppVirtualization - + @@ -17667,8 +18818,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -17731,30 +18882,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - AllowFidoDeviceSignon - - - - - - - - Specifies whether FIDO device can be used to sign on. - - - - - - - - - - - text/plain - - - AllowSecondaryAuthenticationDevice @@ -17785,8 +18912,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -17879,8 +19006,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -17925,8 +19052,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -18013,6 +19140,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + AllowPromptedProximalConnections + + + + + + + + + + + + + + + + + + + text/plain + + + LocalDeviceName @@ -18067,8 +19218,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -18155,6 +19306,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + AllowConfigurationUpdateForBooksLibrary + + + + + + + + This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. + + + + + + + + + + + text/plain + + + AllowCookies @@ -18583,6 +19758,30 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo + + EnableExtendedBooksTelemetry + + + + + + + + This setting allows organizations to send extended telemetry on book usage from the Books Library. + + + + + + + + + + + text/plain + + + EnterpriseModeSiteList @@ -18839,6 +20038,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + PreventTabPreloading + + + + + + + + Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. + + + + + + + + + + + text/plain + + + PreventUsingLocalHostIPAddressForWebRTC @@ -18996,14 +20219,38 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + UseSharedFolderForBooks + + + + + + + + This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. + + + + + + + + + + + text/plain + + + Camera - + @@ -19048,8 +20295,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -19121,7 +20368,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19145,7 +20392,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19190,8 +20437,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -19326,6 +20573,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + AllowPhonePCLinking + + + + + + + + + + + + + + + + + + + text/plain + + + AllowUSBConnection @@ -19544,12 +20815,56 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - CredentialProviders + ControlPolicyConflict + + + + + + + + + + + + + + + + MDMWinsOverGP + + + + + + + If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC + + + + + + + + + + + text/plain + + + + + + CredentialProviders + + + + @@ -19637,13 +20952,59 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + CredentialsDelegation + + + + + + + + + + + + + + + + + + + + + RemoteHostAllowsDelegationOfNonExportableCredentials + + + + + + + + + + + + + + + + + + + text/plain + + + + CredentialsUI - + @@ -19712,8 +21073,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -19782,8 +21143,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -19852,8 +21213,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -19922,8 +21283,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -20784,8 +22145,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -20849,7 +22210,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - DOCacheHost + DODelayBackgroundDownloadFromHttp @@ -20859,7 +22220,31 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + + + + + + + + + + text/plain + + + + + DODelayForegroundDownloadFromHttp + + + + + + + + + + @@ -20920,6 +22305,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DOGroupIdSource + + + + + + + + + + + + + + + + + + + text/plain + + + DOMaxCacheAge @@ -21184,6 +22593,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DOPercentageMaxBackgroundBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + DOPercentageMaxDownloadBandwidth @@ -21208,14 +22641,110 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DOPercentageMaxForegroundBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + + + DORestrictPeerSelectionBy + + + + + + + + + + + + + + + + + + + text/plain + + + + + DOSetHoursToLimitBackgroundDownloadBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + + + DOSetHoursToLimitForegroundDownloadBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + DeviceGuard - + @@ -21308,8 +22837,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -21378,8 +22907,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -21758,6 +23287,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + PreventEnablingLockScreenCamera + + + + + + + + + + + + + + + + + + + text/plain + + + PreventLockScreenSlideShow @@ -21812,8 +23365,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -21828,6 +23381,78 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisablePerProcessDpiForApps + + + + + + + + This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + + + + + + + + + + + text/plain + + + + + EnablePerProcessDpi + + + + + + + + Enable or disable Per-Process System DPI for all applications. + + + + + + + + + + + text/plain + + + + + EnablePerProcessDpiForApps + + + + + + + + This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + + + + + + + + + + + text/plain + + + TurnOffGdiDPIScalingForApps @@ -21882,8 +23507,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -22024,8 +23649,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -22142,8 +23767,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -22446,6 +24071,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + AllowWindowsConsumerFeatures + + + + + + + + + + + + + + + + + + + text/plain + + + AllowWindowsTips @@ -22500,8 +24149,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -22541,13 +24190,83 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + FileExplorer + + + + + + + + + + + + + + + + + + + + + TurnOffDataExecutionPreventionForExplorer + + + + + + + + + + + + + + + + + + + text/plain + + + + + TurnOffHeapTerminationOnCorruption + + + + + + + + + + + + + + + + + + + text/plain + + + + Games - + @@ -22592,8 +24311,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -22638,8 +24357,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -24358,6 +26077,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + InternetZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + + + text/plain + + + InternetZoneDoNotRunAntimalwareAgainstActiveXControls @@ -25678,6 +27421,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + LockedDownIntranetJavaPermissions + + + + + + + + + + + + + + + + + + + text/plain + + + LockedDownIntranetZoneAllowAccessToDataSources @@ -27502,6 +29269,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls @@ -28055,7 +29846,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - SecurityZonesUseOnlyMachineSettings + SecurityZonesUseOnlyMachineSettings @@ -28420,8 +30211,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -28557,13 +30348,179 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + KioskBrowser + + + + + + + + + + + + + + + + + + + + + BlockedUrlExceptions + + + + + + + + List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. + + + + + + + + + + + text/plain + + + + + BlockedUrls + + + + + + + + List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. + + + + + + + + + + + text/plain + + + + + DefaultURL + + + + + + + + Configures the default URL kiosk browsers to navigate on launch and restart. + + + + + + + + + + + text/plain + + + + + EnableHomeButton + + + + + + + + Enable/disable kiosk browser's home button. + + + + + + + + + + + text/plain + + + + + EnableNavigationButtons + + + + + + + + Enable/disable kiosk browser's navigation buttons (forward/back). + + + + + + + + + + + text/plain + + + + + RestartOnIdleTime + + + + + + + + Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. + + + + + + + + + + + text/plain + + + + Licensing - + @@ -28632,8 +30589,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -28958,6 +30915,225 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l + + DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways + + + + + + + + Domain member: Digitally encrypt or sign secure channel data (always) + +This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: + +Domain member: Digitally encrypt secure channel data (when possible) +Domain member: Digitally sign secure channel data (when possible) + +Default: Enabled. + +Notes: + +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. + + + + + + + + + + + text/plain + + + + + DomainMember_DigitallyEncryptSecureChannelDataWhenPossible + + + + + + + + Domain member: Digitally encrypt secure channel data (when possible) + +This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. + +Default: Enabled. + +Important + +There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. + +Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. + + + + + + + + + + + text/plain + + + + + DomainMember_DigitallySignSecureChannelDataWhenPossible + + + + + + + + Domain member: Digitally sign secure channel data (when possible) + +This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. + +Default: Enabled. + + + + + + + + + + + text/plain + + + + + DomainMember_DisableMachineAccountPasswordChanges + + + + + + + + Domain member: Disable machine account password changes + +Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. + +Default: Disabled. + +Notes + +This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. +This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. + + + + + + + + + + + text/plain + + + + + DomainMember_MaximumMachineAccountPasswordAge + + + + + + + + Domain member: Maximum machine account password age + +This security setting determines how often a domain member will attempt to change its computer account password. + +Default: 30 days. + +Important + +This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. + + + + + + + + + + + text/plain + + + + + DomainMember_RequireStrongSessionKey + + + + + + + + Domain member: Require strong (Windows 2000 or later) session key + +This security setting determines whether 128-bit key strength is required for encrypted secure channel data. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. + +Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: + +Domain member: Digitally encrypt or sign secure channel data (always) +Domain member: Digitally encrypt secure channel data (when possible) +Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. + +If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. + +Default: Enabled. + +Important + +In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. +In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. + + + + + + + + + + + text/plain + + + InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -29164,6 +31340,404 @@ Default: No message. + + InteractiveLogon_SmartCardRemovalBehavior + + + + + + + + Interactive logon: Smart card removal behavior + +This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. + +The options are: + + No Action + Lock Workstation + Force Logoff + Disconnect if a Remote Desktop Services session + +If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. + +If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. + +If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. + +Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + +Default: This policy is not defined, which means that the system treats it as No action. + +On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkClient_DigitallySignCommunicationsAlways + + + + + + + + Microsoft network client: Digitally sign communications (always) + +This security setting determines whether packet signing is required by the SMB client component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. + +Default: Disabled. + +Important + +For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees + + + + + + + + Microsoft network client: Digitally sign communications (if server agrees) + +This security setting determines whether the SMB client attempts to negotiate SMB packet signing. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. + +If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. + +Default: Enabled. + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers + + + + + + + + Microsoft network client: Send unencrypted password to connect to third-party SMB servers + +If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication. + +Sending unencrypted passwords is a security risk. + +Default: Disabled. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession + + + + + + + + Microsoft network server: Amount of idle time required before suspending a session + +This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. + +Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. + +For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. + +Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkServer_DigitallySignCommunicationsAlways + + + + + + + + Microsoft network server: Digitally sign communications (always) + +This security setting determines whether packet signing is required by the SMB server component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. + +If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server. + +Default: + +Disabled for member servers. +Enabled for domain controllers. + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. +If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. + +Important + +For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: +Microsoft network server: Digitally sign communications (if server agrees) + +For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: +HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + + + MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees + + + + + + + + Microsoft network server: Digitally sign communications (if client agrees) + +This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. + +If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. + +Default: Enabled on domain controllers only. + +Important + +For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + + + NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts + + + + + + + + Network access: Do not allow anonymous enumeration of SAM accounts + +This security setting determines what additional permissions will be granted for anonymous connections to the computer. + +Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. + +This security option allows additional restrictions to be placed on anonymous connections as follows: + +Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. +Disabled: No additional restrictions. Rely on default permissions. + +Default on workstations: Enabled. +Default on server:Enabled. + +Important + +This policy has no impact on domain controllers. + + + + + + + + + + + text/plain + + + + + NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares + + + + + + + + Network access: Do not allow anonymous enumeration of SAM accounts and shares + +This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. + +Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. + +Default: Disabled. + + + + + + + + + + + text/plain + + + + + NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares + + + + + + + + Network access: Restrict anonymous access to Named Pipes and Shares + +When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: + +Network access: Named pipes that can be accessed anonymously +Network access: Shares that can be accessed anonymously +Default: Enabled. + + + + + + + + + + + text/plain + + + NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM @@ -29220,6 +31794,161 @@ This policy will be turned off by default on domain joined machines. This would + + NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange + + + + + + + + Network security: Do not store LAN Manager hash value on next password change + +This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. + + +Default on Windows Vista and above: Enabled +Default on Windows XP: Disabled. + +Important + +Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. +This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_LANManagerAuthenticationLevel + + + + + + + + Network security LAN Manager authentication level + +This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: + +Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). + +Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). + +Important + +This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. + +Default: + +Windows 2000 and windows XP: send LM and NTLM responses + +Windows Server 2003: Send NTLM response only + +Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only + + + + + + + + + + + text/plain + + + + + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients + + + + + + + + Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + +This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. +Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + + + + + + + + + text/plain + + + + + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers + + + + + + + + Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + +This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + + + + + + + + + text/plain + + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn @@ -29624,8 +32353,8 @@ The options are: - + @@ -29670,8 +32399,8 @@ The options are: - + @@ -29716,8 +32445,8 @@ The options are: - + @@ -29786,8 +32515,8 @@ The options are: - + @@ -29875,13 +32604,273 @@ The options are: + + MSSecurityGuide + + + + + + + + + + + + + + + + + + + + + ApplyUACRestrictionsToLocalAccountsOnNetworkLogon + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureSMBV1ClientDriver + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureSMBV1Server + + + + + + + + + + + + + + + + + + + text/plain + + + + + EnableStructuredExceptionHandlingOverwriteProtection + + + + + + + + + + + + + + + + + + + text/plain + + + + + WDigestAuthentication + + + + + + + + + + + + + + + + + + + text/plain + + + + + + MSSLegacy + + + + + + + + + + + + + + + + + + + + + AllowICMPRedirectsToOverrideOSPFGeneratedRoutes + + + + + + + + + + + + + + + + + + + text/plain + + + + + AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers + + + + + + + + + + + + + + + + + + + text/plain + + + + + IPSourceRoutingProtectionLevel + + + + + + + + + + + + + + + + + + + text/plain + + + + + IPv6SourceRoutingProtectionLevel + + + + + + + + + + + + + + + + + + + text/plain + + + + NetworkIsolation - + @@ -30090,12 +33079,12 @@ The options are: - Power + Notifications - + @@ -30110,6 +33099,76 @@ The options are: + + DisallowCloudNotification + + + + + + + + + + + + + + + + + + + text/plain + + + + + + Power + + + + + + + + + + + + + + + + + + + + + AllowStandbyStatesWhenSleepingOnBattery + + + + + + + + + + + + + + + + + + + text/plain + + + AllowStandbyWhenSleepingPluggedIn @@ -30332,8 +33391,8 @@ The options are: - + @@ -30402,8 +33461,8 @@ The options are: - + @@ -30835,7 +33894,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -30859,7 +33918,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -30883,7 +33942,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -30931,7 +33990,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -30955,7 +34014,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -30979,7 +34038,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31027,7 +34086,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31051,7 +34110,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31075,7 +34134,103 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessGazeInput + + + + + + + + This policy setting specifies whether Windows apps can access the eye tracker. + + + + + + + + + + + text/plain + + + + + LetAppsAccessGazeInput_ForceAllowTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessGazeInput_ForceDenyTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessGazeInput_UserInControlOfTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. @@ -31123,7 +34278,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31147,7 +34302,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31171,7 +34326,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31219,7 +34374,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31243,7 +34398,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31267,7 +34422,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31315,7 +34470,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -31339,7 +34494,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -31363,7 +34518,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -31411,7 +34566,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -31435,7 +34590,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -31459,7 +34614,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -31507,7 +34662,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -31531,7 +34686,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -31555,7 +34710,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -31603,7 +34758,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -31627,7 +34782,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -31651,7 +34806,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -31699,7 +34854,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -31723,7 +34878,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -31747,7 +34902,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -31795,7 +34950,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -31819,7 +34974,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -31843,7 +34998,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -31891,7 +35046,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -31915,7 +35070,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -31939,7 +35094,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32179,7 +35334,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32203,7 +35358,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32227,7 +35382,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32266,14 +35421,38 @@ The options are: + + UploadUserActivities + + + + + + + + Allows ActivityFeed to upload published 'User Activities'. + + + + + + + + + + + text/plain + + + RemoteAssistance - + @@ -32390,8 +35569,8 @@ The options are: - + @@ -32556,8 +35735,8 @@ The options are: - + @@ -32938,8 +36117,8 @@ The options are: - + @@ -33008,8 +36187,8 @@ The options are: - + @@ -33193,13 +36372,60 @@ The options are: + + RestrictedGroups + + + + + + + + + + + + + + + + + + + + + ConfigureGroupMembership + + + + + + + + This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. +Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. + + + + + + + + + + + text/plain + + + + Search - + @@ -33238,6 +36464,30 @@ The options are: + + AllowCortanaInAAD + + + + + + + + This features allows you to show the cortana opt-in page during Windows Setup + + + + + + + + + + + text/plain + + + AllowIndexingEncryptedStoresOrItems @@ -33430,6 +36680,30 @@ The options are: + + DoNotUseWebResults + + + + + + + + + + + + + + + + + + + text/plain + + + PreventIndexingLowDiskSpaceMB @@ -33508,8 +36782,8 @@ The options are: - + @@ -33644,6 +36918,30 @@ The options are: + + ConfigureWindowsPasswords + + + + + + + + Configures the use of passwords for Windows features + + + + + + + + + + + text/plain + + + PreventAutomaticDeviceEncryptionForAzureADJoinedDevices @@ -33746,8 +37044,8 @@ The options are: - + @@ -34080,8 +37378,8 @@ The options are: - + @@ -34174,8 +37472,8 @@ The options are: - + @@ -34220,8 +37518,8 @@ The options are: - + @@ -34476,6 +37774,30 @@ The options are: + + DisableContextMenus + + + + + + + + Enabling this policy prevents context menus from being invoked in the Start Menu. + + + + + + + + + + + text/plain + + + ForceStartSize @@ -34914,8 +38236,8 @@ The options are: - + @@ -34984,8 +38306,8 @@ The options are: - + @@ -35216,6 +38538,54 @@ The options are: + + ConfigureTelemetryOptInChangeNotification + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureTelemetryOptInSettingsUx + + + + + + + + + + + + + + + + + + + text/plain + + + DisableEnterpriseAuthProxy @@ -35249,7 +38619,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. @@ -35321,7 +38691,7 @@ The options are: - This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced) When you configure these policy settings, a Basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: https://go.microsoft.com/fwlink/?linkid=847594. Enabling Enhanced diagnostic data in the Allow Telemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional Enhanced level telemetry data. This setting has no effect on computers configured to send Full, Basic or Security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy. + This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. By configuring this setting, you're not stopping people from changing their Telemetry Settings; however, you are stopping them from choosing a higher level than you've set for the organization. To enable this behavior, you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced).If you configure these policy settings together, you'll send the Basic level of diagnostic data plus any additional events that are required for Windows Analytics, to Microsoft. The additional events are documented here: https://go.Microsoft.com/fwlink/?linked=847594. If you enable Enhanced diagnostic data in the Allow Telemetry policy setting, but you don't configure this policy setting, you'll send the required events for Windows Analytics, plus any additional Enhanced level telemetry data to Microsoft. This setting has no effect on computers configured to send Full, Basic, or Security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy setting. @@ -35362,12 +38732,12 @@ The options are: - TextInput + SystemServices - + @@ -35382,6 +38752,242 @@ The options are: + + ConfigureHomeGroupListenerServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + ConfigureHomeGroupProviderServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + ConfigureXboxAccessoryManagementServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + ConfigureXboxLiveAuthManagerServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + ConfigureXboxLiveGameSaveServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + ConfigureXboxLiveNetworkingServiceStartupMode + + + + + + + + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + + + + TaskScheduler + + + + + + + + + + + + + + + + + + + + + EnableXboxGameSaveTask + + + + + + + + This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. + + + + + + + + + + + text/plain + + + + + + TextInput + + + + + + + + + + + + + + + + + + + + + AllowHardwareKeyboardTextSuggestions + + + + + + + + + + + + + + + + + + + text/plain + + + AllowIMELogging @@ -35598,6 +39204,54 @@ The options are: + + AllowLinguisticDataCollection + + + + + + + + + + + + + + + + + + + text/plain + + + + + EnableTouchKeyboardAutoInvokeInDesktopMode + + + + + + + + + + + + + + + + + + + text/plain + + + ExcludeJapaneseIMEExceptJIS0208 @@ -35670,14 +39324,206 @@ The options are: + + ForceTouchKeyboardDockedState + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardDictationButtonAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardEmojiButtonAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardFullModeAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardHandwritingModeAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardNarrowModeAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardSplitModeAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + + + TouchKeyboardWideModeAvailability + + + + + + + + + + + + + + + + + + + text/plain + + + TimeLanguageSettings - + @@ -35722,8 +39568,8 @@ The options are: - + @@ -36026,6 +39872,30 @@ The options are: + + ConfigureFeatureUpdateUninstallPeriod + + + + + + + + Enable enterprises/IT admin to configure feature update uninstall period + + + + + + + + + + + text/plain + + + DeferFeatureUpdatesPeriodInDays @@ -36867,13 +40737,735 @@ The options are: + + UserRights + + + + + + + + + + + + + + + + + + + + + AccessCredentialManagerAsTrustedCaller + + + + + + + + This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. + + + + + + + + + + + text/plain + + + + + AccessFromNetwork + + + + + + + + This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + + + + + + + + + + + text/plain + + + + + ActAsPartOfTheOperatingSystem + + + + + + + + This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + + + + + + + + + + + text/plain + + + + + AllowLocalLogOn + + + + + + + + This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. + + + + + + + + + + + text/plain + + + + + BackupFilesAndDirectories + + + + + + + + This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users + + + + + + + + + + + text/plain + + + + + ChangeSystemTime + + + + + + + + This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. + + + + + + + + + + + text/plain + + + + + CreateGlobalObjects + + + + + + + + This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. + + + + + + + + + + + text/plain + + + + + CreatePageFile + + + + + + + + This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users + + + + + + + + + + + text/plain + + + + + CreatePermanentSharedObjects + + + + + + + + This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. + + + + + + + + + + + text/plain + + + + + CreateSymbolicLinks + + + + + + + + This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. + + + + + + + + + + + text/plain + + + + + CreateToken + + + + + + + + This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + + + + + + + + + + + text/plain + + + + + DebugPrograms + + + + + + + + This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + + + + + + + + + + + text/plain + + + + + DenyAccessFromNetwork + + + + + + + + This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. + + + + + + + + + + + text/plain + + + + + DenyLocalLogOn + + + + + + + + This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. + + + + + + + + + + + text/plain + + + + + DenyRemoteDesktopServicesLogOn + + + + + + + + This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. + + + + + + + + + + + text/plain + + + + + EnableDelegation + + + + + + + + This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. + + + + + + + + + + + text/plain + + + + + GenerateSecurityAudits + + + + + + + + This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. + + + + + + + + + + + text/plain + + + + + ImpersonateClient + + + + + + + + Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. +1) The access token that is being impersonated is for this user. +2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. +3) The requested level is less than Impersonate, such as Anonymous or Identify. +Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. + + + + + + + + + + + text/plain + + + + + IncreaseSchedulingPriority + + + + + + + + This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. + + + + + + + + + + + text/plain + + + + + LoadUnloadDeviceDrivers + + + + + + + + This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + + + + + + + + + + + text/plain + + + + + LockMemory + + + + + + + + This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). + + + + + + + + + + + text/plain + + + + + ManageAuditingAndSecurityLog + + + + + + + + This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. + + + + + + + + + + + text/plain + + + + + ManageVolume + + + + + + + + This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + + + + + + + + + + + text/plain + + + + + ModifyFirmwareEnvironment + + + + + + + + This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. + + + + + + + + + + + text/plain + + + + + ModifyObjectLabel + + + + + + + + This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. + + + + + + + + + + + text/plain + + + + + ProfileSingleProcess + + + + + + + + This user right determines which users can use performance monitoring tools to monitor the performance of system processes. + + + + + + + + + + + text/plain + + + + + RemoteShutdown + + + + + + + + This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. + + + + + + + + + + + text/plain + + + + + RestoreFilesAndDirectories + + + + + + + + This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. + + + + + + + + + + + text/plain + + + + + TakeOwnership + + + + + + + + This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. + + + + + + + + + + + text/plain + + + + Wifi - + @@ -37033,13 +41625,59 @@ The options are: + + WindowsConnectionManager + + + + + + + + + + + + + + + + + + + + + ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork + + + + + + + + + + + + + + + + + + + text/plain + + + + WindowsDefenderSecurityCenter - + @@ -37078,6 +41716,30 @@ The options are: + + DisableAccountProtectionUI + + + + + + + + + + + + + + + + + + + text/plain + + + DisableAppBrowserUI @@ -37102,6 +41764,30 @@ The options are: + + DisableDeviceSecurityUI + + + + + + + + + + + + + + + + + + + text/plain + + + DisableEnhancedNotifications @@ -37342,6 +42028,78 @@ The options are: + + HideRansomwareDataRecovery + + + + + + + + + + + + + + + + + + + text/plain + + + + + HideSecureBoot + + + + + + + + + + + + + + + + + + + text/plain + + + + + HideTPMTroubleshooting + + + + + + + + + + + + + + + + + + + text/plain + + + Phone @@ -37396,8 +42154,8 @@ The options are: - + @@ -37466,8 +42224,8 @@ The options are: - + @@ -37530,6 +42288,30 @@ The options are: + + EnumerateLocalUsersOnDomainJoinedComputers + + + + + + + + + + + + + + + + + + + text/plain + + + HideFastUserSwitching @@ -37554,14 +42336,84 @@ The options are: + + SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart + + + + + + + + + + + + + + + + + + + text/plain + + + + + + WindowsPowerShell + + + + + + + + + + + + + + + + + + + + + TurnOnPowerShellScriptBlockLogging + + + + + + + + + + + + + + + + + + + text/plain + + + WirelessDisplay - + @@ -37824,8 +42676,8 @@ The options are: - 1 + @@ -37849,8 +42701,8 @@ The options are: - 1 + @@ -37864,6 +42716,9 @@ The options are: text/plain + Search.admx + Search~AT~WindowsComponents~Search + AllowCortanaAboveLock LowestValueMostSecure @@ -37873,8 +42728,8 @@ The options are: - 1 + @@ -37917,8 +42772,8 @@ The options are: - 1 + @@ -37941,8 +42796,8 @@ The options are: - 1 + @@ -37965,8 +42820,8 @@ The options are: - 1 + @@ -37989,8 +42844,8 @@ The options are: - + @@ -38032,8 +42887,8 @@ The options are: - + @@ -38079,8 +42934,8 @@ The options are: - + @@ -38094,9 +42949,40 @@ The options are: text/plain phone + WindowsExplorer.admx + DefaultAssociationsConfiguration_TextBox + WindowsExplorer~AT~WindowsComponents~WindowsExplorer + DefaultAssociationsConfiguration LastWrite + + EnableAppUriHandlers + + + + + 1 + Enables web-to-app linking, which allows apps to be launched with a http(s) URI + + + + + + + + + + + text/plain + + + GroupPolicy.admx + GroupPolicy~AT~System~PolicyPolicies + EnableAppUriHandlers + HighestValueMostSecure + + ApplicationManagement @@ -38123,8 +43009,8 @@ The options are: - 65535 + @@ -38138,6 +43024,9 @@ The options are: text/plain + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + AppxDeploymentAllowAllTrustedApps LowestValueMostSecure @@ -38147,8 +43036,8 @@ The options are: - 2 + @@ -38161,6 +43050,10 @@ The options are: text/plain + + WindowsStore.admx + WindowsStore~AT~WindowsComponents~WindowsStore + DisableAutoInstall LowestValueMostSecure @@ -38170,8 +43063,8 @@ The options are: - 65535 + @@ -38185,6 +43078,9 @@ The options are: text/plain + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + AllowDevelopmentWithoutDevLicense LowestValueMostSecure @@ -38194,8 +43090,8 @@ The options are: - 1 + @@ -38210,6 +43106,9 @@ The options are: phone + GameDVR.admx + GameDVR~AT~WindowsComponents~GAMEDVR + AllowGameDVR LowestValueMostSecure @@ -38219,8 +43118,8 @@ The options are: - 0 + @@ -38234,6 +43133,9 @@ The options are: text/plain + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + AllowSharedLocalAppData LowestValueMostSecure @@ -38243,8 +43145,8 @@ The options are: - 1 + @@ -38268,8 +43170,8 @@ The options are: - + @@ -38292,8 +43194,8 @@ The options are: - 0 + @@ -38307,6 +43209,9 @@ The options are: text/plain + WindowsStore.admx + WindowsStore~AT~WindowsComponents~WindowsStore + DisableStoreApps LowestValueMostSecure @@ -38316,8 +43221,8 @@ The options are: - 0 + @@ -38331,6 +43236,9 @@ The options are: text/plain + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + RestrictAppDataToSystemVolume LowestValueMostSecure @@ -38340,8 +43248,8 @@ The options are: - 0 + @@ -38355,10 +43263,60 @@ The options are: text/plain + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + DisableDeploymentToNonSystemVolumes LowestValueMostSecure + + AppRuntime + + + + + + + + + + + + + + + + + + + AllowMicrosoftAccountsToBeOptional + + + + + + + + + + + + + + + + + text/plain + + phone + AppXRuntime.admx + AppXRuntime~AT~WindowsComponents~AppXRuntime + AppxRuntimeMicrosoftAccountsOptional + LastWrite + + + AppVirtualization @@ -38384,8 +43342,8 @@ The options are: - + @@ -38411,8 +43369,8 @@ The options are: - + @@ -38438,8 +43396,8 @@ The options are: - + @@ -38465,8 +43423,8 @@ The options are: - + @@ -38492,8 +43450,8 @@ The options are: - + @@ -38519,8 +43477,8 @@ The options are: - + @@ -38546,8 +43504,8 @@ The options are: - + @@ -38573,8 +43531,8 @@ The options are: - + @@ -38600,8 +43558,8 @@ The options are: - + @@ -38627,8 +43585,8 @@ The options are: - + @@ -38654,8 +43612,8 @@ The options are: - + @@ -38681,8 +43639,8 @@ The options are: - + @@ -38708,8 +43666,8 @@ The options are: - + @@ -38735,8 +43693,8 @@ The options are: - + @@ -38762,8 +43720,8 @@ The options are: - + @@ -38789,8 +43747,8 @@ The options are: - + @@ -38816,8 +43774,8 @@ The options are: - + @@ -38843,8 +43801,8 @@ The options are: - + @@ -38870,8 +43828,8 @@ The options are: - + @@ -38897,8 +43855,8 @@ The options are: - + @@ -38924,8 +43882,8 @@ The options are: - + @@ -38951,8 +43909,8 @@ The options are: - + @@ -38978,8 +43936,8 @@ The options are: - + @@ -39005,8 +43963,8 @@ The options are: - + @@ -39032,8 +43990,8 @@ The options are: - + @@ -39059,8 +44017,8 @@ The options are: - + @@ -39086,8 +44044,8 @@ The options are: - + @@ -39113,8 +44071,8 @@ The options are: - + @@ -39160,8 +44118,8 @@ The options are: - Specifies whether password reset is enabled for AAD accounts. 0 + Specifies whether password reset is enabled for AAD accounts. @@ -39185,8 +44143,8 @@ The options are: - 1 + @@ -39203,39 +44161,14 @@ The options are: LowestValueMostSecure - - AllowFidoDeviceSignon - - - - - Specifies whether FIDO device can be used to sign on. - 0 - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - AllowSecondaryAuthenticationDevice - 0 + @@ -39249,6 +44182,9 @@ The options are: text/plain + DeviceCredential.admx + DeviceCredential~AT~WindowsComponents~MSSecondaryAuthFactorCategory + MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice LowestValueMostSecure @@ -39278,8 +44214,8 @@ The options are: - + @@ -39305,8 +44241,8 @@ The options are: - + @@ -39332,8 +44268,8 @@ The options are: - + @@ -39379,8 +44315,8 @@ The options are: - 6 + @@ -39423,8 +44359,8 @@ The options are: - 1 + @@ -39447,8 +44383,8 @@ The options are: - 1 + @@ -39471,8 +44407,32 @@ The options are: - 1 + + + + + + + + + + + + text/plain + + + LowestValueMostSecure + + + + AllowPromptedProximalConnections + + + + + 1 + @@ -39495,8 +44455,8 @@ The options are: - + @@ -39518,8 +44478,8 @@ The options are: - + @@ -39561,8 +44521,8 @@ The options are: - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. 1 + This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. @@ -39577,6 +44537,9 @@ The options are: phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowAddressBarDropdown LowestValueMostSecure @@ -39586,8 +44549,8 @@ The options are: - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. 0 + This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. @@ -39601,6 +44564,9 @@ The options are: text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowAutofill LowestValueMostSecure @@ -39610,8 +44576,8 @@ The options are: - 1 + @@ -39630,13 +44596,13 @@ The options are: - AllowCookies + AllowConfigurationUpdateForBooksLibrary - This setting lets you configure how your company deals with cookies. - 2 + 1 + This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. @@ -39649,6 +44615,35 @@ The options are: text/plain + + LowestValueMostSecure + + + + AllowCookies + + + + + 2 + This setting lets you configure how your company deals with cookies. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + CookiesListBox + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + Cookies LowestValueMostSecure @@ -39658,8 +44653,8 @@ The options are: - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. 1 + This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. @@ -39674,6 +44669,9 @@ The options are: phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowDeveloperTools LowestValueMostSecure @@ -39683,8 +44681,8 @@ The options are: - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. 0 + This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. @@ -39698,6 +44696,9 @@ The options are: text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowDoNotTrack LowestValueMostSecure @@ -39707,8 +44708,8 @@ The options are: - This setting lets you decide whether employees can load extensions in Microsoft Edge. 1 + This setting lets you decide whether employees can load extensions in Microsoft Edge. @@ -39723,6 +44724,9 @@ The options are: phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowExtensions LowestValueMostSecure @@ -39732,8 +44736,8 @@ The options are: - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. 1 + This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. @@ -39748,6 +44752,9 @@ The options are: phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowFlash HighestValueMostSecure @@ -39757,8 +44764,8 @@ The options are: - Configure the Adobe Flash Click-to-Run setting. 1 + Configure the Adobe Flash Click-to-Run setting. @@ -39773,6 +44780,9 @@ The options are: phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowFlashClickToRun HighestValueMostSecure @@ -39782,8 +44792,8 @@ The options are: - This setting lets you decide whether employees can browse using InPrivate website browsing. 1 + This setting lets you decide whether employees can browse using InPrivate website browsing. @@ -39797,6 +44807,9 @@ The options are: text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowInPrivate LowestValueMostSecure @@ -39806,12 +44819,12 @@ The options are: + 1 This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - 1 @@ -39825,6 +44838,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowCVList LowestValueMostSecure @@ -39834,8 +44850,8 @@ If you disable this setting, the Microsoft Compatibility List will not be used d - This setting lets you decide whether employees can save their passwords locally, using Password Manager. 1 + This setting lets you decide whether employees can save their passwords locally, using Password Manager. @@ -39849,6 +44865,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowPasswordManager LowestValueMostSecure @@ -39858,8 +44877,8 @@ If you disable this setting, the Microsoft Compatibility List will not be used d - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. 0 + This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. @@ -39874,6 +44893,9 @@ If you disable this setting, the Microsoft Compatibility List will not be used d phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowPopups LowestValueMostSecure @@ -39883,13 +44905,13 @@ If you disable this setting, the Microsoft Compatibility List will not be used d + 1 Allow search engine customization for MDM enrolled devices. Users can change their default search engine. If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - 1 @@ -39903,6 +44925,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSearchEngineCustomization LowestValueMostSecure @@ -39912,8 +44937,8 @@ This policy will only apply on domain joined machines or when the device is MDM - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. 1 + This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. @@ -39927,6 +44952,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSearchSuggestionsinAddressBar LowestValueMostSecure @@ -39936,8 +44964,8 @@ This policy will only apply on domain joined machines or when the device is MDM - This setting lets you decide whether to turn on Windows Defender SmartScreen. 1 + This setting lets you decide whether to turn on Windows Defender SmartScreen. @@ -39951,6 +44979,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowSmartScreen LowestValueMostSecure @@ -39960,8 +44991,8 @@ This policy will only apply on domain joined machines or when the device is MDM - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. 0 + Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. @@ -39975,6 +45006,9 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AlwaysEnableBooksLibrary LowestValueMostSecure @@ -39984,8 +45018,8 @@ This policy will only apply on domain joined machines or when the device is MDM - Specifies whether to always clear browsing history on exiting Microsoft Edge. 0 + Specifies whether to always clear browsing history on exiting Microsoft Edge. @@ -40000,6 +45034,9 @@ This policy will only apply on domain joined machines or when the device is MDM phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + AllowClearingBrowsingDataOnExit LowestValueMostSecure @@ -40009,6 +45046,7 @@ This policy will only apply on domain joined machines or when the device is MDM + Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. @@ -40016,7 +45054,6 @@ If this setting is turned on, you can add up to 5 additional search engines for If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - @@ -40029,6 +45066,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + ConfigureAdditionalSearchEngines_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ConfigureAdditionalSearchEngines LastWrite @@ -40038,13 +45079,13 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 0 Boolean policy that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when Browser/HomePages policy is in effect. Note: This policy has no effect when Browser/HomePages is not configured. Important This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). - 0 @@ -40059,6 +45100,36 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + DisableLockdownOfStartPages + LowestValueMostSecure + + + + EnableExtendedBooksTelemetry + + + + + 0 + This setting allows organizations to send extended telemetry on book usage from the Books Library. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + EnableExtendedBooksTelemetry LowestValueMostSecure @@ -40068,8 +45139,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. @@ -40083,6 +45154,10 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain phone + MicrosoftEdge.admx + EnterSiteListPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + EnterpriseModeSiteList LastWrite @@ -40092,8 +45167,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - + @@ -40116,8 +45191,8 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo - Configure first run URL. + Configure first run URL. @@ -40140,13 +45215,13 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo + Configure the Start page URLs for your employees. Example: If you wanted to allow contoso.com and fabrikam.com then you would append /support to the site strings like contoso.com/support and fabrikam.com/support. Encapsulate each string with greater than and less than characters like any other XML tag. Version 1703 or later:  If you don't want to send traffic to Microsoft, you can use the about:blank value (encapsulate with greater than and less than characters like any other XML tag), which is honored for both domain- and non-domain-joined machines, when it's the only configured URL. - @@ -40160,6 +45235,10 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, you ca text/plain phone + MicrosoftEdge.admx + HomePagesPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + HomePages LastWrite @@ -40169,6 +45248,7 @@ Version 1703 or later:  If you don't want to send traffic to Microsoft, you ca + 0 This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. @@ -40177,7 +45257,6 @@ Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - 0 @@ -40191,6 +45270,9 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + LockdownFavorites LowestValueMostSecure @@ -40200,8 +45282,8 @@ If you disable or don't configure this setting (default), employees can add, imp - Prevent access to the about:flags page in Microsoft Edge. 0 + Prevent access to the about:flags page in Microsoft Edge. @@ -40215,6 +45297,9 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventAccessToAboutFlagsInMicrosoftEdge HighestValueMostSecure @@ -40224,10 +45309,10 @@ If you disable or don't configure this setting (default), employees can add, imp + 0 Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - 0 @@ -40242,6 +45327,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventFirstRunPage HighestValueMostSecure @@ -40251,10 +45339,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 0 This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - 0 @@ -40268,6 +45356,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventLiveTileDataCollection HighestValueMostSecure @@ -40277,8 +45368,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Don't allow Windows Defender SmartScreen warning overrides 0 + Don't allow Windows Defender SmartScreen warning overrides @@ -40292,6 +45383,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventSmartScreenPromptOverride HighestValueMostSecure @@ -40301,8 +45395,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Don't allow Windows Defender SmartScreen warning overrides for unverified files. 0 + Don't allow Windows Defender SmartScreen warning overrides for unverified files. @@ -40316,6 +45410,37 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventSmartScreenPromptOverrideForFiles + HighestValueMostSecure + + + + PreventTabPreloading + + + + + 0 + Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. + + + + + + + + + + + text/plain + + + phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventTabPreloading HighestValueMostSecure @@ -40325,8 +45450,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Prevent using localhost IP address for WebRTC 0 + Prevent using localhost IP address for WebRTC @@ -40340,6 +45465,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + HideLocalHostIPAddress HighestValueMostSecure @@ -40349,6 +45477,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. @@ -40357,7 +45486,6 @@ Important Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - @@ -40370,6 +45498,10 @@ If you disable or don't configure this setting, employees will see the favorites text/plain + MicrosoftEdge.admx + ConfiguredFavoritesPrompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ConfiguredFavorites LastWrite @@ -40379,8 +45511,8 @@ If you disable or don't configure this setting, employees will see the favorites - Sends all intranet traffic over to Internet Explorer. 0 + Sends all intranet traffic over to Internet Explorer. @@ -40395,6 +45527,9 @@ If you disable or don't configure this setting, employees will see the favorites phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SendIntranetTraffictoInternetExplorer HighestValueMostSecure @@ -40404,6 +45539,7 @@ If you disable or don't configure this setting, employees will see the favorites + Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. @@ -40411,7 +45547,6 @@ If this setting is turned on, you are setting the default search engine that you If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - @@ -40424,6 +45559,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + MicrosoftEdge.admx + SetDefaultSearchEngine_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SetDefaultSearchEngine LastWrite @@ -40433,8 +45572,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Show message when opening sites in Internet Explorer 0 + Show message when opening sites in Internet Explorer @@ -40449,6 +45588,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + ShowMessageWhenOpeningSitesInInternetExplorer HighestValueMostSecure @@ -40458,8 +45600,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. 0 + Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. @@ -40474,6 +45616,36 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + SyncFavoritesBetweenIEAndMicrosoftEdge + LowestValueMostSecure + + + + UseSharedFolderForBooks + + + + + 0 + This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. + + + + + + + + + + + text/plain + + + MicrosoftEdge.admx + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + UseSharedFolderForBooks LowestValueMostSecure @@ -40503,8 +45675,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40518,6 +45690,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + Camera.admx + Camera~AT~WindowsComponents~L_Camera_GroupPolicyCategory + L_AllowCamera LowestValueMostSecure @@ -40547,8 +45722,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - This policy setting specifies whether Windows apps can access cellular data. 0 + This policy setting specifies whether Windows apps can access cellular data. @@ -40561,6 +45736,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + wwansvc.admx + LetAppsAccessCellularData_Enum + wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess + LetAppsAccessCellularData HighestValueMostSecure @@ -40570,8 +45750,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -40584,6 +45764,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + wwansvc.admx + LetAppsAccessCellularData_ForceAllowTheseApps_List + wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess + LetAppsAccessCellularData LastWrite ; @@ -40594,8 +45778,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -40608,6 +45792,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + wwansvc.admx + LetAppsAccessCellularData_ForceDenyTheseApps_List + wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess + LetAppsAccessCellularData LastWrite ; @@ -40618,8 +45806,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -40632,6 +45820,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + wwansvc.admx + LetAppsAccessCellularData_UserInControlOfTheseApps_List + wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess + LetAppsAccessCellularData LastWrite ; @@ -40642,8 +45834,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -40688,8 +45880,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 2 + @@ -40712,8 +45904,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40726,6 +45918,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -40735,8 +45928,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40749,6 +45942,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + WCM.admx + WCM~AT~Network~WCM_Category + WCM_DisableRoaming LowestValueMostSecure @@ -40758,8 +45955,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40782,8 +45979,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40801,14 +45998,41 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LowestValueMostSecure + + AllowPhonePCLinking + + + + + 1 + + + + + + + + + + + + text/plain + + + grouppolicy.admx + grouppolicy~AT~System~PolicyPolicies + enableMMX + LowestValueMostSecure + + AllowUSBConnection - 1 + @@ -40832,8 +46056,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40856,8 +46080,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -40880,8 +46104,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -40907,8 +46131,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -40934,8 +46158,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -40961,8 +46185,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -40975,6 +46199,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + ICM.admx + ICM~AT~System~InternetManagement~InternetManagement_Settings + NoActiveProbe HighestValueMostSecure @@ -40984,8 +46212,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41011,8 +46239,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41033,6 +46261,50 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + ControlPolicyConflict + + + + + + + + + + + + + + + + + + + MDMWinsOverGP + + + + + 0 + If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC + + + + + + + + + + + text/plain + + + LastWrite + + + CredentialProviders @@ -41058,8 +46330,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41085,8 +46357,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41112,8 +46384,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41131,6 +46403,53 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + CredentialsDelegation + + + + + + + + + + + + + + + + + + + RemoteHostAllowsDelegationOfNonExportableCredentials + + + + + + + + + + + + + + + + + text/plain + + phone + CredSsp.admx + CredSsp~AT~System~CredentialsDelegation + AllowProtectedCreds + LastWrite + + + CredentialsUI @@ -41156,8 +46475,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41183,8 +46502,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41230,8 +46549,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41244,6 +46563,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + + Windows Settings~Security Settings~Local Policies~Security Options + System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing LastWrite @@ -41253,8 +46575,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41296,8 +46618,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41320,8 +46642,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41363,8 +46685,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41389,8 +46711,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41435,8 +46757,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41449,7 +46771,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_DisableArchiveScanning HighestValueMostSecure @@ -41459,8 +46785,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41473,7 +46799,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection + RealtimeProtection_DisableBehaviorMonitoring HighestValueMostSecure @@ -41483,8 +46813,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41497,7 +46827,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + SpynetReporting + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Spynet + SpynetReporting HighestValueMostSecure @@ -41507,8 +46842,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41521,7 +46856,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_DisableEmailScanning HighestValueMostSecure @@ -41531,8 +46870,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41545,7 +46884,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_DisableScanningMappedNetworkDrivesForFullScan HighestValueMostSecure @@ -41555,8 +46898,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41569,7 +46912,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_DisableRemovableDriveScanning HighestValueMostSecure @@ -41579,8 +46926,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41593,6 +46940,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -41603,8 +46951,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41617,7 +46965,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection + RealtimeProtection_DisableIOAVProtection HighestValueMostSecure @@ -41627,8 +46979,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41641,7 +46993,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection + RealtimeProtection_DisableOnAccessProtection HighestValueMostSecure @@ -41651,8 +47007,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41665,7 +47021,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection + DisableRealtimeMonitoring HighestValueMostSecure @@ -41675,8 +47035,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41689,7 +47049,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_DisableScanningNetworkFiles HighestValueMostSecure @@ -41699,8 +47063,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41713,6 +47077,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -41723,8 +47088,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -41737,7 +47102,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ClientInterface + UX_Configuration_UILockdown LastWrite @@ -41747,8 +47116,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41762,6 +47131,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + ExploitGuard_ASR_ASROnlyExclusions + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ASR + ExploitGuard_ASR_ASROnlyExclusions LastWrite @@ -41771,8 +47144,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41786,6 +47159,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + ExploitGuard_ASR_Rules + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ASR + ExploitGuard_ASR_Rules LastWrite @@ -41795,8 +47172,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 50 + @@ -41809,7 +47186,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Scan_AvgCPULoadFactor + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_AvgCPULoadFactor LastWrite @@ -41819,8 +47201,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41833,7 +47215,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + MpCloudBlockLevel + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~MpEngine + MpEngine_MpCloudBlockLevel LastWrite @@ -41843,8 +47230,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41857,7 +47244,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + MpBafsExtendedTimeout + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~MpEngine + MpEngine_MpBafsExtendedTimeout LastWrite @@ -41867,8 +47259,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41882,6 +47274,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + ExploitGuard_ControlledFolderAccess_AllowedApplications + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess + ExploitGuard_ControlledFolderAccess_AllowedApplications LastWrite @@ -41891,8 +47287,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -41906,6 +47302,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + ExploitGuard_ControlledFolderAccess_ProtectedFolders + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess + ExploitGuard_ControlledFolderAccess_ProtectedFolders LastWrite @@ -41915,8 +47315,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41929,7 +47329,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Quarantine_PurgeItemsAfterDelay + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Quarantine + Quarantine_PurgeItemsAfterDelay LastWrite @@ -41939,8 +47344,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41953,7 +47358,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess + ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess LastWrite @@ -41963,8 +47373,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -41977,7 +47387,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + ExploitGuard_EnableNetworkProtection + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_NetworkProtection + ExploitGuard_EnableNetworkProtection LastWrite @@ -41987,8 +47402,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42002,6 +47417,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + Exclusions_PathsList + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions + Exclusions_Paths LastWrite @@ -42011,8 +47430,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42026,6 +47445,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + Exclusions_ExtensionsList + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions + Exclusions_Extensions LastWrite @@ -42035,8 +47458,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42050,6 +47473,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + Exclusions_ProcessesList + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions + Exclusions_Processes LastWrite @@ -42059,8 +47486,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42073,6 +47500,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LastWrite @@ -42083,8 +47511,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42097,7 +47525,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + RealtimeProtection_RealtimeScanDirection + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection + RealtimeProtection_RealtimeScanDirection LowestValueMostSecure @@ -42107,8 +47540,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -42121,7 +47554,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Scan_ScanParameters + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_ScanParameters LastWrite @@ -42131,8 +47569,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 120 + @@ -42145,7 +47583,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Scan_ScheduleQuickScantime + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_ScheduleQuickScantime LastWrite @@ -42155,8 +47598,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42169,7 +47612,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Scan_ScheduleDay + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_ScheduleDay LastWrite @@ -42179,8 +47627,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 120 + @@ -42193,7 +47641,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + Scan_ScheduleTime + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan + Scan_ScheduleTime LastWrite @@ -42203,8 +47656,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 8 + @@ -42217,7 +47670,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + SignatureUpdate_SignatureUpdateInterval + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate + SignatureUpdate_SignatureUpdateInterval LastWrite @@ -42227,8 +47685,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -42241,7 +47699,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone + WindowsDefender.admx + SubmitSamplesConsent + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Spynet + SubmitSamplesConsent HighestValueMostSecure @@ -42251,8 +47714,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42266,6 +47729,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain phone + WindowsDefender.admx + Threats_ThreatSeverityDefaultActionList + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Threats + Threats_ThreatSeverityDefaultAction LastWrite @@ -42295,8 +47762,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 10 + @@ -42309,7 +47776,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + AbsoluteMaxCacheSize + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + AbsoluteMaxCacheSize LastWrite @@ -42319,8 +47790,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42334,20 +47805,23 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + DeliveryOptimization.admx + AllowVPNPeerCaching + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + AllowVPNPeerCaching LowestValueMostSecure - DOCacheHost + DODelayBackgroundDownloadFromHttp + 0 - - + @@ -42358,7 +47832,39 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + DelayBackgroundDownloadFromHttp + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayBackgroundDownloadFromHttp + LastWrite + + + + DODelayForegroundDownloadFromHttp + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + DelayForegroundDownloadFromHttp + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayForegroundDownloadFromHttp LastWrite @@ -42368,8 +47874,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 1 + @@ -42383,7 +47889,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + DeliveryOptimization.admx + DownloadMode + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DownloadMode LastWrite @@ -42393,8 +47902,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42407,7 +47916,38 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + DeliveryOptimization.admx + GroupId + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + GroupId + LastWrite + + + + DOGroupIdSource + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + GroupIdSource + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + GroupIdSource LastWrite @@ -42417,8 +47957,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 259200 + @@ -42431,7 +47971,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MaxCacheAge + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxCacheAge LastWrite @@ -42441,8 +47985,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 20 + @@ -42455,7 +47999,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MaxCacheSize + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxCacheSize LastWrite @@ -42465,8 +48013,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42479,7 +48027,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MaxDownloadBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxDownloadBandwidth LastWrite @@ -42489,8 +48041,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42503,7 +48055,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MaxUploadBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxUploadBandwidth LastWrite @@ -42513,8 +48069,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 500 + @@ -42527,7 +48083,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MinBackgroundQos + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MinBackgroundQos LastWrite @@ -42537,8 +48097,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42551,7 +48111,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MinBatteryPercentageAllowedToUpload + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MinBatteryPercentageAllowedToUpload LastWrite @@ -42561,8 +48125,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 32 + @@ -42575,7 +48139,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MinDiskSizeAllowedToPeer + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MinDiskSizeAllowedToPeer LastWrite @@ -42585,8 +48153,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 100 + @@ -42599,7 +48167,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MinFileSizeToCache + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MinFileSizeToCache LastWrite @@ -42609,8 +48181,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 4 + @@ -42623,7 +48195,11 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MinRAMAllowedToPeer + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MinRAMAllowedToPeer LastWrite @@ -42633,8 +48209,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - %SystemDrive% + @@ -42647,7 +48223,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + DeliveryOptimization.admx + ModifyCacheDrive + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + ModifyCacheDrive LastWrite @@ -42657,8 +48236,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 20 + @@ -42671,7 +48250,39 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - phone + + DeliveryOptimization.admx + MonthlyUploadDataCap + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MonthlyUploadDataCap + LastWrite + + + + DOPercentageMaxBackgroundBandwidth + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + PercentageMaxBackgroundBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + PercentageMaxBackgroundBandwidth LastWrite @@ -42681,8 +48292,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -42695,10 +48306,191 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LastWrite + + DOPercentageMaxForegroundBandwidth + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + PercentageMaxForegroundBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + PercentageMaxForegroundBandwidth + LastWrite + + + + DORestrictPeerSelectionBy + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + RestrictPeerSelectionBy + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + RestrictPeerSelectionBy + LastWrite + + + + DOSetHoursToLimitBackgroundDownloadBandwidth + + + + + + + + + + + + + + + + + text/plain + + DeliveryOptimization.admx + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + SetHoursToLimitBackgroundDownloadBandwidth + LastWrite + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + DOSetHoursToLimitForegroundDownloadBandwidth + + + + + + + + + + + + + + + + + text/plain + + DeliveryOptimization.admx + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + SetHoursToLimitForegroundDownloadBandwidth + LastWrite + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + DeviceGuard @@ -42725,8 +48517,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Turns On Virtualization Based Security(VBS) 0 + Turns On Virtualization Based Security(VBS) @@ -42741,6 +48533,9 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + DeviceGuard.admx + DeviceGuard~AT~System~DeviceGuardCategory + VirtualizationBasedSecurity HighestValueMostSecure @@ -42750,8 +48545,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if configured previously without UEFI Lock, 1 - Turns on CredentialGuard with UEFI lock. 2 - Turns on CredentialGuard without UEFI lock. 0 + Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if configured previously without UEFI Lock, 1 - Turns on CredentialGuard with UEFI lock. 2 - Turns on CredentialGuard without UEFI lock. @@ -42766,6 +48561,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + DeviceGuard.admx + CredentialIsolationDrop + DeviceGuard~AT~System~DeviceGuardCategory + VirtualizationBasedSecurity LowestValueMostSecureZeroHasNoLimits @@ -42775,8 +48574,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support. 1 + Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support. @@ -42791,6 +48590,10 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone + DeviceGuard.admx + RequirePlatformSecurityFeaturesDrop + DeviceGuard~AT~System~DeviceGuardCategory + VirtualizationBasedSecurity HighestValueMostSecure @@ -42820,8 +48623,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42847,8 +48650,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -42894,8 +48697,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether the user must input a PIN or password when the device resumes from an idle state. 1 + Specifies whether the user must input a PIN or password when the device resumes from an idle state. @@ -42919,8 +48722,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. 0 + Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. @@ -42933,6 +48736,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LastWrite @@ -42942,8 +48746,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether PINs or passwords such as 1111 or 1234 are allowed. For the desktop, it also controls the use of picture passwords. 1 + Specifies whether PINs or passwords such as 1111 or 1234 are allowed. For the desktop, it also controls the use of picture passwords. @@ -42956,6 +48760,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -42965,8 +48770,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 2 + Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 @@ -42979,6 +48784,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -42988,8 +48794,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies whether device lock is enabled. 1 + Specifies whether device lock is enabled. @@ -43002,6 +48808,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -43011,8 +48818,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies when the password expires (in days). 0 + Specifies when the password expires (in days). @@ -43025,6 +48832,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -43034,8 +48842,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies how many passwords can be stored in the history that can’t be used. 0 + Specifies how many passwords can be stored in the history that can’t be used. @@ -43048,6 +48856,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -43057,8 +48866,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -43081,8 +48890,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + @@ -43104,8 +48913,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - 0 + @@ -43118,6 +48927,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -43127,8 +48937,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. 0 + The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. @@ -43141,6 +48951,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecureZeroHasNoLimits @@ -43150,8 +48961,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Sets the maximum timeout value for the external display. 0 + Sets the maximum timeout value for the external display. @@ -43164,6 +48975,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + desktop LowestValueMostSecure @@ -43174,8 +48986,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. 1 + The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. @@ -43188,6 +49000,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -43197,8 +49010,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - Specifies the minimum number or characters required in the PIN or password. 4 + Specifies the minimum number or characters required in the PIN or password. @@ -43211,6 +49024,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecureZeroHasNoLimits @@ -43220,12 +49034,12 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + 1 This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default. - 1 @@ -43238,8 +49052,38 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + + phone + Windows Settings~Security Settings~Account Policies~Password Policy + Minimum password age + HighestValueMostSecure + + + + PreventEnablingLockScreenCamera + + + + + + + + + + + + + + + + + text/plain + phone - HighestValueMostSecure + ControlPanelDisplay.admx + ControlPanelDisplay~AT~ControlPanel~Personalization + CPL_Personalization_NoLockScreenCamera + LastWrite @@ -43248,8 +49092,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43275,8 +49119,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. 10 + Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. @@ -43289,6 +49133,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LastWrite @@ -43313,13 +49158,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - TurnOffGdiDPIScalingForApps + DisablePerProcessDpiForApps - This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. @@ -43333,6 +49178,95 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + Display.admx + DisplayDisablePerProcessSystemDpiSettings + Display~AT~System~DisplayCat + DisplayPerProcessSystemDpiSettings + LastWrite + + + + EnablePerProcessDpi + + + + + + Enable or disable Per-Process System DPI for all applications. + + + + + + + + + + + text/plain + + + phone + Display.admx + DisplayGlobalPerProcessSystemDpiSettings + Display~AT~System~DisplayCat + DisplayPerProcessSystemDpiSettings + LowestValueMostSecure + + + + EnablePerProcessDpiForApps + + + + + + This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + + + + + + + + + + + text/plain + + phone + Display.admx + DisplayEnablePerProcessSystemDpiSettings + Display~AT~System~DisplayCat + DisplayPerProcessSystemDpiSettings + LastWrite + + + + TurnOffGdiDPIScalingForApps + + + + + + This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + + + + + + + + + + + text/plain + + phone + Display.admx + DisplayTurnOffGdiDPIScalingPrompt + Display~AT~System~DisplayCat + DisplayTurnOffGdiDPIScaling LastWrite @@ -43342,8 +49276,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. @@ -43357,6 +49291,10 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain phone + Display.admx + DisplayTurnOnGdiDPIScalingPrompt + Display~AT~System~DisplayCat + DisplayTurnOnGdiDPIScaling LastWrite @@ -43386,8 +49324,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43413,8 +49351,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43440,8 +49378,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43467,8 +49405,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43494,8 +49432,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43541,8 +49479,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43568,8 +49506,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43595,8 +49533,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43622,8 +49560,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -43669,8 +49607,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43694,8 +49632,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43709,6 +49647,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + Search.admx + Search~AT~WindowsComponents~Search + AllowCortana LowestValueMostSecure @@ -43718,8 +49659,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43742,8 +49683,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43757,6 +49698,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + FindMy.admx + FindMy~AT~WindowsComponents~FindMyDeviceCat + FindMy_AllowFindMyDeviceConfig LowestValueMostSecure @@ -43766,8 +49710,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43790,8 +49734,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43814,8 +49758,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43838,8 +49782,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43862,8 +49806,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43886,8 +49830,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43910,8 +49854,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43935,8 +49879,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -43955,13 +49899,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - AllowWindowsTips + AllowWindowsConsumerFeatures + 0 - 1 @@ -43976,17 +49920,20 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableWindowsConsumerFeatures LowestValueMostSecure - DoNotShowFeedbackNotifications + AllowWindowsTips + 1 - 0 @@ -43999,6 +49946,38 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + + phone + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableSoftLanding + LowestValueMostSecure + + + + DoNotShowFeedbackNotifications + + + + + 0 + + + + + + + + + + + + text/plain + + + FeedbackNotifications.admx + FeedbackNotifications~AT~WindowsComponents~DataCollectionAndPreviewBuilds + DoNotShowFeedbackNotifications HighestValueMostSecure @@ -44028,8 +50007,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44042,6 +50021,84 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + ExploitGuard.admx + ExploitProtection_Name + ExploitGuard~AT~WindowsComponents~WindowsDefenderExploitGuard~ExploitProtection + ExploitProtection_Name + LastWrite + + + + + FileExplorer + + + + + + + + + + + + + + + + + + + TurnOffDataExecutionPreventionForExplorer + + + + + + + + + + + + + + + + + text/plain + + phone + Explorer.admx + Explorer~AT~WindowsExplorer + NoDataExecutionPrevention + LastWrite + + + + TurnOffHeapTerminationOnCorruption + + + + + + + + + + + + + + + + + text/plain + + phone + Explorer.admx + Explorer~AT~WindowsExplorer + NoHeapTerminationOnCorruption LastWrite @@ -44071,8 +50128,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. 1 + Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. @@ -44115,8 +50172,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen 0 + Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen @@ -44131,6 +50188,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone + Handwriting.admx + Handwriting~AT~WindowsComponents~Handwriting + PanelDefaultModeDocked LowestValueMostSecure @@ -44160,8 +50220,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44187,8 +50247,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44214,8 +50274,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44241,8 +50301,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44268,8 +50328,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44295,8 +50355,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44322,8 +50382,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44349,8 +50409,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44376,8 +50436,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44403,8 +50463,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44430,8 +50490,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44457,8 +50517,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44484,8 +50544,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44511,8 +50571,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44538,8 +50598,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44565,8 +50625,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44592,8 +50652,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44619,8 +50679,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44646,8 +50706,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44673,8 +50733,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44700,8 +50760,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44727,8 +50787,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44754,8 +50814,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44781,8 +50841,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44808,8 +50868,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44835,8 +50895,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44862,8 +50922,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44889,8 +50949,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44905,8 +50965,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryBinaryBehaviorSecurityRestriction - IESF_PolicyExplorerProcesses_2 + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryConsistentMimeHandling + IESF_PolicyExplorerProcesses_5 LastWrite @@ -44916,8 +50976,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44943,8 +51003,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44970,8 +51030,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -44997,8 +51057,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45024,8 +51084,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45051,8 +51111,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45078,8 +51138,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45105,8 +51165,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45132,8 +51192,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45159,8 +51219,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45186,8 +51246,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45213,8 +51273,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45240,8 +51300,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45267,8 +51327,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45294,8 +51354,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45321,8 +51381,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45348,8 +51408,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45375,8 +51435,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45402,8 +51462,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45429,8 +51489,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45456,8 +51516,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45483,8 +51543,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45510,8 +51570,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45537,8 +51597,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45564,8 +51624,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45591,8 +51651,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45618,8 +51678,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45645,8 +51705,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45672,8 +51732,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45699,8 +51759,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45726,8 +51786,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45753,8 +51813,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45780,8 +51840,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45807,8 +51867,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45834,8 +51894,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45861,8 +51921,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45888,8 +51948,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45915,8 +51975,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45942,8 +52002,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45969,8 +52029,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -45996,8 +52056,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46023,8 +52083,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46050,8 +52110,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46071,14 +52131,41 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + InternetZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone + IZ_PolicyAllowVBScript_1 + LastWrite + + InternetZoneDoNotRunAntimalwareAgainstActiveXControls - + @@ -46104,8 +52191,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46131,8 +52218,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46158,8 +52245,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46185,8 +52272,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46212,8 +52299,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46239,8 +52326,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46266,8 +52353,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46293,8 +52380,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46320,8 +52407,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46347,8 +52434,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46374,8 +52461,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46401,8 +52488,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46428,8 +52515,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46455,8 +52542,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46482,8 +52569,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46509,8 +52596,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46536,8 +52623,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46563,8 +52650,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46590,8 +52677,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46617,8 +52704,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46644,8 +52731,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46671,8 +52758,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46698,8 +52785,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46725,8 +52812,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46752,8 +52839,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46779,8 +52866,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46806,8 +52893,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46833,8 +52920,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46860,8 +52947,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46887,8 +52974,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46914,8 +53001,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46941,8 +53028,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46968,8 +53055,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -46995,8 +53082,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47022,8 +53109,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47049,8 +53136,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47076,8 +53163,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47103,8 +53190,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47130,8 +53217,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47157,8 +53244,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47184,8 +53271,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47211,8 +53298,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47238,8 +53325,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47265,8 +53352,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47292,8 +53379,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47319,8 +53406,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47346,8 +53433,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47373,8 +53460,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47400,8 +53487,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47427,8 +53514,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47454,8 +53541,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47481,8 +53568,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47508,8 +53595,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47535,8 +53622,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47556,14 +53643,41 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + LockedDownIntranetJavaPermissions + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown + IZ_PolicyJavaPermissions_4 + LastWrite + + LockedDownIntranetZoneAllowAccessToDataSources - + @@ -47589,8 +53703,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47616,8 +53730,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47643,8 +53757,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47670,8 +53784,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47697,8 +53811,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47724,8 +53838,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47751,8 +53865,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47778,8 +53892,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47805,8 +53919,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47832,8 +53946,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47859,8 +53973,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47886,8 +54000,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47913,8 +54027,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47940,8 +54054,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47967,8 +54081,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -47994,8 +54108,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48021,8 +54135,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48048,8 +54162,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48075,8 +54189,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48102,8 +54216,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48129,8 +54243,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48156,8 +54270,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48183,8 +54297,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48210,8 +54324,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48237,8 +54351,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48264,8 +54378,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48291,8 +54405,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48318,8 +54432,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48345,8 +54459,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48372,8 +54486,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48399,8 +54513,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48426,8 +54540,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48453,8 +54567,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48480,8 +54594,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48507,8 +54621,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48534,8 +54648,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48561,8 +54675,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48588,8 +54702,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48615,8 +54729,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48642,8 +54756,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48669,8 +54783,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48696,8 +54810,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48723,8 +54837,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48750,8 +54864,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48777,8 +54891,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48804,8 +54918,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48831,8 +54945,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48858,8 +54972,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48885,8 +54999,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48912,8 +55026,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48939,8 +55053,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48966,8 +55080,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -48993,8 +55107,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49020,8 +55134,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49047,8 +55161,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49074,8 +55188,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49101,8 +55215,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49128,8 +55242,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49155,8 +55269,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49182,8 +55296,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49209,8 +55323,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49236,8 +55350,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49263,8 +55377,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49290,8 +55404,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49317,8 +55431,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49344,8 +55458,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49371,8 +55485,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49398,8 +55512,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49425,8 +55539,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49452,8 +55566,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49479,8 +55593,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49506,8 +55620,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49533,8 +55647,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49560,8 +55674,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49587,8 +55701,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49608,14 +55722,41 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone + IZ_PolicyAllowVBScript_7 + LastWrite + + RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - + @@ -49641,8 +55782,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49668,8 +55809,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49695,8 +55836,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49722,8 +55863,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49749,8 +55890,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49776,8 +55917,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49803,8 +55944,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49830,8 +55971,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49857,8 +55998,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49884,8 +56025,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49911,8 +56052,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49938,8 +56079,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49965,8 +56106,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -49992,8 +56133,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50019,8 +56160,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50046,8 +56187,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50073,8 +56214,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50100,8 +56241,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50127,8 +56268,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50154,8 +56295,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50181,8 +56322,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50208,8 +56349,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50230,13 +56371,13 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - SecurityZonesUseOnlyMachineSettings + SecurityZonesUseOnlyMachineSettings - + @@ -50262,8 +56403,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50289,8 +56430,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50316,8 +56457,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50343,8 +56484,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50370,8 +56511,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50397,8 +56538,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50424,8 +56565,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50451,8 +56592,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50478,8 +56619,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50505,8 +56646,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50532,8 +56673,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50559,8 +56700,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50586,8 +56727,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50613,8 +56754,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50660,8 +56801,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50687,8 +56828,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50714,8 +56855,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50741,8 +56882,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50768,8 +56909,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - + @@ -50790,6 +56931,173 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + KioskBrowser + + + + + + + + + + + + + + + + + + + BlockedUrlExceptions + + + + + + List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + BlockedUrls + + + + + + List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + DefaultURL + + + + + + Configures the default URL kiosk browsers to navigate on launch and restart. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + EnableHomeButton + + + + + 0 + Enable/disable kiosk browser's home button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + + + EnableNavigationButtons + + + + + 0 + Enable/disable kiosk browser's navigation buttons (forward/back). + + + + + + + + + + + text/plain + + + phone + LastWrite + + + + RestartOnIdleTime + + + + + 0 + Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. + + + + + + + + + + + text/plain + + + phone + LastWrite + + + Licensing @@ -50815,8 +57123,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 1 + @@ -50831,6 +57139,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone + AVSValidationGP.admx + AVSValidationGP~AT~WindowsComponents~SoftwareProtectionPlatform + AllowWindowsEntitlementReactivation LowestValueMostSecure @@ -50840,8 +57151,8 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - 0 + @@ -50856,6 +57167,9 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone + AVSValidationGP.admx + AVSValidationGP~AT~WindowsComponents~SoftwareProtectionPlatform + NoAcquireGT LowestValueMostSecure @@ -50885,6 +57199,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + 0 This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. @@ -50892,7 +57207,6 @@ If you select the "Users can’t add Microsoft accounts" option, users will not If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. - 0 @@ -50907,6 +57221,8 @@ If you disable or do not configure this policy (recommended), users will be able phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Block Microsoft accounts LastWrite @@ -50916,6 +57232,7 @@ If you disable or do not configure this policy (recommended), users will be able + 0 This security setting determines whether the local Administrator account is enabled or disabled. Notes @@ -50926,7 +57243,6 @@ Disabling the Administrator account can become a maintenance issue under certain Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default: Disabled. - 0 @@ -50939,7 +57255,10 @@ Default: Disabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Administrator account status LastWrite @@ -50949,12 +57268,12 @@ Default: Disabled. + 0 This security setting determines if the Guest account is enabled or disabled. Default: Disabled. Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. - 0 @@ -50967,7 +57286,10 @@ Note: If the Guest account is disabled and the security option Network Access: S text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Guest account status LastWrite @@ -50977,6 +57299,7 @@ Note: If the Guest account is disabled and the security option Network Access: S + 1 Accounts: Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. @@ -50993,7 +57316,6 @@ Notes This setting does not affect logons that use domain accounts. It is possible for applications that use remote interactive logons to bypass this setting. - 1 @@ -51006,7 +57328,10 @@ It is possible for applications that use remote interactive logons to bypass thi text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Limit local account use of blank passwords to console logon only LastWrite @@ -51016,12 +57341,12 @@ It is possible for applications that use remote interactive logons to bypass thi + Administrator Accounts: Rename administrator account This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination. Default: Administrator. - Administrator @@ -51035,6 +57360,8 @@ Default: Administrator. text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Rename administrator account LastWrite @@ -51044,12 +57371,12 @@ Default: Administrator. + Guest Accounts: Rename guest account This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination. Default: Guest. - Guest @@ -51063,6 +57390,8 @@ Default: Guest. text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Accounts: Rename guest account LastWrite @@ -51072,6 +57401,7 @@ Default: Guest. + 0 Devices: Allowed to format and eject removable media This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: @@ -51080,7 +57410,6 @@ Administrators Administrators and Interactive Users Default: This policy is not defined and only Administrators have this ability. - 0 @@ -51094,6 +57423,8 @@ Default: This policy is not defined and only Administrators have this ability.text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Devices: Allowed to format and eject removable media LastWrite @@ -51103,13 +57434,13 @@ Default: This policy is not defined and only Administrators have this ability. + 1 Devices: Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default: Enabled. Caution Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. - 1 @@ -51122,7 +57453,10 @@ Disabling this policy may tempt users to try and physically remove the laptop fr text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Devices: Allow undock without having to log on LastWrite @@ -51132,6 +57466,7 @@ Disabling this policy may tempt users to try and physically remove the laptop fr + 0 Devices: Prevent users from installing printer drivers when connecting to shared printers For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. @@ -51143,7 +57478,6 @@ Notes This setting does not affect the ability to add a local printer. This setting does not affect Administrators. - 0 @@ -51156,7 +57490,10 @@ This setting does not affect Administrators. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Devices: Prevent users from installing printer drivers LastWrite @@ -51166,6 +57503,7 @@ This setting does not affect Administrators. + 0 Devices: Restrict CD-ROM access to locally logged-on user only This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. @@ -51173,7 +57511,6 @@ This security setting determines whether a CD-ROM is accessible to both local an If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network. Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. - 0 @@ -51187,6 +57524,245 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Devices: Restrict CD-ROM access to locally logged-on user only + LastWrite + + + + DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways + + + + + 1 + Domain member: Digitally encrypt or sign secure channel data (always) + +This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: + +Domain member: Digitally encrypt secure channel data (when possible) +Domain member: Digitally sign secure channel data (when possible) + +Default: Enabled. + +Notes: + +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. +Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Digitally encrypt or sign secure channel data (always) + LastWrite + + + + DomainMember_DigitallyEncryptSecureChannelDataWhenPossible + + + + + 1 + Domain member: Digitally encrypt secure channel data (when possible) + +This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. + +Default: Enabled. + +Important + +There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. + +Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Digitally encrypt secure channel data (when possible) + LastWrite + + + + DomainMember_DigitallySignSecureChannelDataWhenPossible + + + + + 1 + Domain member: Digitally sign secure channel data (when possible) + +This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. + +This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. + +Default: Enabled. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Digitally sign secure channel data (when possible) + LastWrite + + + + DomainMember_DisableMachineAccountPasswordChanges + + + + + 0 + Domain member: Disable machine account password changes + +Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. + +Default: Disabled. + +Notes + +This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. +This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Disable machine account password changes + LastWrite + + + + DomainMember_MaximumMachineAccountPasswordAge + + + + + 30 + Domain member: Maximum machine account password age + +This security setting determines how often a domain member will attempt to change its computer account password. + +Default: 30 days. + +Important + +This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Maximum machine account password age + LowestValueMostSecure + + + + DomainMember_RequireStrongSessionKey + + + + + 1 + Domain member: Require strong (Windows 2000 or later) session key + +This security setting determines whether 128-bit key strength is required for encrypted secure channel data. + +When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. + +Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: + +Domain member: Digitally encrypt or sign secure channel data (always) +Domain member: Digitally encrypt secure channel data (when possible) +Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. + +If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. + +Default: Enabled. + +Important + +In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. +In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Domain member: Require strong (Windows 2000 or later) session key LastWrite @@ -51196,11 +57772,11 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l + 1 Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) Do not display user information (3) - 1 @@ -51213,7 +57789,10 @@ Do not display user information (3) text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Display user information when the session is locked LastWrite @@ -51223,6 +57802,7 @@ Do not display user information (3) + 0 Interactive logon: Don't display last signed-in This security setting determines whether the Windows sign-in screen will show the username of the last person who signed in on this PC. If this policy is enabled, the username will not be shown. @@ -51230,7 +57810,6 @@ If this policy is enabled, the username will not be shown. If this policy is disabled, the username will be shown. Default: Disabled. - 0 @@ -51243,7 +57822,10 @@ Default: Disabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Don't display last signed-in LastWrite @@ -51253,6 +57835,7 @@ Default: Disabled. + 1 Interactive logon: Don't display username at sign-in This security setting determines whether the username of the person signing in to this PC appears at Windows sign-in, after credentials are entered, and before the PC desktop is shown. If this policy is enabled, the username will not be shown. @@ -51260,7 +57843,6 @@ If this policy is enabled, the username will not be shown. If this policy is disabled, the username will be shown. Default: Disabled. - 1 @@ -51273,7 +57855,10 @@ Default: Disabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Don't display username at sign-in LastWrite @@ -51283,6 +57868,7 @@ Default: Disabled. + 1 Interactive logon: Do not require CTRL+ALT+DEL This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on. @@ -51293,7 +57879,6 @@ If this policy is disabled, any user is required to press CTRL+ALT+DEL before lo Default on domain-computers: Enabled: At least Windows 8/Disabled: Windows 7 or earlier. Default on stand-alone computers: Enabled. - 1 @@ -51306,7 +57891,10 @@ Default on stand-alone computers: Enabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Do not require CTRL+ALT+DEL LastWrite @@ -51316,12 +57904,12 @@ Default on stand-alone computers: Enabled. + 0 Interactive logon: Machine inactivity limit. Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. Default: not enforced. - 0 @@ -51334,7 +57922,10 @@ Default: not enforced. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Machine inactivity limit LastWrite @@ -51344,6 +57935,7 @@ Default: not enforced. + Interactive logon: Message text for users attempting to log on This security setting specifies a text message that is displayed to users when they log on. @@ -51351,7 +57943,6 @@ This security setting specifies a text message that is displayed to users when t This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited. Default: No message. - @@ -51365,6 +57956,8 @@ Default: No message. text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Message text for users attempting to log on LastWrite 0xF000 @@ -51375,12 +57968,12 @@ Default: No message. + Interactive logon: Message title for users attempting to log on This security setting allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on. Default: No message. - @@ -51394,23 +57987,40 @@ Default: No message. text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Message title for users attempting to log on LastWrite - NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM + InteractiveLogon_SmartCardRemovalBehavior - Network access: Restrict clients allowed to make remote calls to SAM + 0 + Interactive logon: Smart card removal behavior -This policy setting allows you to restrict remote rpc connections to SAM. +This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. -If not selected, the default security descriptor will be used. +The options are: -This policy is supported on at least Windows Server 2016. - + No Action + Lock Workstation + Force Logoff + Disconnect if a Remote Desktop Services session + +If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. + +If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. + +If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. + +Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + +Default: This policy is not defined, which means that the system treats it as No action. + +On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. @@ -51424,19 +58034,41 @@ This policy is supported on at least Windows Server 2016. text/plain phone + Windows Settings~Security Settings~Local Policies~Security Options + Interactive logon: Smart card removal behavior LastWrite - NetworkSecurity_AllowPKU2UAuthenticationRequests + MicrosoftNetworkClient_DigitallySignCommunicationsAlways - Network security: Allow PKU2U authentication requests to this computer to use online identities. + 0 + Microsoft network client: Digitally sign communications (always) -This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine. - 1 +This security setting determines whether packet signing is required by the SMB client component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. + +Default: Disabled. + +Important + +For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. @@ -51449,16 +58081,579 @@ This policy will be turned off by default on domain joined machines. This would text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network client: Digitally sign communications (always) LastWrite + + MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees + + + + + 1 + Microsoft network client: Digitally sign communications (if server agrees) + +This security setting determines whether the SMB client attempts to negotiate SMB packet signing. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. + +If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. + +Default: Enabled. + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network client: Digitally sign communications (if server agrees) + LastWrite + + + + MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers + + + + + 0 + Microsoft network client: Send unencrypted password to connect to third-party SMB servers + +If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication. + +Sending unencrypted passwords is a security risk. + +Default: Disabled. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network client: Send unencrypted password to third-party SMB servers + LastWrite + + + + MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession + + + + + 15 + Microsoft network server: Amount of idle time required before suspending a session + +This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. + +Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. + +For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. + +Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network server: Amount of idle time required before suspending session + LowestValueMostSecure + + + + MicrosoftNetworkServer_DigitallySignCommunicationsAlways + + + + + 0 + Microsoft network server: Digitally sign communications (always) + +This security setting determines whether packet signing is required by the SMB server component. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. + +If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server. + +Default: + +Disabled for member servers. +Enabled for domain controllers. + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. +If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. + +Important + +For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: +Microsoft network server: Digitally sign communications (if server agrees) + +For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: +HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network server: Digitally sign communications (always) + LastWrite + + + + MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees + + + + + 0 + Microsoft network server: Digitally sign communications (if client agrees) + +This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. + +The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. + +If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. + +Default: Enabled on domain controllers only. + +Important + +For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature + +Notes + +All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: +Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. +Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. +Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. +Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. +If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. +SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. +For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Microsoft network server: Digitally sign communications (if client agrees) + LastWrite + + + + NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts + + + + + 1 + Network access: Do not allow anonymous enumeration of SAM accounts + +This security setting determines what additional permissions will be granted for anonymous connections to the computer. + +Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. + +This security option allows additional restrictions to be placed on anonymous connections as follows: + +Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. +Disabled: No additional restrictions. Rely on default permissions. + +Default on workstations: Enabled. +Default on server:Enabled. + +Important + +This policy has no impact on domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network access: Do not allow anonymous enumeration of SAM accounts + LastWrite + + + + NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares + + + + + 0 + Network access: Do not allow anonymous enumeration of SAM accounts and shares + +This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. + +Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. + +Default: Disabled. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network access: Do not allow anonymous enumeration of SAM accounts and shares + LastWrite + + + + NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares + + + + + 1 + Network access: Restrict anonymous access to Named Pipes and Shares + +When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: + +Network access: Named pipes that can be accessed anonymously +Network access: Shares that can be accessed anonymously +Default: Enabled. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network access: Restrict anonymous access to Named Pipes and Shares + LastWrite + + + + NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM + + + + + + Network access: Restrict clients allowed to make remote calls to SAM + +This policy setting allows you to restrict remote rpc connections to SAM. + +If not selected, the default security descriptor will be used. + +This policy is supported on at least Windows Server 2016. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network access: Restrict clients allowed to make remote calls to SAM + LastWrite + + + + NetworkSecurity_AllowPKU2UAuthenticationRequests + + + + + 1 + Network security: Allow PKU2U authentication requests to this computer to use online identities. + +This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Allow PKU2U authentication requests to this computer to use online identities. + LastWrite + + + + NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange + + + + + 1 + Network security: Do not store LAN Manager hash value on next password change + +This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. + + +Default on Windows Vista and above: Enabled +Default on Windows XP: Disabled. + +Important + +Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. +This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Do not store LAN Manager hash value on next password change + LastWrite + + + + NetworkSecurity_LANManagerAuthenticationLevel + + + + + 0 + Network security LAN Manager authentication level + +This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: + +Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. + +Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). + +Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). + +Important + +This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. + +Default: + +Windows 2000 and windows XP: send LM and NTLM responses + +Windows Server 2003: Send NTLM response only + +Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: LAN Manager authentication level + HighestValueMostSecure + + + + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients + + + + + 0 + Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + +This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. +Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + HighestValueMostSecure + + + + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers + + + + + 0 + Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + +This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + HighestValueMostSecure + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn + 1 Shutdown: Allow system to be shut down without having to log on This security setting determines whether a computer can be shut down without having to log on to Windows. @@ -51469,7 +58664,6 @@ When this policy is disabled, the option to shut down the computer does not appe Default on workstations: Enabled. Default on servers: Disabled. - 1 @@ -51482,7 +58676,10 @@ Default on servers: Disabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Shutdown: Allow system to be shut down without having to log on LastWrite @@ -51492,6 +58689,7 @@ Default on servers: Disabled. + 0 Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. @@ -51501,7 +58699,6 @@ Virtual memory support uses a system pagefile to swap pages of memory to disk wh When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled. - 0 @@ -51514,7 +58711,10 @@ Default: Disabled. text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + Shutdown: Clear virtual memory pagefile LastWrite @@ -51524,6 +58724,7 @@ Default: Disabled. + 0 User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop. This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. @@ -51531,7 +58732,6 @@ This policy setting controls whether User Interface Accessibility (UIAccess or U • Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. • Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. - 0 @@ -51544,7 +58744,10 @@ This policy setting controls whether User Interface Accessibility (UIAccess or U text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop LastWrite @@ -51554,6 +58757,7 @@ This policy setting controls whether User Interface Accessibility (UIAccess or U + 5 User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. @@ -51571,7 +58775,6 @@ The options are: • Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. • Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - 5 @@ -51584,7 +58787,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode LastWrite @@ -51594,6 +58800,7 @@ The options are: + 3 User Account Control: Behavior of the elevation prompt for standard users This policy setting controls the behavior of the elevation prompt for standard users. @@ -51604,7 +58811,6 @@ The options are: • Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. • Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - 3 @@ -51619,6 +58825,8 @@ The options are: phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Behavior of the elevation prompt for standard users LastWrite @@ -51628,6 +58836,7 @@ The options are: + 1 User Account Control: Detect application installations and prompt for elevation This policy setting controls the behavior of application installation detection for the computer. @@ -51637,7 +58846,6 @@ The options are: Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. - 1 @@ -51650,7 +58858,10 @@ Disabled: Application installation packages are not detected and prompted for el text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Detect application installations and prompt for elevation LastWrite @@ -51660,6 +58871,7 @@ Disabled: Application installation packages are not detected and prompted for el + 0 User Account Control: Only elevate executable files that are signed and validated This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. @@ -51669,7 +58881,6 @@ The options are: • Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. • Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. - 0 @@ -51682,7 +58893,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Only elevate executables that are signed and validated LastWrite @@ -51692,6 +58906,7 @@ The options are: + 1 User Account Control: Only elevate UIAccess applications that are installed in secure locations This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: @@ -51707,7 +58922,6 @@ The options are: • Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. • Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. - 1 @@ -51720,7 +58934,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Only elevate UIAccess applications that are installed in secure locations LastWrite @@ -51730,6 +58947,7 @@ The options are: + 1 User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. @@ -51739,7 +58957,6 @@ The options are: • Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. • Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. - 1 @@ -51752,7 +58969,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Run all administrators in Admin Approval Mode LastWrite @@ -51762,6 +58982,7 @@ The options are: + 1 User Account Control: Switch to the secure desktop when prompting for elevation This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. @@ -51771,7 +58992,6 @@ The options are: • Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. • Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. - 1 @@ -51784,7 +59004,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Switch to the secure desktop when prompting for elevation LastWrite @@ -51794,6 +59017,7 @@ The options are: + 0 User Account Control: Use Admin Approval Mode for the built-in Administrator account This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. @@ -51803,7 +59027,6 @@ The options are: • Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. • Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. - 0 @@ -51816,7 +59039,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Admin Approval Mode for the Built-in Administrator account LastWrite @@ -51826,6 +59052,7 @@ The options are: + 1 User Account Control: Virtualize file and registry write failures to per-user locations This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software. @@ -51835,7 +59062,6 @@ The options are: • Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. • Disabled: Applications that write data to protected locations fail. - 1 @@ -51848,7 +59074,10 @@ The options are: text/plain + phone + Windows Settings~Security Settings~Local Policies~Security Options + User Account Control: Virtualize file and registry write failures to per-user locations LastWrite @@ -51878,8 +59107,8 @@ The options are: - 0 + @@ -51892,6 +59121,10 @@ The options are: text/plain + + LocationProviderAdm.admx + LocationProviderAdm~AT~LocationAndSensors~WindowsLocationProvider + DisableWindowsLocationProvider_1 LastWrite @@ -51921,8 +59154,8 @@ The options are: - 1 + @@ -51937,6 +59170,9 @@ The options are: phone + EdgeUI.admx + EdgeUI~AT~WindowsComponents~EdgeUI + AllowEdgeSwipe LowestValueMostSecure @@ -51966,8 +59202,8 @@ The options are: - 65535 + @@ -51990,8 +59226,8 @@ The options are: - 65535 + @@ -52005,6 +59241,9 @@ The options are: text/plain + WinMaps.admx + WinMaps~AT~WindowsComponents~Maps + TurnOffAutoUpdate LastWrite @@ -52034,8 +59273,8 @@ The options are: - This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. 1 + This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. @@ -52048,6 +59287,10 @@ The options are: text/plain + + messaging.admx + messaging~AT~WindowsComponents~Messaging_Category + AllowMessageSync LowestValueMostSecure @@ -52057,8 +59300,8 @@ The options are: - This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. 1 + This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. @@ -52071,6 +59314,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -52081,8 +59325,8 @@ The options are: - This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. 1 + This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. @@ -52095,11 +59339,295 @@ The options are: text/plain + desktop LowestValueMostSecure + + MSSecurityGuide + + + + + + + + + + + + + + + + + + + ApplyUACRestrictionsToLocalAccountsOnNetworkLogon + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0201_LATFP + LastWrite + + + + ConfigureSMBV1ClientDriver + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0002_SMBv1_ClientDriver + LastWrite + + + + ConfigureSMBV1Server + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0001_SMBv1_Server + LastWrite + + + + EnableStructuredExceptionHandlingOverwriteProtection + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0102_SEHOP + LastWrite + + + + WDigestAuthentication + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0202_WDigestAuthn + LastWrite + + + + + MSSLegacy + + + + + + + + + + + + + + + + + + + AllowICMPRedirectsToOverrideOSPFGeneratedRoutes + + + + + + + + + + + + + + + + + text/plain + + phone + mss-legacy.admx + Mss-legacy~AT~Cat_MSS + Pol_MSS_EnableICMPRedirect + LastWrite + + + + AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers + + + + + + + + + + + + + + + + + text/plain + + phone + mss-legacy.admx + Mss-legacy~AT~Cat_MSS + Pol_MSS_NoNameReleaseOnDemand + LastWrite + + + + IPSourceRoutingProtectionLevel + + + + + + + + + + + + + + + + + text/plain + + phone + mss-legacy.admx + Mss-legacy~AT~Cat_MSS + Pol_MSS_DisableIPSourceRouting + LastWrite + + + + IPv6SourceRoutingProtectionLevel + + + + + + + + + + + + + + + + + text/plain + + phone + mss-legacy.admx + Mss-legacy~AT~Cat_MSS + Pol_MSS_DisableIPSourceRoutingIPv6 + LastWrite + + + NetworkIsolation @@ -52125,8 +59653,8 @@ The options are: - + @@ -52139,6 +59667,10 @@ The options are: text/plain + NetworkIsolation.admx + WF_NetIsolation_EnterpriseCloudResourcesBox + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_EnterpriseCloudResources LastWrite @@ -52148,8 +59680,8 @@ The options are: - + @@ -52162,6 +59694,10 @@ The options are: text/plain + NetworkIsolation.admx + WF_NetIsolation_Intranet_ProxiesBox + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_Intranet_Proxies LastWrite @@ -52171,8 +59707,8 @@ The options are: - + @@ -52185,6 +59721,10 @@ The options are: text/plain + NetworkIsolation.admx + WF_NetIsolation_PrivateSubnetBox + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_PrivateSubnet LastWrite @@ -52194,8 +59734,8 @@ The options are: - 0 + @@ -52208,6 +59748,10 @@ The options are: text/plain + + NetworkIsolation.admx + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_Authoritative_Subnet LastWrite @@ -52217,8 +59761,8 @@ The options are: - + @@ -52240,8 +59784,8 @@ The options are: - + @@ -52254,6 +59798,10 @@ The options are: text/plain + NetworkIsolation.admx + WF_NetIsolation_Domain_ProxiesBox + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_Domain_Proxies LastWrite @@ -52263,8 +59811,8 @@ The options are: - 0 + @@ -52277,6 +59825,10 @@ The options are: text/plain + + NetworkIsolation.admx + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_Authoritative_Proxies LastWrite @@ -52286,8 +59838,8 @@ The options are: - + @@ -52300,10 +59852,61 @@ The options are: text/plain + NetworkIsolation.admx + WF_NetIsolation_NeutralResourcesBox + NetworkIsolation~AT~Network~WF_Isolation + WF_NetIsolation_NeutralResources LastWrite + + Notifications + + + + + + + + + + + + + + + + + + + DisallowCloudNotification + + + + + 0 + + + + + + + + + + + + text/plain + + + WPN.admx + WPN~AT~StartMenu~NotificationsCategory + NoCloudNotification + LowestValueMostSecure + + + Power @@ -52323,14 +59926,41 @@ The options are: + + AllowStandbyStatesWhenSleepingOnBattery + + + + + + + + + + + + + + + + + text/plain + + phone + power.admx + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + AllowStandbyStatesDC_2 + LastWrite + + AllowStandbyWhenSleepingPluggedIn - + @@ -52356,8 +59986,8 @@ The options are: - + @@ -52383,8 +60013,8 @@ The options are: - + @@ -52410,8 +60040,8 @@ The options are: - + @@ -52437,8 +60067,8 @@ The options are: - + @@ -52464,8 +60094,8 @@ The options are: - + @@ -52491,8 +60121,8 @@ The options are: - + @@ -52518,8 +60148,8 @@ The options are: - + @@ -52545,8 +60175,8 @@ The options are: - + @@ -52592,8 +60222,8 @@ The options are: - + @@ -52619,8 +60249,8 @@ The options are: - + @@ -52666,8 +60296,8 @@ The options are: - 0 + @@ -52690,8 +60320,8 @@ The options are: - 1 + @@ -52706,6 +60336,9 @@ The options are: 10.0.10240 + Globalization.admx + Globalization~AT~ControlPanel~RegionalOptions + AllowInputPersonalization LowestValueMostSecure @@ -52715,8 +60348,8 @@ The options are: - 65535 + @@ -52730,6 +60363,9 @@ The options are: text/plain + UserProfiles.admx + UserProfiles~AT~System~UserProfiles + DisableAdvertisingId LowestValueMostSecureZeroHasNoLimits @@ -52739,8 +60375,8 @@ The options are: - Enables ActivityFeed, which is responsible for mirroring different activity types (as applicable) across device graph of the user. 1 + Enables ActivityFeed, which is responsible for mirroring different activity types (as applicable) across device graph of the user. @@ -52754,6 +60390,9 @@ The options are: text/plain + OSPolicy.admx + OSPolicy~AT~System~PolicyPolicies + EnableActivityFeed HighestValueMostSecure @@ -52763,8 +60402,8 @@ The options are: - This policy setting specifies whether Windows apps can access account information. 0 + This policy setting specifies whether Windows apps can access account information. @@ -52777,6 +60416,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessAccountInfo_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessAccountInfo HighestValueMostSecure @@ -52786,8 +60430,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. @@ -52800,6 +60444,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessAccountInfo_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessAccountInfo LastWrite ; @@ -52810,8 +60458,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. @@ -52824,6 +60472,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessAccountInfo_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessAccountInfo LastWrite ; @@ -52834,8 +60486,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. @@ -52848,6 +60500,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessAccountInfo_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessAccountInfo LastWrite ; @@ -52858,8 +60514,8 @@ The options are: - This policy setting specifies whether Windows apps can access the calendar. 0 + This policy setting specifies whether Windows apps can access the calendar. @@ -52872,6 +60528,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessCalendar_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCalendar HighestValueMostSecure @@ -52881,8 +60542,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. @@ -52895,6 +60556,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCalendar_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCalendar LastWrite ; @@ -52905,8 +60570,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. @@ -52919,6 +60584,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCalendar_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCalendar LastWrite ; @@ -52929,8 +60598,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. @@ -52943,6 +60612,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCalendar_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCalendar LastWrite ; @@ -52953,8 +60626,8 @@ The options are: - This policy setting specifies whether Windows apps can access call history. 0 + This policy setting specifies whether Windows apps can access call history. @@ -52967,6 +60640,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessCallHistory_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCallHistory HighestValueMostSecure @@ -52976,8 +60654,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. @@ -52990,6 +60668,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCallHistory_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCallHistory LastWrite ; @@ -53000,8 +60682,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. @@ -53014,6 +60696,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCallHistory_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCallHistory LastWrite ; @@ -53024,8 +60710,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. @@ -53038,6 +60724,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCallHistory_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCallHistory LastWrite ; @@ -53048,8 +60738,8 @@ The options are: - This policy setting specifies whether Windows apps can access the camera. 0 + This policy setting specifies whether Windows apps can access the camera. @@ -53062,6 +60752,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessCamera_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCamera HighestValueMostSecure @@ -53071,8 +60766,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53085,6 +60780,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCamera_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCamera LastWrite ; @@ -53095,8 +60794,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53109,6 +60808,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCamera_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCamera LastWrite ; @@ -53119,8 +60822,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53133,6 +60836,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessCamera_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessCamera LastWrite ; @@ -53143,8 +60850,8 @@ The options are: - This policy setting specifies whether Windows apps can access contacts. 0 + This policy setting specifies whether Windows apps can access contacts. @@ -53157,6 +60864,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessContacts_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessContacts HighestValueMostSecure @@ -53166,8 +60878,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -53180,6 +60892,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessContacts_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessContacts LastWrite ; @@ -53190,8 +60906,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -53204,6 +60920,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessContacts_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessContacts LastWrite ; @@ -53214,8 +60934,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -53228,6 +60948,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessContacts_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessContacts LastWrite ; @@ -53238,8 +60962,8 @@ The options are: - This policy setting specifies whether Windows apps can access email. 0 + This policy setting specifies whether Windows apps can access email. @@ -53252,6 +60976,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessEmail_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessEmail HighestValueMostSecure @@ -53261,8 +60990,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -53275,6 +61004,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessEmail_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessEmail LastWrite ; @@ -53285,8 +61018,88 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + + + + + + + + + text/plain + + AppPrivacy.admx + LetAppsAccessEmail_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessEmail + LastWrite + ; + + + + LetAppsAccessEmail_UserInControlOfTheseApps + + + + + + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + + + + + + + + + text/plain + + AppPrivacy.admx + LetAppsAccessEmail_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessEmail + LastWrite + ; + + + + LetAppsAccessGazeInput + + + + + 0 + This policy setting specifies whether Windows apps can access the eye tracker. + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + LetAppsAccessGazeInput_ForceAllowTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. @@ -53304,13 +61117,37 @@ The options are: - LetAppsAccessEmail_UserInControlOfTheseApps + LetAppsAccessGazeInput_ForceDenyTheseApps - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessGazeInput_UserInControlOfTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. @@ -53333,8 +61170,8 @@ The options are: - This policy setting specifies whether Windows apps can access location. 0 + This policy setting specifies whether Windows apps can access location. @@ -53347,6 +61184,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessLocation_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessLocation HighestValueMostSecure @@ -53356,8 +61198,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -53370,6 +61212,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessLocation_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessLocation LastWrite ; @@ -53380,8 +61226,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -53394,6 +61240,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessLocation_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessLocation LastWrite ; @@ -53404,8 +61254,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -53418,6 +61268,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessLocation_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessLocation LastWrite ; @@ -53428,8 +61282,8 @@ The options are: - This policy setting specifies whether Windows apps can read or send messages (text or MMS). 0 + This policy setting specifies whether Windows apps can read or send messages (text or MMS). @@ -53442,6 +61296,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessMessaging_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMessaging HighestValueMostSecure @@ -53451,8 +61310,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -53465,6 +61324,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMessaging_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMessaging LastWrite ; @@ -53475,8 +61338,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -53489,6 +61352,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMessaging_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMessaging LastWrite ; @@ -53499,8 +61366,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -53513,6 +61380,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMessaging_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMessaging LastWrite ; @@ -53523,8 +61394,8 @@ The options are: - This policy setting specifies whether Windows apps can access the microphone. 0 + This policy setting specifies whether Windows apps can access the microphone. @@ -53537,6 +61408,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessMicrophone_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMicrophone HighestValueMostSecure @@ -53546,8 +61422,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -53560,6 +61436,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMicrophone_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMicrophone LastWrite ; @@ -53570,8 +61450,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -53584,6 +61464,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMicrophone_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMicrophone LastWrite ; @@ -53594,8 +61478,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -53608,6 +61492,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMicrophone_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMicrophone LastWrite ; @@ -53618,8 +61506,8 @@ The options are: - This policy setting specifies whether Windows apps can access motion data. 0 + This policy setting specifies whether Windows apps can access motion data. @@ -53632,6 +61520,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessMotion_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMotion HighestValueMostSecure @@ -53641,8 +61534,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -53655,6 +61548,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMotion_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMotion LastWrite ; @@ -53665,8 +61562,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -53679,6 +61576,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMotion_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMotion LastWrite ; @@ -53689,8 +61590,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -53703,6 +61604,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessMotion_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessMotion LastWrite ; @@ -53713,8 +61618,8 @@ The options are: - This policy setting specifies whether Windows apps can access notifications. 0 + This policy setting specifies whether Windows apps can access notifications. @@ -53727,6 +61632,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessNotifications_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessNotifications HighestValueMostSecure @@ -53736,8 +61646,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -53750,6 +61660,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessNotifications_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessNotifications LastWrite ; @@ -53760,8 +61674,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -53774,6 +61688,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessNotifications_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessNotifications LastWrite ; @@ -53784,8 +61702,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -53798,6 +61716,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessNotifications_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessNotifications LastWrite ; @@ -53808,8 +61730,8 @@ The options are: - This policy setting specifies whether Windows apps can make phone calls 0 + This policy setting specifies whether Windows apps can make phone calls @@ -53822,6 +61744,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessPhone_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessPhone HighestValueMostSecure @@ -53831,8 +61758,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -53845,6 +61772,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessPhone_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessPhone LastWrite ; @@ -53855,8 +61786,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -53869,6 +61800,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessPhone_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessPhone LastWrite ; @@ -53879,8 +61814,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -53893,6 +61828,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessPhone_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessPhone LastWrite ; @@ -53903,8 +61842,8 @@ The options are: - This policy setting specifies whether Windows apps have access to control radios. 0 + This policy setting specifies whether Windows apps have access to control radios. @@ -53917,6 +61856,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessRadios_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessRadios HighestValueMostSecure @@ -53926,8 +61870,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -53940,6 +61884,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessRadios_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessRadios LastWrite ; @@ -53950,8 +61898,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -53964,6 +61912,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessRadios_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessRadios LastWrite ; @@ -53974,8 +61926,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -53988,6 +61940,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessRadios_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessRadios LastWrite ; @@ -53998,8 +61954,8 @@ The options are: - This policy setting specifies whether Windows apps can access tasks. 0 + This policy setting specifies whether Windows apps can access tasks. @@ -54012,6 +61968,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessTasks_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTasks HighestValueMostSecure @@ -54021,8 +61982,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54035,6 +61996,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTasks_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTasks LastWrite ; @@ -54045,8 +62010,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54059,6 +62024,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTasks_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTasks LastWrite ; @@ -54069,8 +62038,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54083,6 +62052,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTasks_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTasks LastWrite ; @@ -54093,8 +62066,8 @@ The options are: - This policy setting specifies whether Windows apps can access trusted devices. 0 + This policy setting specifies whether Windows apps can access trusted devices. @@ -54107,6 +62080,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsAccessTrustedDevices_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTrustedDevices HighestValueMostSecure @@ -54116,8 +62094,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -54130,6 +62108,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTrustedDevices_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTrustedDevices LastWrite ; @@ -54140,8 +62122,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -54154,6 +62136,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTrustedDevices_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTrustedDevices LastWrite ; @@ -54164,8 +62150,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -54178,6 +62164,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsAccessTrustedDevices LastWrite ; @@ -54188,8 +62178,8 @@ The options are: - This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. 0 + This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. @@ -54202,6 +62192,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsGetDiagnosticInfo_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsGetDiagnosticInfo HighestValueMostSecure @@ -54211,8 +62206,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. @@ -54225,6 +62220,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsGetDiagnosticInfo LastWrite ; @@ -54235,8 +62234,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. @@ -54249,6 +62248,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsGetDiagnosticInfo LastWrite ; @@ -54259,8 +62262,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. @@ -54273,6 +62276,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsGetDiagnosticInfo LastWrite ; @@ -54283,8 +62290,8 @@ The options are: - This policy setting specifies whether Windows apps can run in the background. 0 + This policy setting specifies whether Windows apps can run in the background. @@ -54297,6 +62304,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsRunInBackground_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsRunInBackground HighestValueMostSecure @@ -54306,8 +62318,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. @@ -54320,6 +62332,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsRunInBackground_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsRunInBackground LastWrite ; @@ -54330,8 +62346,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. @@ -54344,6 +62360,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsRunInBackground_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsRunInBackground LastWrite ; @@ -54354,8 +62374,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. @@ -54368,6 +62388,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsRunInBackground_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsRunInBackground LastWrite ; @@ -54378,8 +62402,8 @@ The options are: - This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. 0 + This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. @@ -54392,6 +62416,11 @@ The options are: text/plain + + AppPrivacy.admx + LetAppsSyncWithDevices_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsSyncWithDevices HighestValueMostSecure @@ -54401,8 +62430,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -54415,6 +62444,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsSyncWithDevices_ForceAllowTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsSyncWithDevices LastWrite ; @@ -54425,8 +62458,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -54439,6 +62472,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsSyncWithDevices_ForceDenyTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsSyncWithDevices LastWrite ; @@ -54449,8 +62486,8 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -54463,6 +62500,10 @@ The options are: text/plain + AppPrivacy.admx + LetAppsSyncWithDevices_UserInControlOfTheseApps_List + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsSyncWithDevices LastWrite ; @@ -54473,8 +62514,8 @@ The options are: - Allows apps/system to publish 'User Activities' into ActivityFeed. 1 + Allows apps/system to publish 'User Activities' into ActivityFeed. @@ -54488,6 +62529,36 @@ The options are: text/plain + OSPolicy.admx + OSPolicy~AT~System~PolicyPolicies + PublishUserActivities + HighestValueMostSecure + + + + UploadUserActivities + + + + + 1 + Allows ActivityFeed to upload published 'User Activities'. + + + + + + + + + + + text/plain + + + OSPolicy.admx + OSPolicy~AT~System~PolicyPolicies + UploadUserActivities HighestValueMostSecure @@ -54517,8 +62588,8 @@ The options are: - + @@ -54544,8 +62615,8 @@ The options are: - + @@ -54571,8 +62642,8 @@ The options are: - + @@ -54598,8 +62669,8 @@ The options are: - + @@ -54645,8 +62716,8 @@ The options are: - + @@ -54672,8 +62743,8 @@ The options are: - + @@ -54699,8 +62770,8 @@ The options are: - + @@ -54726,8 +62797,8 @@ The options are: - + @@ -54753,8 +62824,8 @@ The options are: - + @@ -54780,8 +62851,8 @@ The options are: - + @@ -54827,8 +62898,8 @@ The options are: - + @@ -54854,8 +62925,8 @@ The options are: - + @@ -54881,8 +62952,8 @@ The options are: - + @@ -54908,8 +62979,8 @@ The options are: - + @@ -54935,8 +63006,8 @@ The options are: - + @@ -54962,8 +63033,8 @@ The options are: - + @@ -54989,8 +63060,8 @@ The options are: - + @@ -55016,8 +63087,8 @@ The options are: - + @@ -55043,8 +63114,8 @@ The options are: - + @@ -55070,8 +63141,8 @@ The options are: - + @@ -55097,8 +63168,8 @@ The options are: - + @@ -55124,8 +63195,8 @@ The options are: - + @@ -55151,8 +63222,8 @@ The options are: - + @@ -55178,8 +63249,8 @@ The options are: - + @@ -55205,8 +63276,8 @@ The options are: - + @@ -55252,8 +63323,8 @@ The options are: - + @@ -55279,8 +63350,8 @@ The options are: - + @@ -55326,8 +63397,8 @@ The options are: - + @@ -55353,8 +63424,8 @@ The options are: - + @@ -55380,8 +63451,8 @@ The options are: - + @@ -55407,8 +63478,8 @@ The options are: - + @@ -55434,8 +63505,8 @@ The options are: - + @@ -55461,8 +63532,8 @@ The options are: - + @@ -55488,8 +63559,8 @@ The options are: - + @@ -55510,6 +63581,51 @@ The options are: + + RestrictedGroups + + + + + + + + + + + + + + + + + + + ConfigureGroupMembership + + + + + + This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. +Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. + + + + + + + + + + + text/plain + + phone + LastWrite + + + Search @@ -55535,8 +63651,8 @@ The options are: - 2 + @@ -55549,6 +63665,39 @@ The options are: text/plain + + Search.admx + AllowCloudSearch_Dropdown + Search~AT~WindowsComponents~Search + AllowCloudSearch + LowestValueMostSecure + + + + AllowCortanaInAAD + + + + + 0 + This features allows you to show the cortana opt-in page during Windows Setup + + + + + + + + + + + text/plain + + + phone + Search.admx + Search~AT~WindowsComponents~Search + AllowCortanaInAAD LowestValueMostSecure @@ -55558,8 +63707,8 @@ The options are: - 0 + @@ -55573,6 +63722,9 @@ The options are: text/plain + Search.admx + Search~AT~WindowsComponents~Search + AllowIndexingEncryptedStoresOrItems LowestValueMostSecure @@ -55582,8 +63734,8 @@ The options are: - 1 + @@ -55597,6 +63749,9 @@ The options are: text/plain + Search.admx + Search~AT~WindowsComponents~Search + AllowSearchToUseLocation LowestValueMostSecure @@ -55606,8 +63761,8 @@ The options are: - 1 + @@ -55630,8 +63785,8 @@ The options are: - 0 + @@ -55644,6 +63799,10 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + AllowUsingDiacritics HighestValueMostSecure @@ -55653,8 +63812,8 @@ The options are: - 3 + @@ -55667,6 +63826,7 @@ The options are: text/plain + LowestValueMostSecure @@ -55676,8 +63836,8 @@ The options are: - 0 + @@ -55690,6 +63850,10 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + AlwaysUseAutoLangDetection HighestValueMostSecure @@ -55699,8 +63863,8 @@ The options are: - 0 + @@ -55713,6 +63877,10 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + DisableBackoff HighestValueMostSecure @@ -55722,8 +63890,8 @@ The options are: - 0 + @@ -55736,17 +63904,48 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + DisableRemovableDriveIndexing HighestValueMostSecure + + DoNotUseWebResults + + + + + 1 + + + + + + + + + + + + text/plain + + + Search.admx + Search~AT~WindowsComponents~Search + DoNotUseWebResults + LowestValueMostSecure + + PreventIndexingLowDiskSpaceMB - 1 + @@ -55759,6 +63958,10 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + StopIndexingOnLimitedHardDriveSpace HighestValueMostSecure @@ -55768,8 +63971,8 @@ The options are: - 1 + @@ -55782,6 +63985,10 @@ The options are: text/plain + + Search.admx + Search~AT~WindowsComponents~Search + PreventRemoteQueries HighestValueMostSecure @@ -55791,8 +63998,8 @@ The options are: - 1 + @@ -55805,6 +64012,7 @@ The options are: text/plain + desktop HighestValueMostSecure @@ -55835,8 +64043,8 @@ The options are: - 1 + @@ -55859,8 +64067,8 @@ The options are: - 1 + @@ -55884,8 +64092,8 @@ The options are: - 1 + @@ -55908,8 +64116,8 @@ The options are: - 1 + @@ -55933,8 +64141,8 @@ The options are: - 0 + @@ -55949,17 +64157,20 @@ The options are: phone + TPM.admx + TPM~AT~System~TPMCategory + ClearTPMIfNotReady_Name HighestValueMostSecure - PreventAutomaticDeviceEncryptionForAzureADJoinedDevices + ConfigureWindowsPasswords - - 0 + 2 + Configures the use of passwords for Windows features @@ -55972,6 +64183,32 @@ The options are: text/plain + + phone + LastWrite + + + + PreventAutomaticDeviceEncryptionForAzureADJoinedDevices + + + + + 0 + + + + + + + + + + + + text/plain + + LastWrite @@ -55981,8 +64218,8 @@ The options are: - 0 + @@ -55995,6 +64232,7 @@ The options are: text/plain + HighestValueMostSecure @@ -56004,8 +64242,8 @@ The options are: - 0 + @@ -56018,6 +64256,7 @@ The options are: text/plain + HighestValueMostSecure @@ -56027,8 +64266,8 @@ The options are: - 0 + @@ -56041,6 +64280,7 @@ The options are: text/plain + HighestValueMostSecure @@ -56070,8 +64310,8 @@ The options are: - 1 + @@ -56095,8 +64335,8 @@ The options are: - 1 + @@ -56119,8 +64359,8 @@ The options are: - 1 + @@ -56143,8 +64383,8 @@ The options are: - 1 + @@ -56167,8 +64407,8 @@ The options are: - 1 + @@ -56192,8 +64432,8 @@ The options are: - 1 + @@ -56207,6 +64447,10 @@ The options are: text/plain + ControlPanel.admx + CheckBox_AllowOnlineTips + ControlPanel~AT~ControlPanel + AllowOnlineTips LowestValueMostSecure @@ -56216,8 +64460,8 @@ The options are: - 1 + @@ -56241,8 +64485,8 @@ The options are: - 1 + @@ -56266,8 +64510,8 @@ The options are: - 1 + @@ -56291,8 +64535,8 @@ The options are: - 1 + @@ -56315,8 +64559,8 @@ The options are: - 1 + @@ -56340,8 +64584,8 @@ The options are: - 1 + @@ -56364,8 +64608,8 @@ The options are: - + @@ -56378,6 +64622,10 @@ The options are: text/plain + ControlPanel.admx + SettingsPageVisibilityBox + ControlPanel~AT~ControlPanel + SettingsPageVisibility LastWrite @@ -56407,8 +64655,8 @@ The options are: - 0 + @@ -56423,6 +64671,9 @@ The options are: phone + SmartScreen.admx + SmartScreen~AT~WindowsComponents~SmartScreen~Shell + ConfigureAppInstallControl HighestValueMostSecure @@ -56432,8 +64683,8 @@ The options are: - 1 + @@ -56448,6 +64699,9 @@ The options are: phone + SmartScreen.admx + SmartScreen~AT~WindowsComponents~SmartScreen~Shell + ShellConfigureSmartScreen HighestValueMostSecure @@ -56457,8 +64711,8 @@ The options are: - 0 + @@ -56473,6 +64727,10 @@ The options are: phone + SmartScreen.admx + ShellConfigureSmartScreen_Dropdown + SmartScreen~AT~WindowsComponents~SmartScreen~Shell + ShellConfigureSmartScreen HighestValueMostSecure @@ -56502,8 +64760,8 @@ The options are: - 1 + @@ -56517,6 +64775,9 @@ The options are: text/plain + Speech.admx + Speech~AT~WindowsComponents~Speech + AllowSpeechModelUpdate LowestValueMostSecure @@ -56546,8 +64807,8 @@ The options are: - This policy controls the visibility of the Documents shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Documents shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56571,8 +64832,8 @@ The options are: - This policy controls the visibility of the Downloads shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Downloads shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56596,8 +64857,8 @@ The options are: - This policy controls the visibility of the File Explorer shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the File Explorer shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56621,8 +64882,8 @@ The options are: - This policy controls the visibility of the HomeGroup shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the HomeGroup shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56646,8 +64907,8 @@ The options are: - This policy controls the visibility of the Music shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Music shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56671,8 +64932,8 @@ The options are: - This policy controls the visibility of the Network shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Network shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56696,8 +64957,8 @@ The options are: - This policy controls the visibility of the PersonalFolder shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the PersonalFolder shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56721,8 +64982,8 @@ The options are: - This policy controls the visibility of the Pictures shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Pictures shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56746,8 +65007,8 @@ The options are: - This policy controls the visibility of the Settings shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Settings shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56771,8 +65032,8 @@ The options are: - This policy controls the visibility of the Videos shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. 65535 + This policy controls the visibility of the Videos shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. @@ -56791,13 +65052,13 @@ The options are: - ForceStartSize + DisableContextMenus - 0 + Enabling this policy prevents context menus from being invoked in the Start Menu. @@ -56810,6 +65071,35 @@ The options are: text/plain + + phone + StartMenu.admx + StartMenu~AT~StartMenu + DisableContextMenusInStart + LowestValueMostSecure + + + + ForceStartSize + + + + + 0 + + + + + + + + + + + + text/plain + + phone LastWrite @@ -56820,8 +65110,8 @@ The options are: - Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. 0 + Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. @@ -56834,6 +65124,7 @@ The options are: text/plain + phone LastWrite @@ -56844,8 +65135,8 @@ The options are: - Enabling this policy hides "Change account settings" from appearing in the user tile in the start menu. 0 + Enabling this policy hides "Change account settings" from appearing in the user tile in the start menu. @@ -56868,8 +65159,8 @@ The options are: - Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. 0 + Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. @@ -56893,8 +65184,8 @@ The options are: - Enabling this policy hides "Hibernate" from appearing in the power button in the start menu. 0 + Enabling this policy hides "Hibernate" from appearing in the power button in the start menu. @@ -56917,8 +65208,8 @@ The options are: - Enabling this policy hides "Lock" from appearing in the user tile in the start menu. 0 + Enabling this policy hides "Lock" from appearing in the user tile in the start menu. @@ -56941,8 +65232,8 @@ The options are: - Enabling this policy hides the power button from appearing in the start menu. 0 + Enabling this policy hides the power button from appearing in the start menu. @@ -56965,8 +65256,8 @@ The options are: - Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. 0 + Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. @@ -56990,8 +65281,8 @@ The options are: - Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. 0 + Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. @@ -57006,6 +65297,9 @@ The options are: phone + StartMenu.admx + StartMenu~AT~StartMenu + HideRecentlyAddedApps LowestValueMostSecure @@ -57015,8 +65309,8 @@ The options are: - Enabling this policy hides "Restart/Update and restart" from appearing in the power button in the start menu. 0 + Enabling this policy hides "Restart/Update and restart" from appearing in the power button in the start menu. @@ -57039,8 +65333,8 @@ The options are: - Enabling this policy hides "Shut down/Update and shut down" from appearing in the power button in the start menu. 0 + Enabling this policy hides "Shut down/Update and shut down" from appearing in the power button in the start menu. @@ -57063,8 +65357,8 @@ The options are: - Enabling this policy hides "Sign out" from appearing in the user tile in the start menu. 0 + Enabling this policy hides "Sign out" from appearing in the user tile in the start menu. @@ -57087,8 +65381,8 @@ The options are: - Enabling this policy hides "Sleep" from appearing in the power button in the start menu. 0 + Enabling this policy hides "Sleep" from appearing in the power button in the start menu. @@ -57111,8 +65405,8 @@ The options are: - Enabling this policy hides "Switch account" from appearing in the user tile in the start menu. 0 + Enabling this policy hides "Switch account" from appearing in the user tile in the start menu. @@ -57135,8 +65429,8 @@ The options are: - Enabling this policy hides the user tile from appearing in the start menu. 0 + Enabling this policy hides the user tile from appearing in the start menu. @@ -57159,8 +65453,8 @@ The options are: - This policy setting allows you to import Edge assets to be used with StartLayout policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when StartLayout policy is modified. + This policy setting allows you to import Edge assets to be used with StartLayout policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when StartLayout policy is modified. @@ -57183,8 +65477,8 @@ The options are: - This policy setting allows you to control pinning programs to the Taskbar. If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. 0 + This policy setting allows you to control pinning programs to the Taskbar. If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. @@ -57208,8 +65502,8 @@ The options are: - + @@ -57223,6 +65517,9 @@ The options are: text/plain phone + StartMenu.admx + StartMenu~AT~StartMenu + LockedStartLayout LastWrite @@ -57252,8 +65549,8 @@ The options are: - 1 + @@ -57266,7 +65563,11 @@ The options are: text/plain + phone + StorageHealth.admx + StorageHealth~AT~System~StorageHealth + SH_AllowDiskHealthModelUpdates LastWrite @@ -57276,8 +65577,8 @@ The options are: - + @@ -57323,8 +65624,8 @@ The options are: - 2 + @@ -57337,6 +65638,10 @@ The options are: text/plain + + AllowBuildPreview.admx + AllowBuildPreview~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowBuildPreview LowestValueMostSecure @@ -57346,8 +65651,8 @@ The options are: - 0 + @@ -57370,8 +65675,8 @@ The options are: - 1 + @@ -57384,6 +65689,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57393,8 +65699,8 @@ The options are: - 1 + @@ -57408,6 +65714,9 @@ The options are: text/plain + GroupPolicy.admx + GroupPolicy~AT~Network~NetworkFonts + EnableFontProviders LowestValueMostSecure @@ -57417,8 +65726,8 @@ The options are: - 1 + @@ -57431,6 +65740,10 @@ The options are: text/plain + + Sensors.admx + Sensors~AT~LocationAndSensors + DisableLocation_2 LowestValueMostSecure @@ -57440,8 +65753,8 @@ The options are: - 1 + @@ -57464,8 +65777,8 @@ The options are: - 3 + @@ -57478,6 +65791,11 @@ The options are: text/plain + + DataCollection.admx + AllowTelemetry + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowTelemetry LowestValueMostSecure @@ -57487,8 +65805,8 @@ The options are: - 1 + @@ -57511,8 +65829,8 @@ The options are: - + @@ -57533,36 +65851,13 @@ The options are: - DisableEnterpriseAuthProxy + ConfigureTelemetryOptInChangeNotification - This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. - 0 - - - - - - - - - - - text/plain - - LastWrite - - - - DisableOneDriveFileSync - - - - - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. 0 + @@ -57576,6 +65871,93 @@ The options are: text/plain + DataCollection.admx + ConfigureTelemetryOptInChangeNotification + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + ConfigureTelemetryOptInChangeNotification + HighestValueMostSecure + + + + ConfigureTelemetryOptInSettingsUx + + + + + 0 + + + + + + + + + + + + text/plain + + + DataCollection.admx + ConfigureTelemetryOptInSettingsUx + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + ConfigureTelemetryOptInSettingsUx + HighestValueMostSecure + + + + DisableEnterpriseAuthProxy + + + + + 0 + This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. + + + + + + + + + + + text/plain + + + DataCollection.admx + DisableEnterpriseAuthProxy + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + DisableEnterpriseAuthProxy + LastWrite + + + + DisableOneDriveFileSync + + + + + 0 + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + + + + + + + + + + + text/plain + + + SkyDrive.admx + SkyDrive~AT~WindowsComponents~OneDrive + PreventOnedriveFileSync HighestValueMostSecure @@ -57585,8 +65967,8 @@ The options are: - + @@ -57612,31 +65994,8 @@ The options are: + 0 Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy is not present or set to false, users will be presented with the option to save locally. The default is to not save locally. - 0 - - - - - - - - - - - text/plain - - LastWrite - - - - LimitEnhancedDiagnosticDataWindowsAnalytics - - - - - This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced) When you configure these policy settings, a Basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: https://go.microsoft.com/fwlink/?linkid=847594. Enabling Enhanced diagnostic data in the Allow Telemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional Enhanced level telemetry data. This setting has no effect on computers configured to send Full, Basic or Security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy. - 0 @@ -57650,6 +66009,34 @@ The options are: text/plain + LastWrite + + + + LimitEnhancedDiagnosticDataWindowsAnalytics + + + + + 0 + This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. By configuring this setting, you're not stopping people from changing their Telemetry Settings; however, you are stopping them from choosing a higher level than you've set for the organization. To enable this behavior, you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced).If you configure these policy settings together, you'll send the Basic level of diagnostic data plus any additional events that are required for Windows Analytics, to Microsoft. The additional events are documented here: https://go.Microsoft.com/fwlink/?linked=847594. If you enable Enhanced diagnostic data in the Allow Telemetry policy setting, but you don't configure this policy setting, you'll send the required events for Windows Analytics, plus any additional Enhanced level telemetry data to Microsoft. This setting has no effect on computers configured to send Full, Basic, or Security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy setting. + + + + + + + + + + + text/plain + + + DataCollection.admx + LimitEnhancedDiagnosticDataWindowsAnalytics + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + LimitEnhancedDiagnosticDataWindowsAnalytics LowestValueMostSecure @@ -57659,8 +66046,8 @@ The options are: - + @@ -57673,6 +66060,237 @@ The options are: text/plain + DataCollection.admx + TelemetryProxyName + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + TelemetryProxy + LastWrite + + + + + SystemServices + + + + + + + + + + + + + + + + + + + ConfigureHomeGroupListenerServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + HomeGroup Listener + LastWrite + + + + ConfigureHomeGroupProviderServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + HomeGroup Provider + LastWrite + + + + ConfigureXboxAccessoryManagementServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + Xbox Accessory Management Service + LastWrite + + + + ConfigureXboxLiveAuthManagerServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + Xbox Live Auth Manager + LastWrite + + + + ConfigureXboxLiveGameSaveServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + Xbox Live Game Save + LastWrite + + + + ConfigureXboxLiveNetworkingServiceStartupMode + + + + + 0 + This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~System Services + Xbox Live Networking Service + LastWrite + + + + + TaskScheduler + + + + + + + + + + + + + + + + + + + EnableXboxGameSaveTask + + + + + 0 + This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. + + + + + + + + + + + text/plain + + + phone LastWrite @@ -57696,14 +66314,38 @@ The options are: + + AllowHardwareKeyboardTextSuggestions + + + + + 1 + + + + + + + + + + + + text/plain + + + LowestValueMostSecure + + AllowIMELogging - 1 + @@ -57727,8 +66369,8 @@ The options are: - 1 + @@ -57752,8 +66394,8 @@ The options are: - 1 + @@ -57777,8 +66419,8 @@ The options are: - 1 + @@ -57791,6 +66433,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -57801,8 +66444,8 @@ The options are: - 1 + @@ -57826,8 +66469,8 @@ The options are: - 1 + @@ -57851,8 +66494,8 @@ The options are: - 1 + @@ -57876,8 +66519,8 @@ The options are: - 1 + @@ -57900,8 +66543,8 @@ The options are: - 1 + @@ -57916,6 +66559,60 @@ The options are: phone + TextInput.admx + TextInput~AT~WindowsComponents~TextInput + AllowLanguageFeaturesUninstall + LowestValueMostSecure + + + + AllowLinguisticDataCollection + + + + + 1 + + + + + + + + + + + + text/plain + + + TextInput.admx + TextInput~AT~WindowsComponents~TextInput + AllowLinguisticDataCollection + LowestValueMostSecure + + + + EnableTouchKeyboardAutoInvokeInDesktopMode + + + + + 0 + + + + + + + + + + + + text/plain + + LowestValueMostSecure @@ -57925,8 +66622,8 @@ The options are: - 0 + @@ -57939,6 +66636,7 @@ The options are: text/plain + HighestValueMostSecure @@ -57948,8 +66646,8 @@ The options are: - 0 + @@ -57962,6 +66660,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -57972,8 +66671,8 @@ The options are: - 0 + @@ -57986,10 +66685,203 @@ The options are: text/plain + phone HighestValueMostSecure + + ForceTouchKeyboardDockedState + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardDictationButtonAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardEmojiButtonAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardFullModeAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardHandwritingModeAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardNarrowModeAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardSplitModeAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + TouchKeyboardWideModeAvailability + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + TimeLanguageSettings @@ -58016,8 +66908,8 @@ The options are: - 0 + @@ -58061,8 +66953,8 @@ The options are: - 17 + @@ -58075,6 +66967,11 @@ The options are: text/plain + + WindowsUpdate.admx + ActiveHoursEndTime + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ActiveHours LastWrite @@ -58084,8 +66981,8 @@ The options are: - 18 + @@ -58098,6 +66995,11 @@ The options are: text/plain + + WindowsUpdate.admx + ActiveHoursMaxRange + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ActiveHoursMaxRange LastWrite @@ -58107,8 +67009,8 @@ The options are: - 8 + @@ -58121,6 +67023,11 @@ The options are: text/plain + + WindowsUpdate.admx + ActiveHoursStartTime + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ActiveHours LastWrite @@ -58130,8 +67037,8 @@ The options are: - 2 + @@ -58144,6 +67051,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoUpdateMode + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58153,8 +67065,8 @@ The options are: - 0 + @@ -58167,6 +67079,10 @@ The options are: text/plain + + WindowsUpdate.admx + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AllowAutoWindowsUpdateDownloadOverMeteredNetwork LastWrite @@ -58176,8 +67092,8 @@ The options are: - 0 + @@ -58190,7 +67106,12 @@ The options are: text/plain + phone + WindowsUpdate.admx + AllowMUUpdateServiceId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58200,8 +67121,8 @@ The options are: - 1 + @@ -58224,8 +67145,8 @@ The options are: - 1 + @@ -58239,6 +67160,9 @@ The options are: text/plain + WindowsUpdate.admx + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL LowestValueMostSecure @@ -58248,8 +67172,8 @@ The options are: - 7 + @@ -58262,6 +67186,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoRestartDeadline + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoRestartDeadline LastWrite @@ -58271,8 +67200,8 @@ The options are: - 15 + @@ -58286,6 +67215,10 @@ The options are: text/plain + WindowsUpdate.admx + AutoRestartNotificationSchd + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoRestartNotificationConfig LastWrite @@ -58295,8 +67228,8 @@ The options are: - 1 + @@ -58309,6 +67242,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoRestartRequiredNotificationDismissal + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoRestartRequiredNotificationDismissal LastWrite @@ -58318,8 +67256,8 @@ The options are: - 16 + @@ -58333,6 +67271,34 @@ The options are: text/plain + WindowsUpdate.admx + BranchReadinessLevelId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferFeatureUpdates + LastWrite + + + + ConfigureFeatureUpdateUninstallPeriod + + + + + 10 + Enable enterprises/IT admin to configure feature update uninstall period + + + + + + + + + + + text/plain + + LastWrite @@ -58342,8 +67308,8 @@ The options are: - 0 + @@ -58356,6 +67322,11 @@ The options are: text/plain + + WindowsUpdate.admx + DeferFeatureUpdatesPeriodId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferFeatureUpdates LastWrite @@ -58365,8 +67336,8 @@ The options are: - 0 + @@ -58379,6 +67350,11 @@ The options are: text/plain + + WindowsUpdate.admx + DeferQualityUpdatesPeriodId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferQualityUpdates LastWrite @@ -58388,8 +67364,8 @@ The options are: - 0 + @@ -58402,6 +67378,11 @@ The options are: text/plain + + WindowsUpdate.admx + DeferUpdatePeriodId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DeferUpgrade LastWrite @@ -58411,8 +67392,8 @@ The options are: - 0 + @@ -58425,6 +67406,11 @@ The options are: text/plain + + WindowsUpdate.admx + DeferUpgradePeriodId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DeferUpgrade LastWrite @@ -58434,8 +67420,8 @@ The options are: - 22 + @@ -58448,6 +67434,11 @@ The options are: text/plain + + WindowsUpdate.admx + DetectionFrequency_Hour2 + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DetectionFrequency_Title LastWrite @@ -58457,8 +67448,8 @@ The options are: - Do not allow update deferral policies to cause scans against Windows Update 0 + Do not allow update deferral policies to cause scans against Windows Update @@ -58471,6 +67462,10 @@ The options are: text/plain + + WindowsUpdate.admx + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DisableDualScan LastWrite @@ -58480,8 +67475,8 @@ The options are: - 14 + @@ -58494,6 +67489,11 @@ The options are: text/plain + + WindowsUpdate.admx + EngagedRestartDeadline + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + EngagedRestartTransitionSchedule LastWrite @@ -58503,8 +67503,8 @@ The options are: - 3 + @@ -58517,6 +67517,11 @@ The options are: text/plain + + WindowsUpdate.admx + EngagedRestartSnoozeSchedule + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + EngagedRestartTransitionSchedule LastWrite @@ -58526,8 +67531,8 @@ The options are: - 7 + @@ -58540,6 +67545,11 @@ The options are: text/plain + + WindowsUpdate.admx + EngagedRestartTransitionSchedule + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + EngagedRestartTransitionSchedule LastWrite @@ -58549,8 +67559,8 @@ The options are: - 0 + @@ -58563,6 +67573,10 @@ The options are: text/plain + + WindowsUpdate.admx + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + ExcludeWUDriversInQualityUpdate LastWrite @@ -58572,8 +67586,8 @@ The options are: - 0 + @@ -58586,6 +67600,11 @@ The options are: text/plain + + WindowsUpdate.admx + CorpWUFillEmptyContentUrls + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL LastWrite @@ -58595,8 +67614,8 @@ The options are: - 0 + @@ -58619,8 +67638,8 @@ The options are: - 0 + @@ -58643,8 +67662,8 @@ The options are: - 3 + @@ -58657,6 +67676,11 @@ The options are: text/plain + + WindowsUpdate.admx + ManagePreviewBuildsId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + ManagePreviewBuilds LastWrite @@ -58666,8 +67690,8 @@ The options are: - 0 + @@ -58680,6 +67704,11 @@ The options are: text/plain + + WindowsUpdate.admx + PauseDeferralsId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DeferUpgrade LastWrite @@ -58689,8 +67718,8 @@ The options are: - 0 + @@ -58703,6 +67732,11 @@ The options are: text/plain + + WindowsUpdate.admx + PauseFeatureUpdatesId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferFeatureUpdates LastWrite @@ -58712,8 +67746,8 @@ The options are: - + @@ -58726,6 +67760,10 @@ The options are: text/plain + WindowsUpdate.admx + PauseFeatureUpdatesStartId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferFeatureUpdates LastWrite @@ -58735,8 +67773,8 @@ The options are: - 0 + @@ -58749,6 +67787,11 @@ The options are: text/plain + + WindowsUpdate.admx + PauseQualityUpdatesId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferQualityUpdates LastWrite @@ -58758,8 +67801,8 @@ The options are: - + @@ -58772,6 +67815,10 @@ The options are: text/plain + WindowsUpdate.admx + PauseQualityUpdatesStartId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + DeferQualityUpdates LastWrite @@ -58781,8 +67828,8 @@ The options are: - 4 + @@ -58795,6 +67842,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58804,8 +67852,8 @@ The options are: - 0 + @@ -58818,6 +67866,11 @@ The options are: text/plain + + WindowsUpdate.admx + DeferUpgradePeriodId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + DeferUpgrade LastWrite @@ -58827,8 +67880,8 @@ The options are: - 0 + @@ -58841,6 +67894,7 @@ The options are: text/plain + HighestValueMostSecure @@ -58850,8 +67904,8 @@ The options are: - 0 + @@ -58864,6 +67918,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoUpdateSchDay + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58873,8 +67932,8 @@ The options are: - 1 + @@ -58887,6 +67946,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoUpdateSchEveryWeek + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58896,8 +67960,8 @@ The options are: - 0 + @@ -58910,6 +67974,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoUpdateSchFirstWeek + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58919,8 +67988,8 @@ The options are: - 0 + @@ -58933,6 +68002,11 @@ The options are: text/plain + + WindowsUpdate.admx + ScheduledInstallFourthWeek + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58942,8 +68016,8 @@ The options are: - 0 + @@ -58956,6 +68030,11 @@ The options are: text/plain + + WindowsUpdate.admx + ScheduledInstallSecondWeek + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58965,8 +68044,8 @@ The options are: - 0 + @@ -58979,6 +68058,11 @@ The options are: text/plain + + WindowsUpdate.admx + ScheduledInstallThirdWeek + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -58988,8 +68072,8 @@ The options are: - 3 + @@ -59002,6 +68086,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoUpdateSchTime + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoUpdateCfg LowestValueMostSecure @@ -59011,8 +68100,8 @@ The options are: - 15 + @@ -59026,6 +68115,10 @@ The options are: text/plain + WindowsUpdate.admx + RestartWarn + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + RestartWarnRemind LastWrite @@ -59035,8 +68128,8 @@ The options are: - 4 + @@ -59050,6 +68143,10 @@ The options are: text/plain + WindowsUpdate.admx + RestartWarnRemind + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + RestartWarnRemind LastWrite @@ -59059,8 +68156,8 @@ The options are: - 0 + @@ -59073,6 +68170,11 @@ The options are: text/plain + + WindowsUpdate.admx + AutoRestartNotificationSchd + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + AutoRestartNotificationDisable LastWrite @@ -59082,8 +68184,8 @@ The options are: - 0 + @@ -59096,6 +68198,10 @@ The options are: text/plain + + WindowsUpdate.admx + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + SetEDURestart LastWrite @@ -59105,8 +68211,8 @@ The options are: - CorpWSUS + @@ -59119,6 +68225,10 @@ The options are: text/plain + WindowsUpdate.admx + CorpWUURL_Name + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL LastWrite @@ -59128,8 +68238,8 @@ The options are: - + @@ -59143,10 +68253,821 @@ The options are: text/plain phone + WindowsUpdate.admx + CorpWUContentHost_Name + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL LastWrite + + UserRights + + + + + + + + + + + + + + + + + + + AccessCredentialManagerAsTrustedCaller + + + + + + This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Access Credential Manager ase a trusted caller + LastWrite + 0xF000 + + + + AccessFromNetwork + + + + + + This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Access this computer from the network + LastWrite + 0xF000 + + + + ActAsPartOfTheOperatingSystem + + + + + + This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Act as part of the operating system + LastWrite + 0xF000 + + + + AllowLocalLogOn + + + + + + This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Allow log on locally + LastWrite + 0xF000 + + + + BackupFilesAndDirectories + + + + + + This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Back up files and directories + LastWrite + 0xF000 + + + + ChangeSystemTime + + + + + + This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Change the system time + LastWrite + 0xF000 + + + + CreateGlobalObjects + + + + + + This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Create global objects + LastWrite + 0xF000 + + + + CreatePageFile + + + + + + This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Create a pagefile + LastWrite + 0xF000 + + + + CreatePermanentSharedObjects + + + + + + This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Create permanent shared objects + LastWrite + 0xF000 + + + + CreateSymbolicLinks + + + + + + This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Create symbolic links + LastWrite + 0xF000 + + + + CreateToken + + + + + + This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Create a token object + LastWrite + 0xF000 + + + + DebugPrograms + + + + + + This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Debug programs + LastWrite + 0xF000 + + + + DenyAccessFromNetwork + + + + + + This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Deny access to this computer from the network + LastWrite + 0xF000 + + + + DenyLocalLogOn + + + + + + This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Deny log on as a service + LastWrite + 0xF000 + + + + DenyRemoteDesktopServicesLogOn + + + + + + This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Deny log on through Remote Desktop Services + LastWrite + 0xF000 + + + + EnableDelegation + + + + + + This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Enable computer and user accounts to be trusted for delegation + LastWrite + 0xF000 + + + + GenerateSecurityAudits + + + + + + This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Generate security audits + LastWrite + 0xF000 + + + + ImpersonateClient + + + + + + Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. +1) The access token that is being impersonated is for this user. +2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. +3) The requested level is less than Impersonate, such as Anonymous or Identify. +Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Impersonate a client after authentication + LastWrite + 0xF000 + + + + IncreaseSchedulingPriority + + + + + + This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Increase scheduling priority + LastWrite + 0xF000 + + + + LoadUnloadDeviceDrivers + + + + + + This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Load and unload device drivers + LastWrite + 0xF000 + + + + LockMemory + + + + + + This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Lock pages in memory + LastWrite + 0xF000 + + + + ManageAuditingAndSecurityLog + + + + + + This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Manage auditing and security log + LastWrite + 0xF000 + + + + ManageVolume + + + + + + This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Perform volume maintenance tasks + LastWrite + 0xF000 + + + + ModifyFirmwareEnvironment + + + + + + This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Modify firmware environment values + LastWrite + 0xF000 + + + + ModifyObjectLabel + + + + + + This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Modify an object label + LastWrite + 0xF000 + + + + ProfileSingleProcess + + + + + + This user right determines which users can use performance monitoring tools to monitor the performance of system processes. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Profile single process + LastWrite + 0xF000 + + + + RemoteShutdown + + + + + + This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Force shutdown from a remote system + LastWrite + 0xF000 + + + + RestoreFilesAndDirectories + + + + + + This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Restore files and directories + LastWrite + 0xF000 + + + + TakeOwnership + + + + + + This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~User Rights Assignment + Take ownership of files or other objects + LastWrite + 0xF000 + + + Wifi @@ -59172,8 +69093,8 @@ The options are: - 1 + @@ -59187,6 +69108,9 @@ The options are: text/plain + wlansvc.admx + wlansvc~AT~Network~WlanSvc_Category~WlanSettings_Category + WiFiSense LowestValueMostSecure @@ -59196,8 +69120,8 @@ The options are: - 1 + @@ -59211,6 +69135,9 @@ The options are: text/plain + NetworkConnections.admx + NetworkConnections~AT~Network~NetworkConnections + NC_ShowSharedAccessUI LowestValueMostSecure @@ -59220,8 +69147,8 @@ The options are: - 1 + @@ -59244,8 +69171,8 @@ The options are: - 1 + @@ -59268,8 +69195,8 @@ The options are: - 1 + @@ -59292,8 +69219,8 @@ The options are: - 0 + @@ -59306,10 +69233,58 @@ The options are: text/plain + HighestValueMostSecureZeroHasNoLimits + + WindowsConnectionManager + + + + + + + + + + + + + + + + + + + ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork + + + + + + + + + + + + + + + + + text/plain + + phone + WCM.admx + WCM~AT~Network~WCM_Category + WCM_BlockNonDomain + LastWrite + + + WindowsDefenderSecurityCenter @@ -59335,8 +69310,8 @@ The options are: - + @@ -59350,6 +69325,38 @@ The options are: text/plain phone + WindowsDefenderSecurityCenter.admx + Presentation_EnterpriseCustomization_CompanyName + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_CompanyName + LastWrite + + + + DisableAccountProtectionUI + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AccountProtection + AccountProtection_UILockdown LastWrite @@ -59359,8 +69366,8 @@ The options are: - 0 + @@ -59373,7 +69380,39 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AppBrowserProtection + AppBrowserProtection_UILockdown + LastWrite + + + + DisableDeviceSecurityUI + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity + DeviceSecurity_UILockdown LastWrite @@ -59383,8 +69422,8 @@ The options are: - 0 + @@ -59397,7 +69436,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~Notifications + Notifications_DisableEnhancedNotifications LastWrite @@ -59407,8 +69450,8 @@ The options are: - 0 + @@ -59421,7 +69464,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~FamilyOptions + FamilyOptions_UILockdown LastWrite @@ -59431,8 +69478,8 @@ The options are: - 0 + @@ -59445,7 +69492,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DevicePerformanceHealth + DevicePerformanceHealth_UILockdown LastWrite @@ -59455,8 +69506,8 @@ The options are: - 0 + @@ -59469,7 +69520,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~FirewallNetworkProtection + FirewallNetworkProtection_UILockdown LastWrite @@ -59479,8 +69534,8 @@ The options are: - 0 + @@ -59493,7 +69548,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~Notifications + Notifications_DisableNotifications LastWrite @@ -59503,8 +69562,8 @@ The options are: - 0 + @@ -59517,7 +69576,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~VirusThreatProtection + VirusThreatProtection_UILockdown LastWrite @@ -59527,8 +69590,8 @@ The options are: - 0 + @@ -59541,7 +69604,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AppBrowserProtection + AppBrowserProtection_DisallowExploitProtectionOverride LastWrite @@ -59551,8 +69618,8 @@ The options are: - + @@ -59566,6 +69633,10 @@ The options are: text/plain phone + WindowsDefenderSecurityCenter.admx + Presentation_EnterpriseCustomization_Email + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_Email LastWrite @@ -59575,8 +69646,8 @@ The options are: - 0 + @@ -59589,7 +69660,11 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_EnableCustomizedToasts LastWrite @@ -59599,8 +69674,8 @@ The options are: - 0 + @@ -59613,7 +69688,95 @@ The options are: text/plain + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_EnableInAppCustomization + LastWrite + + + + HideRansomwareDataRecovery + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~VirusThreatProtection + VirusThreatProtection_HideRansomwareRecovery + LastWrite + + + + HideSecureBoot + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity + DeviceSecurity_HideSecureBoot + LastWrite + + + + HideTPMTroubleshooting + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + WindowsDefenderSecurityCenter.admx + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity + DeviceSecurity_HideTPMTroubleshooting LastWrite @@ -59623,8 +69786,8 @@ The options are: - + @@ -59638,6 +69801,10 @@ The options are: text/plain phone + WindowsDefenderSecurityCenter.admx + Presentation_EnterpriseCustomization_Phone + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_Phone LastWrite @@ -59647,8 +69814,8 @@ The options are: - + @@ -59662,6 +69829,10 @@ The options are: text/plain phone + WindowsDefenderSecurityCenter.admx + Presentation_EnterpriseCustomization_URL + WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization + EnterpriseCustomization_URL LastWrite @@ -59691,8 +69862,8 @@ The options are: - 1 + @@ -59707,6 +69878,9 @@ The options are: phone + WindowsInkWorkspace.admx + WindowsInkWorkspace~AT~WindowsComponents~WindowsInkWorkspace + AllowSuggestedAppsInWindowsInkWorkspace LowestValueMostSecure @@ -59716,8 +69890,8 @@ The options are: - 2 + @@ -59730,7 +69904,12 @@ The options are: text/plain + phone + WindowsInkWorkspace.admx + AllowWindowsInkWorkspaceDropdown + WindowsInkWorkspace~AT~WindowsComponents~WindowsInkWorkspace + AllowWindowsInkWorkspace LowestValueMostSecure @@ -59760,8 +69939,8 @@ The options are: - + @@ -59787,8 +69966,8 @@ The options are: - + @@ -59808,14 +69987,41 @@ The options are: LastWrite + + EnumerateLocalUsersOnDomainJoinedComputers + + + + + + + + + + + + + + + + + text/plain + + phone + logon.admx + Logon~AT~System~Logon + EnumerateLocalUsers + LastWrite + + HideFastUserSwitching - This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager. If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations. 0 + This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager. If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations. @@ -59829,9 +70035,86 @@ The options are: text/plain + Logon.admx + Logon~AT~System~Logon + HideFastUserSwitching HighestValueMostSecure + + SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart + + + + + + + + + + + + + + + + + text/plain + + phone + WinLogon.admx + WinLogon~AT~WindowsComponents~Logon + AutomaticRestartSignOn + LastWrite + + + + + WindowsPowerShell + + + + + + + + + + + + + + + + + + + TurnOnPowerShellScriptBlockLogging + + + + + + + + + + + + + + + + + text/plain + + phone + PowerShellExecutionPolicy.admx + PowerShellExecutionPolicy~AT~WindowsComponents~PowerShell + EnableScriptBlockLogging + LastWrite + + WirelessDisplay @@ -59858,8 +70141,8 @@ The options are: - This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. 1 + This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. @@ -59882,8 +70165,8 @@ The options are: - This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. 1 + This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. @@ -59906,10 +70189,10 @@ The options are: + 1 This policy allows you to turn off projection from a PC. If you set it to 0, your PC cannot discover or project to other devices. If you set it to 1, your PC can discover and project to other devices. - 1 @@ -59932,10 +70215,10 @@ The options are: + 1 This policy allows you to turn off projection from a PC over infrastructure. If you set it to 0, your PC cannot discover or project to other infrastructure devices, though it may still be possible to discover and project over WiFi Direct. If you set it to 1, your PC can discover and project to other devices over infrastructure. - 1 @@ -59958,10 +70241,10 @@ The options are: + 1 This policy setting allows you to turn off projection to a PC If you set it to 0, your PC isn't discoverable and can't be projected to If you set it to 1, your PC is discoverable and can be projected to above the lock screen only. The user has an option to turn it always on or off except for manual launch, too. - 1 @@ -59976,6 +70259,9 @@ The options are: phone + WirelessDisplay.admx + WirelessDisplay~AT~WindowsComponents~Connect + AllowProjectionToPC LowestValueMostSecure @@ -59985,10 +70271,10 @@ The options are: + 1 This policy setting allows you to turn off projection to a PC over infrastructure. If you set it to 0, your PC cannot be discoverable and can't be projected to over infrastructure, though it may still be possible to project over WiFi Direct. If you set it to 1, your PC can be discoverable and can be projected to over infrastructure. - 1 @@ -60011,8 +70297,8 @@ The options are: - 1 + @@ -60035,10 +70321,10 @@ The options are: + 0 This policy setting allows you to require a pin for pairing. If you turn this on, the pairing ceremony for new devices will always require a PIN If you turn it off or don't configure it, a pin isn't required for pairing. - 0 @@ -60052,6 +70338,9 @@ The options are: text/plain + WirelessDisplay.admx + WirelessDisplay~AT~WindowsComponents~Connect + RequirePinForPairing LowestValueMostSecure From 1d6a7981b9e87b9b082e802b25da353b1ffa5782 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Tue, 27 Feb 2018 00:13:52 +0000 Subject: [PATCH 041/119] Added sentences to bulleted list to make it clear which features require Windows Defender Antivirus. --- .../windows-defender-exploit-guard.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 817038ca1c..d75309c31b 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -9,8 +9,8 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security localizationpriority: medium -author: iaanw -ms.author: iawilt +author: andreabichsel +ms.author: v-anbic ms.date: 12/12/2017 --- @@ -33,10 +33,10 @@ Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrus There are four features in Windows Defender EG: -- [Exploit protection](exploit-protection-exploit-guard.md) can apply exploit mitigation techniques to apps your organization uses, both individually and to all apps -- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware -- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices -- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware +- [Exploit protection](exploit-protection-exploit-guard.md) can apply exploit mitigation techniques to apps your organization uses, both individually and to all apps. Works with third-party antivirus solutions and Windows Defender Antivirus (Windows Defender AV). +- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware. Requires Windows Defender AV. +- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV. +- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV. You can evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action: From 6a1bdfa038d144374fbb60367b1df52b691c39b8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 11:16:03 -0800 Subject: [PATCH 042/119] revised hub page --- windows/hub/TOC.md | 4 +--- windows/hub/index.md | 30 +++++++++--------------------- windows/security/index.yml | 2 ++ 3 files changed, 12 insertions(+), 24 deletions(-) diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md index b0a1554fa0..43202e6dde 100644 --- a/windows/hub/TOC.md +++ b/windows/hub/TOC.md @@ -5,8 +5,6 @@ ## [Configuration](/windows/configuration) ## [Client management](/windows/client-management) ## [Application management](/windows/application-management) -## [Identity and access management](/windows/security/identity-protection) -## [Information protection](/windows/security/information-protection) -## [Threat protection](/windows/security/threat-protection) +## [Security](/windows/security) ## [Troubleshooting](/windows/client-management/windows-10-support-solutions) ## [Other Windows client versions](https://docs.microsoft.com/previous-versions/windows) \ No newline at end of file diff --git a/windows/hub/index.md b/windows/hub/index.md index 7d1f965f9d..4c7f9358ed 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -37,12 +37,6 @@ Find the latest how to and support content that IT pros need to evaluate, plan, Windows 10 deployment
          Deployment
          - - - - Windows 10 client management -
          Client Management
          -
          @@ -50,21 +44,15 @@ Find the latest how to and support content that IT pros need to evaluate, plan, Manage applications in your Windows 10 enterprise deployment
          Application Management -
          - - Windows 10 access protection -
          Access Protection           + + + Windows 10 client management +
          Client Management

          - - Windows 10 device security -
          Device Security           - -
          - - Windows 10 threat protection -
          Threat Protection           - + + Windows 10 security +
          Security           @@ -74,9 +62,9 @@ Find the latest how to and support content that IT pros need to evaluate, plan, The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. - These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. +These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - - [Read more about Windows as a Service](/windows/deployment/update/waas-overview) +- [Read more about Windows as a Service](/windows/deployment/update/waas-overview) ## Related topics [Windows 10 TechCenter](https://go.microsoft.com/fwlink/?LinkId=620009) diff --git a/windows/security/index.yml b/windows/security/index.yml index 8999a8a950..7a1ed6b87c 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -14,6 +14,8 @@ metadata: keywords: protect, company, data, Windows, device, app, management, Microsoft365, e5, e3 + ms.localizationpriority: high + author: brianlic-msft ms.author: brianlic From 723c69a6906d714004fa9f1ed3b1bcfed7120424 Mon Sep 17 00:00:00 2001 From: computeronix <19168174+computeronix@users.noreply.github.com> Date: Tue, 27 Feb 2018 14:32:12 -0500 Subject: [PATCH 043/119] corrected typo instead of pased it should be based --- windows/whats-new/whats-new-windows-10-version-1607.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index fb858f7d9e..b296cc0cdf 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -81,7 +81,7 @@ Additional changes for Windows Hello in Windows 10, version 1607: ### VPN -- The VPN client can integrate with the Conditional Access Framework, a cloud-pased policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. +- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. - The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection. - New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](https://msdn.microsoft.com/en-us/library/windows/hardware/mt299056%28v=vs.85%29.aspx#whatsnew_1607) - Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins. From ba1edcfafa36ab85c1b9ee1d5809e36e02d165f4 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 11:33:21 -0800 Subject: [PATCH 044/119] added new png --- windows/hub/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/hub/index.md b/windows/hub/index.md index 4c7f9358ed..90c4720c7a 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -51,7 +51,7 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
          - Windows 10 security + Windows 10 security
          Security           From 746a27a847738dd540fda6cd6d14f7de673b5f61 Mon Sep 17 00:00:00 2001 From: computeronix <19168174+computeronix@users.noreply.github.com> Date: Tue, 27 Feb 2018 14:35:28 -0500 Subject: [PATCH 045/119] Typo and link correction Corrected link typo causing poor display issues Corrected link for Windows Hello for Business forgot pin to point to right article --- windows/whats-new/whats-new-windows-10-version-1703.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 3b14218ea5..9beb4709cd 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -122,7 +122,7 @@ New features in Windows Defender Advanced Threat Protection (ATP) for Windows 10 You can read more about ransomware mitigations and detection capability in Windows Defender Advanced Threat Protection in the blog: [Averting ransomware epidemics in corporate networks with Windows Defender ATP](https://blogs.technet.microsoft.com/mmpc/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/). -Get a quick, but in-depth overview of Windows Defender ATP for Windows 10 and the new capabilities in Windows 10, version 1703 see (Windows Defender ATP for Windows 10 Creators Update)[https://technet.microsoft.com/en-au/windows/mt782787]. +Get a quick, but in-depth overview of Windows Defender ATP for Windows 10 and the new capabilities in Windows 10, version 1703 see [Windows Defender ATP for Windows 10 Creators Update](https://technet.microsoft.com/en-au/windows/mt782787). ### Windows Defender Antivirus Windows Defender is now called Windows Defender Antivirus, and we've [increased the breadth of the documentation library for enterprise security admins](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). @@ -169,7 +169,7 @@ For Windows Phone devices, an administrator is able to initiate a remote PIN res For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. -For more details, check out [What if I forget my PIN?](/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password#what-if-i-forget-my-pin). +For more details, check out [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-features#pin-reset). ### Windows Information Protection (WIP) and Azure Active Directory (Azure AD) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. For more info, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune) and [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune). From 4bb6735f7a0777a94d159b99a277dfb54dc623a9 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 27 Feb 2018 19:53:13 +0000 Subject: [PATCH 046/119] Merged PR 6054: TextInput/AllowHardwareKeyboardTextSuggestions added to Policy CSP --- ...ew-in-windows-mdm-enrollment-management.md | 3 +- .../policy-configuration-service-provider.md | 6 +- .../mdm/policy-csp-textinput.md | 55 ++++++++++++++++++- 3 files changed, 61 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 55233dabcb..7a1fc2a5f2 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,7 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/05/2018 +ms.date: 02/26/2018 --- # What's new in MDM enrollment and management @@ -1411,6 +1411,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
        • Display/EnablePerProcessDpi
        • Display/EnablePerProcessDpiForApps
        • Experience/AllowWindowsSpotlightOnSettings
          • +
        • TextInput/AllowHardwareKeyboardTextSuggestions
            • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 1d2ee6afaa..1d092797ac 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/12/2018 +ms.date: 02/26/2018 --- # Policy CSP @@ -2811,6 +2811,7 @@ The following diagram shows the Policy configuration service provider in tree fo
            SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
            +
      ### TaskScheduler policies @@ -2823,6 +2824,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### TextInput policies
      +
      + TextInput/AllowHardwareKeyboardTextSuggestions +
      TextInput/AllowIMELogging
      diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 18075100b2..ea9e693f80 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 02/26/2018 --- # Policy CSP - TextInput @@ -21,6 +21,9 @@ ms.date: 01/30/2018 ## TextInput policies
      +
      + TextInput/AllowHardwareKeyboardTextSuggestions +
      TextInput/AllowIMELogging
      @@ -66,6 +69,56 @@ ms.date: 01/30/2018
      +
      + + +**TextInput/AllowHardwareKeyboardTextSuggestions** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies text prediction for hardware keyboard is always disabled. When this policy is set to 0, text prediction for hardware keyboard is always disabled. + + + +The following list shows the supported values: + +- 0 – Text prediction for the hardware keyboard is disabled and the switch is unusable (user cannot activate the feature). +- 1 (default) – Text prediction for the hardware keyboard is enabled. User can change the setting. + + + +
      From 3d60a7b52a0c526219e4af11ba6f5794b257c346 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 12:42:51 -0800 Subject: [PATCH 047/119] added image --- windows/hub/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/hub/index.md b/windows/hub/index.md index 90c4720c7a..fe2fe838a6 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -51,7 +51,7 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
      - Windows 10 security + Windows 10 security
      Security       From b3dbeaaeb981241dc987561646462131b4f243eb Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 12:51:56 -0800 Subject: [PATCH 048/119] added spaces to images --- windows/hub/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/hub/index.md b/windows/hub/index.md index fe2fe838a6..ac84a4855e 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -42,7 +42,7 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
      Manage applications in your Windows 10 enterprise deployment -
      Application Management       +
      Application Management
      @@ -52,7 +52,7 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
      Windows 10 security -
      Security       +
      Security
      From b58bd49c3ddb5e85ffab2434e393b61d6001dab4 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 13:00:08 -0800 Subject: [PATCH 049/119] added spaces to images --- windows/hub/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/hub/index.md b/windows/hub/index.md index ac84a4855e..a1d13d683d 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -51,7 +51,7 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
      - Windows 10 security + Windows 10 security
      Security
      From b2200d31f8725f178ecd17b02ce0ff848315e98a Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 27 Feb 2018 14:20:08 -0800 Subject: [PATCH 050/119] added spaces --- windows/hub/index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/hub/index.md b/windows/hub/index.md index a1d13d683d..73eff095ff 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -42,17 +42,17 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
      Manage applications in your Windows 10 enterprise deployment -
      Application Management
      +
      Application Management - +
      Windows 10 client management -
      Client Management
      +
      Client Management
      Windows 10 security -
      Security
      +
      Security From 9ddb49ba952cda14ab491ad31cb2ca5ff859f282 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Tue, 27 Feb 2018 22:58:48 +0000 Subject: [PATCH 051/119] Merged PR 6060: Deleting duplicate browser policy. --- .../mdm/policy-csp-browser.md | 56 ------------------- 1 file changed, 56 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index da6abdd0ee..762300cba0 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -2331,62 +2331,6 @@ The following list shows the supported values:
      - -**Browser/UseSharedFolderForBooks** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
      - - - -This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. - - - -The following list shows the supported values: - -- 0 - No shared folder. -- 1 - Use a shared folder. - - - - - - - - - - -
      Footnote: From cfbf00b7299ff56ef514aa60dfb26c3e11d24e5f Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Wed, 28 Feb 2018 19:14:01 +0000 Subject: [PATCH 052/119] Merged PR 6077: fixing 3 cellular href ID's to match consistent schema produced by automation fixing 3 cellular href ID's to match consistent schema produced by automation --- .../mdm/policy-configuration-service-provider.md | 6 +++--- windows/client-management/mdm/policy-csp-cellular.md | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 1d092797ac..ea66a5dbe0 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -536,13 +536,13 @@ The following diagram shows the Policy configuration service provider in tree fo Cellular/LetAppsAccessCellularData
      - Cellular/LetAppsAccessCellularData_ForceAllowTheseApps + Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
      - Cellular/LetAppsAccessCellularData_ForceDenyTheseApps + Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
      - Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps + Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
      Cellular/ShowAppCellularAccessUI diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 33931f6aa7..0a1606c00c 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -23,13 +23,13 @@ ms.date: 01/30/2018 Cellular/LetAppsAccessCellularData
      - Cellular/LetAppsAccessCellularData_ForceAllowTheseApps + Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
      - Cellular/LetAppsAccessCellularData_ForceDenyTheseApps + Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
      - Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps + Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
      Cellular/ShowAppCellularAccessUI @@ -103,7 +103,7 @@ The following list shows the supported values:
      -**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps** +**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps** @@ -146,7 +146,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
      -**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps** +**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps**
      @@ -189,7 +189,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N
      -**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps** +**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps**
      From bf96b81dc5c3b07c5c2d1d1383501a0367d0899e Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 28 Feb 2018 20:06:49 +0000 Subject: [PATCH 053/119] Merged PR 6079: TextInput policies in Policy CSP - added new policies --- ...ew-in-windows-mdm-enrollment-management.md | 8 + .../policy-configuration-service-provider.md | 24 + .../mdm/policy-csp-textinput.md | 432 ++++++++++++++++++ 3 files changed, 464 insertions(+) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 7a1fc2a5f2..4ff04b5dba 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1412,6 +1412,14 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    • Display/EnablePerProcessDpiForApps
    • Experience/AllowWindowsSpotlightOnSettings
    • TextInput/AllowHardwareKeyboardTextSuggestions
      • +
    • TextInput/ForceTouchKeyboardDockedState
      • +
    • TextInput/TouchKeyboardDictationButtonAvailability
      • +
    • TextInput/TouchKeyboardEmojiButtonAvailability
      • +
    • TextInput/TouchKeyboardFullModeAvailability
      • +
    • TextInput/TouchKeyboardHandwritingModeAvailability
      • +
    • TextInput/TouchKeyboardNarrowModeAvailability
      • +
    • TextInput/TouchKeyboardSplitModeAvailability
      • +
    • TextInput/TouchKeyboardWideModeAvailability
       diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ea66a5dbe0..4b54639bbb 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2866,6 +2866,30 @@ The following diagram shows the Policy configuration service provider in tree fo
      TextInput/ExcludeJapaneseIMEExceptShiftJIS
      +
      + TextInput/ForceTouchKeyboardDockedState +
      +
      + TextInput/TouchKeyboardDictationButtonAvailability +
      +
      + TextInput/TouchKeyboardEmojiButtonAvailability +
      +
      + TextInput/TouchKeyboardFullModeAvailability +
      +
      + TextInput/TouchKeyboardHandwritingModeAvailability +
      +
      + TextInput/TouchKeyboardNarrowModeAvailability +
      +
      + TextInput/TouchKeyboardSplitModeAvailability +
      +
      + TextInput/TouchKeyboardWideModeAvailability +
      ### TimeLanguageSettings policies diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index ea9e693f80..c301cc1884 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -66,6 +66,30 @@ ms.date: 02/26/2018
      TextInput/ExcludeJapaneseIMEExceptShiftJIS
      +
      + TextInput/ForceTouchKeyboardDockedState +
      +
      + TextInput/TouchKeyboardDictationButtonAvailability +
      +
      + TextInput/TouchKeyboardEmojiButtonAvailability +
      +
      + TextInput/TouchKeyboardFullModeAvailability +
      +
      + TextInput/TouchKeyboardHandwritingModeAvailability +
      +
      + TextInput/TouchKeyboardNarrowModeAvailability +
      +
      + TextInput/TouchKeyboardSplitModeAvailability +
      +
      + TextInput/TouchKeyboardWideModeAvailability +
      @@ -859,8 +883,416 @@ The following list shows the supported values: +
      + +**TextInput/ForceTouchKeyboardDockedState** + + +
      + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies the touch keyboard is always docked. When this policy is set to enabled, the touch keyboard is always docked. + + + +The following list shows the supported values: + +- 0 - (default) - The OS determines when it's most appropriate to be available. +- 1 - Touch keyboard is always docked. +- 2 - Touch keyboard docking can be changed. + + + + +
      + + +**TextInput/TouchKeyboardDictationButtonAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the dictation input button is enabled or disabled for the touch keyboard. When this policy is set to disabled, the dictation input button on touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Dictation button on the keyboard is always available. +- 2 - Dictation button on the keyboard is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardEmojiButtonAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the emoji button is enabled or disabled for the touch keyboard. When this policy is set to disabled, the emoji button on touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Emoji button on keyboard is always available. +- 2 - Emoji button on keyboard is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardFullModeAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the full keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the full keyboard mode for touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Full keyboard is always available. +- 2 - Full keyboard is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardHandwritingModeAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the handwriting input panel is enabled or disabled. When this policy is set to disabled, the handwriting input panel is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Handwriting input panel is always available. +- 2 - Handwriting input panel is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardNarrowModeAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the narrow keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the narrow keyboard mode for touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Narrow keyboard is always available. +- 2 - Narrow keyboard is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardSplitModeAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the split keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the split keyboard mode for touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Split keyboard is always available. +- 2 - Split keyboard is always disabled. + + + + +
      + + +**TextInput/TouchKeyboardWideModeAvailability** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Added in Windows 10, version 1803. Specifies whether the wide keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the wide keyboard mode for touch keyboard is disabled. + + + +The following list shows the supported values: + +- 0 (default) - The OS determines when it's most appropriate to be available. +- 1 - Wide keyboard is always available. +- 2 - Wide keyboard is always disabled. + + + + +
      Footnote: - 1 - Added in Windows 10, version 1607. From b68561c57c4065bdca882b8c8dab6d119cae6fc2 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 28 Feb 2018 12:54:24 -0800 Subject: [PATCH 054/119] new WIP4Biz intro; other additions from PMs --- windows/deployment/update/WIP4Biz-intro.md | 70 +++++++ .../update/images/WIP4Biz_Deployment.png | Bin 0 -> 28300 bytes .../update/images/WIP4Biz_Prompts.png | Bin 0 -> 66737 bytes .../waas-windows-insider-for-business.md | 181 ++++++------------ 4 files changed, 132 insertions(+), 119 deletions(-) create mode 100644 windows/deployment/update/WIP4Biz-intro.md create mode 100644 windows/deployment/update/images/WIP4Biz_Deployment.png create mode 100644 windows/deployment/update/images/WIP4Biz_Prompts.png diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md new file mode 100644 index 0000000000..4623481b66 --- /dev/null +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -0,0 +1,70 @@ +--- +title: Introduction to the Windows Insider Program for Business +description: Introduction to the Windows Insider Program for Business and why IT Pros should join it +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: high +ms.author: jaimeo +ms.date: 02/26/2018 +--- + +# Introduction to the Windows Insider Program for Business + + +**Applies to** + +- Windows 10 + +> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available. + +The Windows Insider Program for Business gives you the opportunity to: + +* Get early access to Windows Insider Preview Builds. +* Provide feedback to Microsoft in real time by using the Feedback Hub app. +* Sign in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. +* Register your Azure Active Directory domain in the program, allowing you to cover all users within your organization with just one registration. +* Starting with Windows 10, version 1709, enable, disable, defer, and pause the installation of preview builds through policies. +* Track feedback provided through the Feedback Hub App across your organization. + +Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. + +The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. + + + + + +## Explore new Windows 10 features in Insider Previews +Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: + +|Objective |Feature exploration| +|---------|---------| +|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.| +|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. | +|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)
      - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications
      - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. | +|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
      - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
      - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) | + +## Validate Insider Preview builds +Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: + +- Get a head start on your Windows validation process +- Identify issues sooner to accelerate your Windows deployment +- Engage Microsoft earlier for help with potential compatibility issues +- Deploy Windows 10 Semi-Annual releases faster and more confidently +- Maximize the 18-month support Window that comes with each Semi-Annual release. + +[![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png) +Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. + +|Objective |Feature exploration| +|---------|---------| +|Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.| +|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.| +|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. | +|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. | +|Guidance | Application and infrastructure validation:
      - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps)
      - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/en-us/windows/deployment/update/device-health-monitor)
      - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)| + diff --git a/windows/deployment/update/images/WIP4Biz_Deployment.png b/windows/deployment/update/images/WIP4Biz_Deployment.png new file mode 100644 index 0000000000000000000000000000000000000000..bf267aa9eb8a01d0ae43b623a0b3701550d2a269 GIT binary patch literal 28300 zcmdRW^;?wN7q1FPDk&{3AV`UXq%J6G)PHzcjsN> z`QGRL4fhAnQ66UIec!$ITA$hz{OqaR4IE0GD_5@EP>`2ay>jK6)|D$)nX#_HPk0*L z(&2yTW)eygSFYqm;GP*^z`wC=<+UBITp=Ss{kckRK=>DaNZ}}><)~(3>gZx%Z*s-f z;I*|Qr?rVA-2+Z;&ig#ubg!eYT(QPhkd}Dvs=J=x;z}|<8We#{{lQAdN=N$q8G06$ z>Q|h{Tx=o95AIYQPIzp>f7t!@-an?K|9(h-h3$H;Wq0WC$pnvH7xSY=rPd9x!+qT{ z(}}yEl}wX7yerf$_HiW$&?S)EOp^X|Sdw4q35n1p2pDbzzo*0UCwMK7fPW$6r5Kp7 z{OP1AiRj^%>HFSeVZ$#+21?7LUi#qw&zJhgTwGi%EG+EpIkK~7IxKd1oh+x{zI}V_ zLCV{IH)h+|+}z&QR#aTfshvO9D@S`iRCBT4${2A^ullSfMM_CYX-rWP6ZNDd3rigq zZ(gHq_C?&s+uK`A_WbOOo05=_r*Mv| zCie4Zg9rETe+c{EyQExum{U>`a|0g_&+}+HsKBiI0^Wn0jf)FEZ+)z+e|T6>RP?r} zSy#NOelMs9|wj?cV*M@M&dcX>`0zSvZsAN<{2=w#>OQhxG8Dk3`iR$$(mj!jj7 z`Y)}#Yne?mSRZjo@6|4CZIZnBSFrsF8ynV6PEJ}YBW6kCB{q6?cH3c80vg#b9~w2k zD=ihAD{i6ndHM1swS)J;h#A)nG>`qm!_$+Kt^{FCIXTSYCkhI$ZESpY+E|jjPnH?w z!p$u#jOspp`Xoo=HaC!=rghNw?TN!eM_oKtfEKA}4?V+zQG}>7Tx806tmzci)XDzp zSgW`%s*ZTVmR449aB+YC{yp35bBsZBGW8ap#%r&aL#KFcqyY1U|KImmPaZ!excJ2R zYGrn|K_uuiA#sY3va<4?mX3~8(w52d=OnT>ZrmWGn3hL~;OUzlY~Pg~%6=uh_r?48 z&clZkaR|yh`$1w_TKu7ja;MO+r|h;5l9QA5U%&qR`7?HlLzNFLYUegerKP1Yii(bR zb=|}mZ*RvrzMhBI_u<2bnT4ZyGBY!?y&pe+=0~uPl(F0NK zj~k;t?Tdg-;Pg#uLEELCluXT>)LmGcIy_WC!Gd)siPw0YI?I!26QgONsWC!fnOj;K zhsQ5CIy+0AiQiykW;WH=fB*601N+pT#(#}QkubMw{&$R*msj-1k8|_$^j~81yeXL9 z=IOdlW0by`Z4UeO>sNtk=V-YTdr1dZ4YjbdW%E0V=;&z6!kQYNgS8Q@_g=!KK9}D2 zT=$k#_;0PYu%f$7*JEJeKUCG$rf|FY-4j|O_uIHQN`~1Fcb*hm{bi=7_fvw6DOqS3 zs;s=NAFZ9Nn-CSQrnx*hv3yrXX+U1X`n}kXz7P zOn3(d2Mt%?_S%>w$hVdv#4oUvQi-D^B_+Av)uJ;RUjO>z;J}%bHl1bog(XvC(&x_< z)YO&+27a^G6%-Vnx}^EyMt&XPCUQ_$zf}@agZ-~TcMCpzSao@ENnT(7Kuizo$FWx zO*wRnmc04H#(yi#VkkQRi{~Amv9YmY_wGw_+lT!4f3=|oX=yj-=L3GQ+_@9Lc>TM; zby<4JrJjzCj+Pb{9v;FVviEl`u8oY0#ICHYoG9xuqponq<}J>|z<}d&-yM>9ScL3D zF1#BzQaG8)a&x(fiHX0KQ1F^2_oRRQntTa0B>y@tF3wh0S{mIwIlE-S9e202z1`4G zMn-07w>|*Z(hB-BSLN0<|Frn{_%C0mNRF1$B2JEv^D^FF{V+MC=hG=$hvvyI$fw_+ z&vjM?ElyHOir$rvkIy`!f1Gvev6G`CH8u4XW=C5as!5NiM~sEY_V)B#Aqy9NJ@cEzgFvowR_~Z#YE3512dPyFM@$uPiH*~dpKHiIz>&$4D zL>J~z-AHRejYsdK2BJQFA|)m^`bl+FbZ2Kr@Z}@wM!hS$E>2DcBN?75sA+-p@Dr*w z?@eV%bWKf7_1_;J9)9$E(&ti?cdul;+zFTGZKFOf}J49*Wf*8KINX+^k?seUYo)*CtP zv^rSliRGV>k+JsW*Wsj(&qSqL8rMLD_qou^Yqt$01OrzS_#d@B(|rB<_2b7OIXPUZ zG=`bb$rsC2lJ#IzK}!q5b*(ZnF)1o4+TY(7zvRMd_c`0fEIA0eimJq3e^I}snWoUZ zygb+i82z`*N*%5rjM?z(y5>znKARnF@# ztgWq|KmQmSirWZ1r%puRnl9Z=64WHzWkrPt6#31Y1p9)$O1@oPPd7Bh@KCc0i?`J{ z_jbsAUL|8=CgE+wi224?Su5+SSFddQpnnl4apR{>&qjz>yKWn@68qtu3p=mXeuZVs z(Jr`d{pel8W0)dBXHN+|-WhDFb@#Db2fbCNcI=XtF%hSm* zXT^u8YD7f&`};#j=}Hn$N-*+&J~TG=jt-0Cwx~Nvbc|?JYi%tZfDW`Z-2^;m3>w2{ zIy!%&l*Qa&a%^pF;fozzN$Be8iZ$r}t_1zvpP#NbibXk6 z0Dvbm7uRN_9L@1wzw&gMQA>E8dU$xaE&U9gKc%U@<~{~GIujFFIKhALFp=ReK)CKXfn!=ybC8I+1Jl{pI)WA&=qMgM)+i z_V#!0@G4nxadG+hitNOvr3d=^`tpm55BB$!6cromq@A4j%zi2?&@ULFwn@DLKns!p z#Xy6Bb0{lPzT0hKi`V|84#P_8K++L+RTjq zRbJkL>T0nLD4t*yCMFvj8?CLWy0?^+lmP(&{cKwjwSY&5*_c#ZTwJ6@%{|tfaIbtG z?&%?*5P0x_Ly)F#(gPk4! zJm<}cFcm?(5o_3n03jF?#Lu=GnnKCoBc_{*EQab?pJ4?$I5>>psAQ$3rmn26jx0%G zs^kx;!%SOSTT5QaW3jFGhkA#3fK~U*)zZ@P>C>){GF8F5x!HKA`A=V1>)b=d zprWNkevSHLU_8PR+4Urb6R-dsbJu5H%mgbdD`;TS;=yt{adgai){kNWoQw{PDXoP>nnR8n{G_rs6_+LGjV&4BM9 zSqvK+8&6JF_T=Qmuof^-LR(uKAZFb%`#Y&L_6EATx{n?`($*f4y8J=>7&d;!uU|5f z0Zq55sUJLe&@6;6+L{HW2FN%uF|oI|7wN7QLL8dx*AS`aa~^$4tVsWFbCAx_3)%n@ zz`RKv`_O?IfmuOE^Xo+s&KrZ>!s6om^gMCt;jr|`XY{6ATwI8UGBQneMM2)8qM{xi zr-0mmliXt{9i@6=WHc*<9q{ihKf%XB>xZ6x3or*iFE5pw@v0P_C)7-}-K^}ZSGQBC zW-s| zJoHT{tm^9O_dH|Gvm(Af(%~x7(i%2oKYjS1s-?xMsA4lySXii7g{y#~glAVrGjnpf zJ3GU|!=3Hz`+9obQ|_9J`qID~LH`sGC;|8cMF2}58iAGI(9qxQ?QdSc9)YHFeB9L1vbeYywY$+dFp2z!q3vj4xd`@gaBvKb zj9$HbNyoor^%6>ef`Y;z5&8)f4fL@02N#@bKA{xAq%d z4Ev_6tPF}E5NDvKR| z4GU9pb}nXRlB{g@^YeoN0#IpS;JLA&wCI^qbCtEkix)3o&58k?;{ zAeOCHBW9vU`~fbSZE15;E;uJUd!aeVrrHx2gwOe^9#{3zOvo*E(~j6Y09d1=qu;+X zYZ+W#oG&deEln+ua&CUz=bD8*M>o*tjeuT&lRz4jy_AU(G zM`!t^%0xlCnFf4u&(&Wg+`cP0U%#R!nV6ay9&NYKUcy8zEAu%H zP+F`WdS1CZT}va15HV~(Vpoc7;Q@B(QIfH$-m&b>+ra26&>{S}6rrmpKn zL%N>ZO_65MZ`%!tJY0p0j(6rGL=VU-dJPp6u)kkyHQ-zJ?V(E)7Zeoy{J8>9zpf5N zx8e8UuH#o_udZkO_%ZdUZel_VW^Gm$o)2e;dt+5y-JOz5rTfqyr|@A>fRSrgx$^~X zUk_}4e;E=I!fm@T_Rx_=)ZKBR<1^!?m7JWMqCfvI>rHPmE?p6qjhCOWgoT7q2(TA> zXWIWq5Qn9;HH`fGs`t<%xCJ(f+yMt7eSwr93t&0u>FM8}!x-c`m$A0y)V-~_f;F>I zSX6X=ak@FiDfk)1A8fK-mhFJ-5Wt~DAf0GoW0NH6anKw_#iI@lFM*Mez-9+k&=*Iu z&d$ycA3jWfno$4T&CQMf){J)1n?G{2UWluMywOuJ3@d*I1|I3Bq@?ik^FtqV}d?uH+Mbhc*ji5{09@ks7x2LUm~oV(vS03Z$46AnU|k!<{H|!2CNnI{HFY z^#ic-+1a;0SU5OD56UqR;^xXyQVl@)Mn)bA3X-dKx3|xn9k_tNwYssf@c6dGSVG1_ zJ(Mo!i5BSFryu$|hD(Y&Yj?L>Jc-Xj!^nv78mR-#BSqlC%>yt%fBayT$50zNi^6Hg z!9&NV|0E+VEhr?kva~eDv2vGI7hg=pGs~TYHj26{7SR0Qv9VBM^wUZ_$VhfEticuP{7gSb>&LUw(XY!mt9JEX-s4 z8UtN%KS0~IHf)Wj08BbM=Cb&(A2qaAgVge}h!I)QGd3n-ulUgI-?F}}aK6!X3Mi>` z+W^%drpjH-_hC=~*MMGzjOFCygjQ*k;Bs;12810}R1uWJgS|aGe0-3tX3_ZqVEpvl z+K_n=YocZRqcl!NHjSy(G{jliB#LNkdeWlUfA4>U}~ZH)v|0&a{vB)P%2=p z0li8{NC0$!iKi%o9|JcH3@dw-uyK5OeSQAmQ~{+~_EWYN)zr|oGyxw2o&%#xNJz+* zrrQaZ{1zEmOjK0=;9zlKp`(k7+`toM<(fn6cziPFWl_y_tQk(ly8ab-pgdvv5xPIK zvS5(`N+J5*FX{_Eb@90h(-yWMIRynQJRM1WWDkuQ`PHi_xd2Bqozd;cpz|`HdZK2p z$b;*cmkXkc8;ioL)emAY&lZzb4=w!^$%9hyhU?-P>#88Lt)t^WPY?N!+nO6LAdBMS;)#g~q&vfWr5%jl6lJ;KQ+w#G3O4}u z&G?kMZqERXzOfFV$cRM3c5|W%iUOC6({m*weYoitQkeWzzA^Sac%ts}?YD}vSZl3C z!ZZ`&Jm5735q&sE zslOb-Z13pkqh z6?WU1d%{&^Y-#!KDJ?DSAog>0_1>tsxOQ1sPM(kzS~9Yso}OAE3`)TqkXR}!sdIX} zySo8n$;bq>xLxsKh4BqH2}tz^4>vb~&(#q3O9b#)P~fts2peC;4&>;|BP6dCYHDjg zv`^%jd*E|%1~f8H1(dQYPH->uOO^YBI=1wyax3jg9XCT( zo2e1LVo6?}L7Jr%!S%rHCm^3|*CbzA|1&hSI6p5VCs**Vv1)iM`K^IgNBB`2wJXW| zS4qF$0`TdW!#7j?ZXmVISDN)lvNIwe;1(%qzRFk8*ky1ZEJ>K920RYOT}D{tpFVBI zgK0-D=DI}}XmE``xTyj_F`#)+EjEVp8ag}Ip~*|81AqL2+2uMHDF>oegDkLBZl~qG zZ{6aTBG&;tXk9v@$wi)@pKtA<0c^9Fg*v`gMow`Hq6K9XgQieBLjo0Xm^;I4NEgJus^wj_JsmHurE?Euet7a3M_Vf zM!SL6eSv$x)Zs8ydlfG;Bf~(O#GN184J!?VB`kXlHo4K~@NV^_gz`cRQL`2+eEiGmMU_s(GH3I}N z9|QPg_)n&0kQwdFa(Yr=)l{pm@0AW46O(|avG(huMOwG+M@2;upMW%jiHXVcB{&#c zmL9M8D43W9dZ(;d1}%jv>r@Gl9J(V7b#=gCfd~YsD!IghZiPWK(95Z%0IrSx{acX! z!_35_x9whk5KLX_O$Uq!x@NSNnW#f@9HNxkD-YrM$=T|Fnjq@}9}Eapr=cV*Adkl9 z%&zf1z+8~8q-A7M)Bs^nf|Ee`!Zj8IHG0N+TF?gMgIXP65@5NJUjPK;X@Itv=(*Dd zOWr=jLppY zP4*kTC?1w2Y{G*KE-fvM{Cx}Li(>C{_dy>}BtVK{>`oB#qTJERGsMUO5&NBiv0z6J z%*?Sd&y|6@dvuJ3BqM|kQ=I~n(w_`H$esC)7N%uIuT#HNQ$zEsGlq`X>R^UiK&S_zOyv{s(uYE7qu((r-mss{+8I# zb}UX!`O;|31+yd$gH`d)zZb+%1IM-xcb4?3-1ny&f`FcaERsv5G_gIaeizuutuX-y5V#edgj};a1UX{>|P01t0Zr|DHoV#5bg@q9z6?Bt+<*Ktk zYe*{yMNsL(&wb-yP=@#g9nrIR?}Pnd_fGG{3!JFDCj&6;TAUI~zh-59$j;BM`tFwO zrxsGCm!agEW+mOvRdcaeb9v5n6HWUU6CxJ+UR|98s_(f@ai5e-de1(_)1xO8!-C3& zH?p&{1ETeEh(z`I^F46mHb#p=Uk&%bSQs2Uu7qN3zuSrr|HmZ$yq9!=gI8LR1FUNieUT__OgTr|%weYBY5V`^sR(DZ>o z*Va=3KZ|8U!oh*}PQ5~URh1|o->ru>b33-TZzn(zU#{w1`X6uY0+m9Lp`oGiptvG5 z*&xHZ4D@E1fdM)V(wjIW8SE= z`#Ya`PCyT3G!=4(z7mB4kMB2DQ2>^IL##)rLO7H2(Ej(WK!DLO@z5Ilv=aZp7 z6Qu!{1r-b?V+;30CTwSNL7xjx0MZ{APCZr4YgLY+Rd1EU8s58ikA#HeKdyLfG)iSa zwXe9Bd%xdBk^hjr=w{Ucevv@2N%TGs;iu?mJJcfx2@TzroyDP%c-O*|Ajo#cPzgGK zg$4UsbYf!HhB7Gu0XHzJUcF7|U0uK>{`^!YBqRh7kyCxL0s|%P!-x8fVgHv%eaE?0 zLM)<7?AT3cF>>Ol3G+Uxvw z@~2;Dv3hKz#lo`zD#l-J=G$)Liio3@f7fU4;IM6NvL8;@Z1Q14kj;|8xX#VimVoD` z40WITe6*%4CyftSZy+-fxNvt^i+2jT@3Bg20acX+VS=Y2MJfn1Gj5bMB1p8+D8zGX z^A9-Rb};;a-rl-(E6QEj(fjJUle6>8{L50?tKa4N)HO6f@iP2L6$YEK(Eoetr|7`o zh-#w`pKbEgZ8;{>CeU?kO)-fLz{G~)oxUS1T#=vu;eYk}!BfsxW_V&ETuNR~PtVF~ zy{G3HFc9cT>)`at)BtfcJe>}r<))H8S}W)VZJmjQMSQ!F7{+6@^E&0V$=0`&we8XD zNp1_DVN>zr{Gs1XAr@Wo*(h5)SpOR&0|sVu;?^M$PNTrYM4ER{9`zNLb<0nRYkZzRmn5N5iiaK=EEJ9bi?G-&95dDhD#p|C|u_a9@>m8d>(F>Mk;pS zdLsFwjtb|}B71?bk-WU3f@Ri|LgLmm2x#EZ^O5d=3(UmD6=96(@kibL{c1`|HzxdV z@~{jXLC#=iJRtW7r5*>sr?xs^xml{~A8w3m%q5Acx>Hda4z~A-JFW1Cv6p(v?sS4TbE5{R^Is&1hlpc@=CGI&RqMHZ|v@yGbyv65cNX>X7S-$tx&m5J7sqr~c&s zlpExnPz9Y5>jXXvQg7Uo&zFr&O$iAJkvAjr6crVTh>2O2PygmU@_;QWUjoV&(jCzG zFbzmU1TpU;)d$rE9eVPyXu{p2rG_}971N*-nbMAQWM^!G_R4mLe&G4@=Tpf+nQrJj zfePjRlD;yopja%iF*7r>v9%8k#W;OWPw$R@NPNzycNJt^{k_j-i4yhw{ryII3>%X* zwC*6o%EkZ8&X$cEt90Wv^#J4o!W#Bpdaius$IwMV9uD`p639cPIy>Nb7wZn#14DoQ z!2FN~s{Qcc^2!Q~9Q)K$pRNWsRr{Yfl%{WF6U&Qxn`uTqNvMm+684yqjW{}NxgZHH z`Lb1sB$Yt=aQ4vH!7_aL9PKH6EASZs^B0q<3h?uPiix2; zEDuPjh`j6I!pQ5WP=fV?yxdx%Cv~EcYW$__*VeAC?-nb;9=sGuwb;2>jEs!*1#0O} z>4(ES-&C4))0F=D@nZ?>Jyd)K4D$=y*!8XH2FvTRT3W-fg`Osf-S`4B@Y8Px1pA;4 zhFf+0{v8TZwv&_009A|IVmJP)RL-<}Io7GBOI@5QB{tlbEM&@ws< zjbNJA=gjYti~S?QRw^QeZllw9tU=mW2CELmJGm#JA>%BrPuA!uDz2@UOg>doYI<(m zcy@LM?jqj1xh94AgRL+HDoV=#RP^!jaqR)B&2kJoh1W7}d`9YMnpUf}Mu(vqbww@} z+l9!I`nZ&etaEV59b@v>ItC^WL>L5qseZH@my|#mWm2?{DP=;DM(66e>N)V!S zbaZ+fl)iXQiBQMF4`FUx$G`v}m64elA?im=`teg_jOHK=CYow0?GG6)DeCeZ%4O-! zCH(d=eCQac^12bOx2!5TL-RmDz(GCM2P+pV{R3#dP+?$tgP?$qk1s9y`t@>Nx6YOO z_8}`m%*}%|H+6Zuc>;K1;)r*IU!i@ltk2&5==z5EwE~8yA_BIKl!+u*mVOzQV z*U(*@b=^Z_Q7H=tOdqn#xmrYi z>DWPIJq=BjQso^|#}SN}|DJ<)#=0V6_*6TE2|-h-ybP4d8r-aB4Dqb6EiGTazRSU( z^zgpIu2t<@Hr|b(Jef#f{H@1KIoSC&EpxeIu%!EidIdLza zWwpaUx{#NwBc_L!=;(mR23|=`O%338kd4U~&zYE+IXNKW;0)*r2>-uje8e|p!%BijSYB4<&`cHXuG*LX_>GYJ_nU*9^c!^)^lj1D z#|a`cpRGCKvXfntP04y26B`{@2RZ&-p||%1r11W|QLWvF*5EAw0vg5P%>0SrVs=;U znpCvKm3`L3tmqX?G`s^u)L~gDJ&1^%(f+*}lucA!p{fZ&Y{X5{S}#whVmK9}NRx&P zh@ZEs&15Kj&12y)5SVIbqF;N2s5w8N(%i)|#Ph5vd#BG-UyEd-$-#OV`rE1imu==> zwZ16#@x$^t-yd3AvxGfc{}ia{zn6e(cINfb{|b_T>qxRr9rd~=tV{U^kLUlr&fA*S zooO2UkEaYIw?X?_!mer@H@C7n2YXjgY6}e>zNb53geH2PTXWwn68ye5I@jqX*AAH^ zdx0f@tUQKxA!Z@ZElnOB+sSxK!jeDR;9nVzMhB*t?Os5yLj5Xeh2Opfz)an)**dTO z>u;B@Xsyi~@f@v--~iBikMMURIb z{GO`KvMnY{y`*d!ZA3y6a@{L;W1I68jQ&omy+|jCcNJn8ZY(Qzz|kndi5q0wnUL4Vn-7_5tS-x}PP<+u3u!B}oFoy%e*!CqCx6 zwVPv{(sw?Y!5Y^>*G8-sdwnxZu%ALul0LxC8gbJ)i%OXE%(WAjHorZ%^+!37)<)F+W&Jhw zI@L+!XPOfU2jikctBe?r&sdP8DZ76c3$&2R-7aCSs=dC2&M#%z9y80!Wd;p_fQRg7 z8_+Q^0mt=&QBLJUH#M}F=n+muNB|L6=wtu(_7XTKcy;*bQi$HRG7;73*EcUd2M37S zx!vZZe@K4gamIFN&a*xT8c}?U-k298PPg5JHhU%eR<1?;bQRL>=iU$hJx?>8`Fi2@ zC-0#QUi6w=)PFmnkqOmv`^{WAJ?@m0q-rbuz;n6C zWp4~;;^lrD{?5&$+nv-{*4M90dyF@~fBg!7$K!Yy0#>vYq@5r+O5WAp zZtvov3{K}Rgt2QAz!A~H-wVE~MO+}^K`yKO>>0s=95snFAt@^OOUXkgzwRGYB z-x|qFB$ff=JL_?mg-qHTnpq=XEk7ew4tkeZgv0B?$)o#lwU6ug`MwkiOln^)C#uCd zOxl@X;Yo__RW)AE4ZB0}Ozy^2U z|Dy@PHJXpO|Pt!`&?eAXKJhu=NSP31f>k6hCxg->;j0G11>(=Zq-gZ zdk@tEQn06DV~@a}-UOoj+Z$Bl+-1m%1*=zWH&X$pf@DL5%Vx7`O9ZW^h6Y%tVzyIP zm_kI@l7n+0`;H<|*Vky`X^#Bf$KP|%tt>t6Z-^#yZeAYu3Hbop~gH{tx zPh}&1eGc9#{5rUSHtALB{iXQZWi^*F?a@hmfQN{;W@A90vJ1_a$KC+@Zw*&zk~J|~ z&&e1wZuOS?Q*WJg+!$UD1h_xhyqCy!S$pHc!@a8#!srcKJUsm)%Ay{!Bexo6Lu~su zh=p$kzZTMk{TNL!4NYzODT2Rs6WW?pJtb-7(MrW?%_DzL=#)AKiLw#J4*d4h1-rV1 zSToj0-fXN$=^IrcJj*?IIhZBSnmdz{2J9>M+P`c{Amo!aZH7Zf=7PG@{IJxs)P`|b zhS8rRwvwWw{|IkZ?m{{gT-SP_JxP=0POH6Xat2)BVGi3t{0kWf#u137oPfD#Owl4E zBj1nYoBRfsXy}&?3mh>Z6g%JR#|j6DIhK~e6J{{|6QE;)(Q*hZe^@6F=TXjc{56*P z_;_j|?Z8q@@PYm}Ha}zz$x)eDI^c8pu8WQ4HVpIZRM18XSpN;}X_h|vbJ&-%>|`M} z=D3IWYE&EWejt-zTC*XNkkD#5(?;^e%wuM)voHPjUtFktxiqUvXc8Sv=mNl~zy}7D&67j?FE4}n60OjY$ znATWtlDxMY1ZGUh2c5gLi=5LV4}01Vz0+91z{~#u(P9|P68^1wfn)IGy{NfFuw6s7wO2{7W)>{aDtZv!%kB zhNwXmMv(un+uDoLalRqkkoy-0$_YM=2=ZHU34|)?FeDLRs^Q@+uCI4Wm)cHCp5Z`{5BUtTt6;G~N0`HsM((+- z4f8;d29gQ|iVq8w{LzS}K{2-ZC$AixTI$xxBQ8>~QB!LBI3b5i&uLD0JNMlQ8ClJ} zj5j@VW|1QGYPI$ct)=hQ8F6-L z&|;3(zQIdt%s~+bNsDeKVix4H_B%{EFFJ9&1J2H7*e71>rx@vz&Y3NKsa`o(9;@G> zM$4a4xy$#vR|g3|)|%>Bt=fFXcuCW|6EC5LrltdQB^1#IXF}{~3QY^=!2R<4ke-c| zV6-9#t1N))mE?|;?z@nXdhUF%Nm8dprO9b%!d0@4!IeN@MdFH|ETuIB;p6_m0wS=w zvhsfc^ek#b&l-OYjaha3dcXMf=hM=_n+a-+Y1U!GWHCc2Z|1_sOs7f7qQ-w3PEp4E z4OcMD&aw~ zsPPj6*-efghT#}azpl|gVUo`x{T*mF(2#8Q&8cUWLL0HyHptyaCuy;%n8>EQUd_R& zNhgEV-2_>$rY8D1gFW!*AYp}tB$q9I0xG~2)7s}9!6RG526pCc29U?(78kHzCNhmLz+aw$E%B=b9x zNN(mk5prz)!$i0q@o7g65~6X4r&BJf8URt>RkEB^PFA%qa!@!GFo~tm3lD$W;{JYX>B<~ttr8Q*r&I->kws7VqI6ipuZPU`oLlI483;nWN z#>YGVh@=>Sy`JQC@EHO>;o&!joRr`1fUp4<2`X+9uUU9WiGaYxBZ%LCW|T-p$eQc1 zwSAQYMKGKd7$cs$#(n(RlrD_FG3K$>7{P{p{0bYxd^|W{+|EsEa<^&GX@a}gC-qNLT3u6L%t zq|RVN*}$0@tHHrm5gMFZT>ObW>e@B7@l25LJ9xWMJ|}n@tUhB1OpG>t@U20t87tlL zmu78@QNE{@Tie|oL3Mm=*1862EmRa}gtQ-{&dJb^H>@h)|;9R{P_c? zvFdAU^}7>A$(uMK@|X7Omlv2OeSHuQea1>E3V(?uu8TY-5;it9HI7gaW>y zYa+npWpK$?)R(>=q2fv@{Udo+e?7YLb;|{p@?)>!O)9C=tzQ)pp2eFwc6XwRsKjx9 zmma`;xL%w>RlKqPj%~EmYI5N=CZ46#pl5C`OR;0y?;OlKnntFHe|Adl%(-Zlx9p-i zJi+v9nZ=}ms-!P9t;6YOBW_%t<%=K7txl-ehk`AR8<3mXr)OWY#^sV|^095Sc2@q% zPJDAn(#u-Z@V(gln#ELzrt7vV%ENKVx9V&$Y$7IVHgQ)b{dQ27QG!U#Qi{OUTl8$b zt2s3^BqWa8Gcs83g1Lo+;=J;Ly0*4#jivFDxee$by(b!rXz=0x+e+pEgBHSWYft3B zT7d&ob8ixRrWY29;m8cE(NC}?FZY1J8`2Kv8lWLcJdf>LI|c?wT9hFYB#0m)BLlfq z%=3u5WQ%(k)$87Z>?9LP3ObCP04B$^E zsB?n&2dNORGBKI=Iz5QQqVSKz3eDMh9FQ)7$f>?KXtwfrCFMXbNwrC$wz%|X(`RR$ zA|Qf)?Y(NjbAba-oAva%yP#Md8m_>wJ*ds2t+~)OZ5R~2Psv|_pZH#-M1#+9QJcf( zZ;uPYz_Y^h8iVKRc;~7Mwb}!!534=ny72`ZZ&ztN&Vp}kTEECM?LVbDh&y`a1}F#T zd)}sJZdfN8p<&>Brhxtk{09FvM^cULGJvCq_}+2gDZo-p{gd*anuL-n5~f~Hp|N9( z;gmpd)tv2w-xeNj(e7cYEVZA1OpS`ec7VMP-URC#h-!gL@Z&>;^SV1&E1sU7BBG*p zYY`csvF0ryxdj9?OSzKZb?p$L&}aTysHy8_0%sK<$`Dylz$=XuiHV89BsAoQfDwSB z@L=vccjm`kCSR3UzfxEK19NlIZ83q?`)C?8i53w8dRZRvdfJ7S@Rr8lDhPROo^ICA za!9T{$Hb>;%t7;KuLrlM_r#nexQB}=T#ij7?2aTq2u6sxS|nA;rqt*zlJ(K3hsC~} zIMM<=eNYk+QvQ_uAp9=2;?EDycusB4`FUf8hbFWr;xq*E>)XtOF~$$Bj)a>DygDn7!!omlQ*Pj1?13R<@b)H)2 ze0GqTC7`cJr|k26_pSqkDtu}|Uzvrjgiy)5Lcs(rqAxp%g}|wV^Nzv?fxVyzb#qazMPvKXSZG=Sf zS}N~}DsHNQq(n?e%HN3mlayttLqc`l9b~5!nc4$|^2K2O%gX7)(G%k>RL20Utx}*w zOA*jLd_%+}j6u^o*Q&F8Ts*_W;Q3>&xlWfs#=H4$?vnE0{i z@7b{eo+S{q*jViA-*t$43StS=_Xh>B`MSl47so76N8tIQzK)zK( zto0ocvpju-c%KS3@o#Ryc(Md(B%?lRfXdtV;7j^gTHebF9KRC01x+UV$B){ZK!

      eXbMpr&$rh6_>7oocdRm2hK+T-)ox7Pn+6`kbu#GTl z=&Fm+eYw;A^HBU)MMGR8$I>ZQenlUdbM$;xi_F)ypXn?&E!O=}dV7Z=w<<}jjz4JSATX9*zR2ks&&vBWIG zDp;thsktaC?K?QA5n18MAb3Bzg;k_;jN|F!&OY{&orMHUo;a=H8x3CGTZnHS{?TTA ziHzdrpHDZAW-_BK2Hjge>R)fE%}VfyXqqdm+H0qZ)DC0uR<*+^cLjR0@ph78GzcSo zz%UZPc>I|HAL}>ML%&T~?_TlO+htay*4U`-@Wt)X{@+a-p52_2HDu#VjOIOex2C%o zEk=gSz&6@>7e(W;EiQ~A#J6`=Gs*6`hrN9+_JQ)RE-xnt+8O$54o;$pi`PIr$&QiXk&e!n zrB`Aqzu9jkUSEHR@yZ`-QS`DtD9O?Vt2Ei-))9)rZHTyT4M&K#QOUltfd?UzTviS!!{?{GqPl zgerGflSs3e$%^wBhcbPAz>`k~Q}I7r@=L_(edFy&7F6;c^Y7jJ#1~?GXw%Rh-9h}| zc7E>lEbYf!#{C;9yB6QSeBxS7YC$Ij5 zh|-K~bFR~>2GbR5=_OWnb}CdbB(Y~3j-Nw9%$`yF5|8k)f&%20;egD*&=3ox>z+ea zSlAP?Le4b53}E}MK&Tabp?{~ogE1`LyqQwzcvlnqBRIF9Ky8jQY3oM#Jm6?y_Ow;% zc+n47=QHiVvlpp7Uypx(1$g?-^Nx}YAw0swPkpAlQV8J#&tG2`J?Dgj2?;OgvI#$_ zTuzKC<5LTpEl27ve(4IfJrye+5VzcRTj%#K`!{DQR>g;$+lxWE{WHIrGj1>4;N5Da zh{zrKpgB2FdMaGHUaPPlb)TO~>~wHov%RCmw9X+&`8BO*W{bu(LNNiK-iSB4w3eea zhdOumI=sB|{95KqCQeE096%Z2y61LVcg*QIj)L8JxRG*)_w^dA39tFiLs^<(;Sr@r zNzZ%$ZIN&-g(L{Z!P#kA+U`V+2&SN`1H$}xf2Uc-f>q8ME#>iI{lP0>e1NVH60x6|nP%OIUdKBo)}C63wGY)8xTJJA4bH=uFv!v&68$t92Mfy; zGM8`!2~Ja&IIoY^*4Dy-03(*;jfzcZ*xZ-!6&w&;W>jS$Y5L8w;StIwb!zKowj`7r-y0wR%4}va)%&=6YX3LNq}=RkEcOsdV2wmAOw!ZPuB`) zJ-7T~V#pRI3t#uc*9Zg~fd5~NHS?VyG#4l;q(m~^>SZ871A(Zwvs9=B8CK`M(l*VC zS$_%#7~%ZzK2Y^X2yO;u1$p_U)m143H?3@m)!)Eeq?bMfsNrC&D{y}Bxn&+BQeBUw zpBwT6MSJ1ty|@_kbZ6BxrPV*AJUnUr^m^pBoVJ%o4PGJzP1YR}$C04j^_^f4wryr~ zuHwG9jxX9f^V{J%t(91-^ijgcTc^Iy`{{9U5PAAapC}DV0VjoJ8PBEl{yOc-#as+W zZdHEgLIfFO69PF%OwkNhH$OiMc#=od_^fy|a$oVyZ?;V%hI^cx3+-QhxfvvV&w^Bo z0HN~o@*;2W-Aq7by;!dgJH7g0-4cFVs>%ZZDp)E!yoEutUIW6Y<1Bk{@)OQ#78eyY zF`y7DJhUG_`SjX86F;|Cir`CXQ=G@@B- z9=OxjdB@i;2{$fODNm%6Jr~Lrc_RGedZ{+EsI=RROXAz96cMc9s9`TFO-@Q$3~?<8 zSW_=RK}aD4v*pB}FD@?!Umf5>5;$!^)>F2Dj)I#|NKjB;dl36BgK)kD2fyVoT_Zyl zWIoo`Py|XvU40+YCO}AM5?m(oKp>8eE`l!u5WndNfCA3>!WWM~N`nzYNLbh?rj`jp z0C1Wge5$qU<|ZRLj$RJ=L#O)ax2UrIzC*=I+x=(xgc%vbK`V zKgKs02R8)+uZAYSC=D4GZodCDT+|#p<%Sz!)Nscq`k`SZ=}xpvZGYn%8C?Sr9+D}a zeQuEo>{ndVi^F(Mf0@!hP(zevzSI)GtEUw*5}w#A>O2w4!H4lHd4ZYO0KWJIEbED!Jz7cQ465f_qb9iA?%IzyBZ{QR?l?h zB-y*t%#Ze^1L0T}8A1yIN6R2{^3R4tj%lY!#VAXUFYaLbnb%?8(eRc*^>C^=$GO6; zfiXspp%~THNSo{z5lPS1E{J~)HpIopX?PYT1#`2o1c8PiDJ_kFFJPdO-D%)PzI%uG zJKVGnXQ~|G#Gs1{>}lfgz24c)O&ib#5{3Pwyz$^$BfzBx7pJVW)Y!ztfDmvafV8X- z(O;6Rce%L8W+G&ReV)q61+~5svnw;T-@GQo$FWo2&2ON#h%d$;I+ZEJ>2^Ia#y~Go zL9K_)o5mO8624IZWkDMgO0Xez4*Q2tGi@qv5MDqCubxG6#(M1kba&>DP_FUcFImPCGnQ;qjj^Y)WSIzA zGAgnsTC7EKY)M*dW8aA)DNBiLp@=w@C8JGg5hqzobvTkrI-Gppx4zHw7d$^b{aP{i zeO=e*`YiAFYrtIbyKOlTjp`D4W(&F+o*X|CU4904Yf%@gK4-TmX#Xp%@-DotRI@4f7CvESqCGn7>ye3T}>f8Nq*>dP6PF zTm0`$1g#B^7epuAT7rn9_O+!LY{$U)h_*^Xg(A9|K zr$=thJ{q|;gCCRc;T%5ypH%`eu37p31qDwX^jMAj^dCJ+0Y`r;x5&mZH{(KvGVi_?R?eI_UZd!A78&_%a70g z*?R52D##&qCtDX0Qv->I^f_|m(+uzEAfPINC-H7%+Inad$KRSJ9v-|pA8&8?JuewX zT)Hvpl8~6Ja?R({`M$kPoXuRNJo0CmERbg9s`C%Lj$twcc&SAoXo?L zCmbwSh#V1O7BGfBE=+%`u$w*aV{W#|DzQ{Mb5(v%tLYvWm#2^blp%rvRWm|JdwEP5 z=-~23t|dj2*g+qr?4d|^% zNYEH*U(c84HdeOO-EOG8R+W?G&vLPFGc|i_czQO>-R;&9Q{|-(eh!QW(}Z@ZC2b+v zj}Z}uj?*OfEdga6?9v$yitxxDaZ1L}aXX?B`ea(a|$W>+-nA zcQs6nTq<%Zy5?X#)^UAwYsby6rAHLkTsfG%&x;OM^Kbo^sA#~eG};u9Fzv`g8g;vc zOr2xKSi_+(RSXOapz4LU7ovCEK7E;3)O>M~EJxcH&u?ko_;GC3Y9_szdZNg{;CeJO zs&d=@#zX()u$NxVdq*MtOTQp*HO>A&yq&_wJ@q0Tf5JLkn04@K9@J}yLY(Y(?>u2v z!mve5>}+kpHRIGXwi-$6oa4s3L)K&-7|AiVs~Gzl|5767^SZpF#xnitHF`D9*wEnzFPx2I^Q4O;=5MQyLg_>SKK>EZ}L(bxfe@3SM-1tBCe{^c<|4T=w&P3-U(~I zdGqDdr$U#Zs8>8#Fsf*{fsF~ zuy%1-YuMh_22W=pJy$633A{D>k4zjKv}iOMC><;2`g?oh+HKWZK3<7#BplZ0Q^HIH zJXMS%+^yI(f)QowWRxo^%MO;fjbHzq;r;i1+CafIT~n>a4^NBqQt1zmo;^eMdHCqj zr*WT-u#wk4oMaP{NRo5>ZMuZHO3)0qu!o0-I-e}qcD3mnvE=UV?l9rc&(HVU3UN_q z3h6)wczEDM^u1rit(q^&lu^E{bp24V&&O&Hk;CuK9i&*hZCHQ&M@YJVEZ6e4fqPBC z;J`z<--lK|_Op%@SFyZtr#XS|ISHqvbgVzE4M>ZabckWET)9$n;;N8!D9lRQ64Hqa zK5$g+)0^@tcNcyR0rHN&dh^Dk{@wN9>R{|{8OIY;S@H(8i_JYsznJ?<oD_C|NY;?om>+no+`S<0{8yCIpjqSSs<0li|_d5xI7in@C`+dUWfdG8T-d3u!{_)2NUMu0D3r7@o9OYwP{n> zy!LDn zp-u4N3chaiVUmv*H8)?lD^B4M9=WN2W-aFRYHBqAf}kp!xJWHD+ns2A22r#>Y^?J? z3kQpRw#LqZN{qa@kNxcPq2qMM3?oIg>W{ew4MIx@y)ro~Cx`hVSy-e97?295g=kYo zm5rTUyA=*uV@*rT>41P|aBjYNBW`c6)#*zvJs!%u~U5e9!4=Kq1Kgo?AW zd2O08Y(=)aw;8p&f4mbY$g6PR#5to^Tgsc6M^pTMjTxFazHqr4eo^II%rr}%kNNMu zYw(UouTZF#_#z}c@~s3AmPe2HSE#KGA8ZT+VUDz-%X6;(^=lqWx-wlAB$>L%F2C$e z_i0*n{?tHgAsv|TJoE@JF{ExE-piC|+FwIzbQjre=oj$K+LfXnXzI z5&i``I}snki|iaEA*b!tlg~*C4O$Sk?eB;8iQFGsp@DT)S|%VU=q>~|>b-#d z`!B+kkFgaThQ(*l6FB33{P-=<99tMcF9Q7iKZ5{8FRtxDM!$dmTR8L4y|!pufZxdO z>xMDXs^>_-g+&IWc+X!}5t-SJ@kNb=dhZp*Eh`PLl1jQ5F;y zSw7D@WF^TZXWYtN`*d*d4hA>ikhHb2CRYDa5UNAD=z1BM(zADv*WR6UcF;xFX5v=L z7h=jFTMYNTkea$un?a{@+)>oxqk_ZN=lIF?q&wZB^AGF@YdKi$V@W*R+!>3QyQ2xC zrKt%Ut&Fr1&#&b4bhfYgxrBYBy*2!%Bp1*@?x_R$v|_JN@m^q?kdp1z+AbNmuTLj! zawcN-CK;F?B5l-R|KycU8TLMOXnb^3SX4CTb!??YNPhR$m_FVnT_7nq@5kf0=Q`m| z^nZI>Ol?856DH))`?z{9-2fEl%a^Fl@FRc~KwD#OzI}V*1_vjn2X_XeeZdRBr9?Pu ztq=v=sTaI_?(LSTqMN-NAICHUTi@LSGb6^@G!7qoYwLUVNOfXduUPPLylW>n4Qx$ruN@Z7@~|08Tm5SB1=WqT{1zqzk9YSQu+KH#e8`LFTRd8%QrgS+ZtM z0UZ;pmk1u}5lB+|zZ69-iid67VUh75AsQT`0sbxl<^&c_BF=+MEm{?Ge+7@=)*$R# zL}`q(axKx*{kpXn!*PjcJv~Ngrl&jZ9C3H&xKYQy(q@iqw%6G?uGc`mCZ1s&)O81m zAD|1Qw6XB3NseBwuC88QA0{S}Q<8JI_3GR$E!Om%08YU)_sS8)Wr-Pcr)Z%vQqFt! z+>1a+Ft>;N8v7ILn46Tu-4Eaxm#$H&or6Q{E@XYsalaiH=)R<%%$b;-STgL`(5B4& zCITE-q@ZWc2!{+Yd@tYxe`vR%?V!)m8Kd{%8;g&Lp)qWI-Vv8mCq>xt18MY<#q)X* zJo>^P@HsO#K33DxS{;@W=LQ!CJ}q=g5)_sNKx-gPXt)_5seL?#Y0tZNng`dO-$nN9 z$E}-^l7dr@)eZT%*f&hNCOhAD5kVwW28k(zp`z5a64bQdXYHYhiBbFC6ZX}?+S9T4 zm9i+Cn~KyCfCL2uwuS~20WeFbdL-G6ud&m`ib{~lu7CVd zRbH+;OJPfhiHMj4XsWBb21^>fIqX-uZK8{~c+5l@T>|^VclyE?C z%0UbvFqTm5q(pdZcA@9S7ai~*PrcKMUWSbY( z3a3KhwTkcDYDl!DKlSYFi1{=zAxjbN@C5c@8mE-22kw0| zvXlnQ%*=8*w-vG2ot+@L0861RBjXmT)#AEN=iAdrDR`j2ya7Z4^-l(WrXbrvHv1ZU z3Z9?F$5#mpvsSjNjNaVzr0dC(`!-yTBP4f@l>hSM(y;)nQp3C8gZ+j z`D2iADcwPx&&7S7Km>0DD0({S>Vq2$^5qM8d5wHbvWV+UclL5Hk|g3G#;mMdKf5(T zTKd9^QY)9Hp!QDDn*L0 zNNH_t;H0?7=@@L?AMtvQ7vwus@CLFqPTc?#uV3c=#7InOlr$RQ?9vsM;RZ@Ke;V}k9^US-B)Ha9iZF7Qz_l+(;m zo$qA?{fxlG{q7`*^8Bzy#}J4A%?EmR+zDj_U#hWa#F=1216<>me;wVzBWHRoEKFSM zfbf~zj}VLm8@mwk94%VKUHOqx-@koBX?)Pr6L-U%pX1UH)B+y1K6XF>SN$YnR|OL3 z&HaCo^_hNt-8D5e!*O#wFB2^9`y;Q2@2aY-Bw&Te&9SI95dHM^_e=VC{YV{qH+%fv zM9I@_iFfaROwyMmMUuW;;^pTz;lfF6J5^s;7O_($eSUFa66$40!QeGyGE2+L`OI4HbofcW z`s**gc6pFC9f{(kjjrpK4Ax>Nn=QLVhS_GNb`D73L-&f_eDtT{rtkM35#J--o48+m zFE~S=Mn^ef+lP+NcT(*B@bztJX`$2Uwsv-(!^D_ytmz+5oNHbnz*~cxH{&@1*ORg1 zOn}OC?~Oh##km_$Nh96cIQJl3x{fL{) zo7)gCMJ*bzM%<@}^>qp%n;)lN-0k8L@vcgp!*lbj`BcF&t|4c~4; zBa=NRZjBg&!Ub7DG`y7~tE0vo4;e-31c75x;m3)JXB)-1adlu2IXB(xi(t$-wMZSg zc>`|4FL518f5+kqJUP5cNkq!z!My^ZuVee;*NBR@#8Xr-FrIFJPGSv3W((Ui7t#tb z_hnjKcD1C_agu%4@9Ek^*D!+j*xIt}F<$L|^M?PGo3g0ZOWDUM+iILErvcrX``{+} zg%bZWcjbjBNw|ai2D@fW4lxCgwII_l-rSdyQC#EV_8CC-g5Mn#xa*#{VHgl-5qErf zor2)642?i?+?tPGp>MOe8bsdn8gyRZI>i{I;ZF3pKDrEziuH`qVGR`({;#qkV})5~ zai{7qf{IP&7Ki^y_2#-IvmhhdW)}LU-8NKYw2Eufh<@Ul1Ri$V#}2iJoP3-d^i_e! zkH@!XEDSefXN&GWsV2RfYro8H2#JjM=kkbgstf98(C5W!E@Cvvu{I?+e8HclUCAlN zSI^7*R_3xtnl4)|)*!-LUsA#)`3*?TJ-p)`=Y;N(SaYX_L-~97nk8rHllDky`!?5( z$)p->>r1V_d9$Vf7Cn%>&GCG1~Ki|G4b4&1Y$HKIoXna#VmcMGB{+ssBS zV{};9UuP;%>Ek1A8udo%nR&3tin?#~pXm18jRlkDDF@$W-+W-gusYXzf$uC!`b6JA zW8jLYpt{TYGIUV8XsbsRLxSXLaJrDxP*)poc=F^4BLozh`@ZJ!xjZXy(Ur+EA|E|? zKoJ*bf1!GMpgQ!>qmCFkliy7zDe{+5{Fk?^Ro#C(rkxpM>^s|7aIM%5sJ^Lh$k^v< zTM2c}207DQWyX*-W1Bg-82r(TmP7G2G{1 zbO@~5wmbS5>bpMi<#ybx^}%U3lY*fSISicB6}{fHtq_iYTYH|d)OuL$CO%ac<=c9J0u|w6@HPCuWd<#F$5tJFA<~5;W`Ffu8g1 zY}_eY7g|3@j!b+CX;sk<4G5?~-yWG0knwNduD*~O$(UUycxCS@YGxt=0m?UI8M~LykHk9oUtK#2gGAw3(4?!RLT&rp%bRsH~TD9w`N9 zpkrYtRJ5Q{ak3$H^?usXVS3;|_@r!FPy13b41+iF!E2e5bFR1=Em~tmh*cqX48`ep zsH>=`$jNo!?t<#PHE?nz8(RtG@%jxL!cLz?6BK>4Z|DCu_4fDw@T)gVh=9b77O;l< zhK7dv`<-lUp~C$zGSWIF&Hfo6iarJIbNHFi^Z*~4ler_+1EYZ4JXO+f5P8Y1TjJNM zQA#R|-JW}h-UEI;fDX|t7D{c%sB!Igax;A)}>bF+F_b zNc6dk5ft#5hK+;U$B_+TPonN3#zsKeXlf!IqB^FMvJu*_(y;A_Z`^k;B&pl0d}Y?6 z+F%cng_3P>(@jiFUVrem{2qfqc=c#**7iMx@I)N1qs}5qE7lSW7ggQRq-ASnI!gh zZv^>3MTGU#zI3vUmq_JEl#-?e4Adjo*0BGn>0n3KR4_2Zf)E`mq4pK&BiBZ)T~9Wc zF%cCwWp2~nfyap(vQ2$5d;kRk7`tFU!s?Gnd)zkis+9r)NSu zf6!m&4*`+<3ty`;ppq|4V1~(yE9k2^v0p$~MSIH8-k!kVg`*#BT7ldO0YO_+vyjI} zfJBP4FEp7GZZ|)SaDf{X6sH8OJu6m89+(haE(s0@(tj?eUN)PJ54vsJ!N~^411vH?^-wwS0*nTDW)A~evB93F6<*dMTsZo0W0JDXGt8aMGZ2Y! zVIg^i+{`2o+~;-c*T=}Z?Lb_?TurX)*|TRrIE>W);kt%V7Q6HP+z*QF`zSsvzGI-)CBlgH*~|A8z?A=LjAN zoBPt16T&|QSfF46|7x*oR~m-q=T=jx1I@=(v$1s&EVSL(6tb@RQRHDd-G~#o3eY!0 zlu#PzKvf(#P`ZdOX}|9jSfBqR} zWE53Vp|US@cG5|}3$JD^bnAh?HD)_sjP@A96$zCDhP;t!NHG@iG&udoF-N?~sZU*s8l zg$|jzNkb#UFOwg&Ozo3=;YE&C8&n~!J)NC#VYNwnwotTowdP#)`2GDavKdn7Mxlh3 zAzC3<)Ps#vaU#vnp%%h+wchFHR}EgNxw*Nu^)rC=YD5)UuR&^dXyW`1+8Fo@=t23a zrBvf8S5-CCX0)Y|(y+~@kE3O%;dkQ1Pj5ZU^Zx^sYGB9zKB6X^*+Jnlr+=npnw3taKFyX0AUL=M~rhWqg19Z$X8lh11L-o37cR} z6E8aV!QP?F2B}c*E$D$)t~~gZ8yon~H?P4-ufnPgbVZ}ngzsVUMKoTi%FW4%iTl_G zdxKjeYdN$UZr!@^H5v{~WOay1a`N)Oi*K?oP}3tLQCmSn9C-P%CytEb{rfWXb3i)S6Cvd zv&iOt1C26pY?qWE2+msh`RyVekH$%$UC;xG2+#5(-sS%<-!1n4{(IC&UmvM1^03l) Xw}~gOOvg9JE!)0rmua=JE9-v%#r$G_ literal 0 HcmV?d00001 diff --git a/windows/deployment/update/images/WIP4Biz_Prompts.png b/windows/deployment/update/images/WIP4Biz_Prompts.png new file mode 100644 index 0000000000000000000000000000000000000000..37acadde3a67183843c6e1bc9452430d67923bcb GIT binary patch literal 66737 zcmd42WmH>V)W%7R7l#(t;O_1atU!RaSaEl^LUE_K7cW*^OQCov6hd%!D8;=5C=hHe z{lD+5S@UH+&8+#5K$4qWJ7@2Ge$TUGG$Bej&&Z!4AtB+YD1%=iAwAVYLVB`cCq&KF>|*< zay7Ga_T+N5@}w2u;^E@sJ*BlvM?!jtR{_hud1rjMf||xSkj{L2adxmEZ_aS^U_lap+kifR;cZ>YKo5@Pl z|DGh>IL<_Ut|y!m)3i_y3R-;sGh4pvNbB#$ECJ3dmJG=cC;2{@EK z@!wOvNPf`42Hz5aMm(hc{^m1Y#=~FH!R${1J17T1wLwApTjwM&hm(M}gfU=HvND4o zYF)?8AP=Kn0S!h5h7Mu%zjp~c!=;&fUNZdKXqPK8($wkpdk|G#?d6$rXu9&_`$Z%Z z0ihS76^NX%#D|kJzI*G`Q`P!=cxHE;7+Pq^XN`Yfo}dy4@F}zKH&eTakEL8;)T5Br zyT94l+_!lzX}m4AodpkS_P5p4st&=g_E`&PkwEMgZ>_#R;dJS`wpOwd7>fW&18>2X zJ;u^~R()-9pMU(fck|^xdu0U~1Jv)UfsZ7&j@wVDkG?(J-wYKz-0r{^YzpGlBt12w z+E)DzYP4>VZi61~E{9aPJKsFup%^jhfpoj)Z%!Kr1nV-sj`=p+ZV+!oncAIiWttd! zFIZ(ZjtDKK9n^Jq`CqL^(bwI-pb5Hl^ZgZq4y&r`dJ7z1=gWTM!0WBbVJxn1pCm4( zUvHEW5&gTOw=Y~eP8IdNX0(TN44kx^mz>+R27qS+p+(zbci`vnKF-Hs;dg!+lWNa( zhp`GO6J7lZ!(&qtIsUf6WGg2id}D}4pI3mYf%SYtyeyusAyRWY!3`P`Z{M{W)yHSvvoQk zo$1ki2P@4qek*>QWs_gAS8{12FccJy^^^nf)GJ zK4avwqK(&e8%>|ULg831ixZA5c!dx@>Gv4`+mAj92>f($+??5O@FeQI%5)gark8{ zV?=nZgVJkSEB(r}=)S;jzrw08f|%{*@Qa4%`MCU0UEoC(-;(1O?dIE9liQ+U!8yaN z5A3xp%=z!kkH%xUyS^QM+eonb`9hZiI5rR8^#~HSRLR5oUKotM&ah6ac{dZHXBP1S z7C~aHCk0%qGCQrE_!`_00z2A>Y?1Q*JvHMrmPU5G|Toj;^s zEMsaNxIv9~QAf4i_Xw+A9AOST$#YF@sC`w9j`v!?C3!31s)2b7BaAMJ@>NWl13L9P zQ{Ue)%=YNUo)ZdIb4EU#>@`iVL?3R?4lX=KMau}wfk9cV*gk9g{-_PrcUIqK#zSoF z7Z2%wlk~-Ww#S(JO&4?2Ssk!PXqtR1t=BkoUtzgvqAbu|VlN;CnUttVYK{rcDcCXO1$GB8)IE@pJ=q$Y9I zDZ8+kmOZD`HyGdXb!WABBb)#C4%XcIK zX@el3*R??SIlZWeFmP@yRjj;Co(jX%DFow7`Uk9 zl*}Vtkp;Pz|D zCKjSm(*cRIO26Rjsleu+?6Qzg?I=U1qJ;?9&cMTMM_ip}n^bUdHwqShrAW4I!NGwC zvt~8L{VZ@x5PgMZn9Ck7tP(hb9+MbhOjl2$VsLQ)#=CFbe*VFfPucRkOHhnJMS}RA z1*SjE99;1y*au`VW;KI8AeAX1jF$A*KQE zccPqg;GdX>1kj}=*AtQRIo=yy+xs4bG3fnI3Pvv`sCGHJ+ms%0>q~7}IUjz%l_e~d z^=IIKX6~qG4DR*%e>TJb_IgHjcJ8DR0CD{9NEiq=BDwLaegAi#%Gl3T>i_4Xwz&V@ z1)-7R|7P|WE_zIz|IQnnnT*2z@A83*hW;PV`2U-qEh;)@YRq4lYsh~<+8^5o23b@B4FAXJ)->pZ8-TPH=6UB6mdxcv4=Bd2r zpOs=Jj9EpB3fe7<%D@qt|0HpDK4s#1-z9zfr`HNdE1Ww8L4it>=Y2#PX`IdTMU=pV z-l}O?WmBT^dZX|3bp|F6q=yJNTI>K#P=^}t&*zUBpeDSILONoN@cI+W-~)*k7EsC5O6B7!a@Yj$3!~>5?ljyVmb-PPiRvTdlKzN(y#+ zHfE9t9j2C>zwg>C!?6d_LHuQv&TA7 zw~h%R1JaK}*>H4`Y9`;v?L@?VU?g0LxISF{1e9=X9Icxv7xy1soA0H8vfnCMftWQ_ zL(2F1$R)_2SX4AOUhu-E-FRET_Cx{>G0grF) zz{Sk8DF|p@OVwRq>SX!&Ui5n>D##qDiG7UJ(bEZaC(_-#gc;?OPbYL+13NVlIx@QBmox0?hTbt8&@1)i$j;%Fd1YH<&jh+ET zeeHxx$p&y$*nvXf7&>{61#2t^CDsf9*}r`D;yW^)CxhO;7xLHld0ZWTeq`?eC0}(5 zXJ2y}-(w;9)_N)<_yhy#W~K>?IA+cyC?MS^uo-fL&$tx0NcUElsj;j>sK*_*!Rt%l z@)b}j>(23&x=9P{2O**j1D>#zhAsJ9W#$wxitG?eMwi*~XSz-S=C<$AcEbhJJgcUX)eb`$ghjtn%X1$sysZKR;n)JfUl|G#GCVcCD4Q z{6qiRCf7}o>Kz(asMW!^40YzVw_gun~d&>W(ROMjIC;ngk2b zVO!hb3n6C^yh`wl%Xz|G=fI>2;^hsKwfPlvcVIGC2K$lhF0fskld@vd3Wu@J*}gDG zg1cozhqbx{W_cWjd0?b?Y!|T1lRH#v9rZU3aTyT5wJqdZ@tjJpD9dkKeT#oaH9gi^ z+X!R3U~**m9v}{zw=2u5OtmKZQJaLUG zY+PJr5|PFYJg8}*j-O}IJwFE4CgshF`mvnNdRZ0;qV`l!=FWPh#YN1~7R(GG_wr-O zB5ngqOUCw`t4uxfnEmha!~wu^=)S>tPSIIa1eZc4J@A#eGd;HCATQs!~|nZ5}} z_bptzCE5X6>vHsxqyGETuhl>tsM;n}A*LfInsiqTValD!> zH6t!TH%r=hi!Yspzo!yh3mZ@S0CnU{m*o!U9}=J@ti-c;V^Go%_MYd&#MV zydlRbL%*^b_cCNpuBJ+cigS|6PKQ(9{W1{}5HEp%Z!jBkEZ*x-`V)gy7aaE_$+|dRs4`g~b;4BP z2dV32981)x&!`W(8_}BmM6iu=%c6ai`>5#7v>#zi%!}L)EZEHEwSD`G`_zTMDTjH% z%IC_PKfFAq%%Pq7l;o})hhaHcTbYnIVIHzPBA_2}vTDz}NoDMaOA$0xI%u2ulmLUVNLGeO=@e_hLUxkT8rrHe5 zR|Z{Y233qE6r=7*nz42x6jqaPm-L8}m0wJLk{qd-5z0LQ*Ee0auiZH_qIxRQfUGD* zQ??32zX^ukzJ`ceeRUwfd5+_z$CHvCxZC3;1BOVP_U%tEs9I`CB}-}qwC!LH&RklS zprfGae=AIx&!@to*+Ywrj;~*I!oNqJ+8Q=qELt^i8iCC@iJM~a&fd^V z((3UV$6J*=3n?ud;_mLq7`Yr5{9&)FVEMZ9+$rI9Te!Pog3HRbKmaP?UdiPJ8aa>7 zrE|T-UzsRts9j6$@_x=YK|$(?GW1L67pY?8u&I1CHVgaA?y$o3vPb1tQ{w+au7h?b73m@qdqJ)lSS~3aC zaTKhmWM#E#nNPDOL3d)8KUA_`>)cYdwAyjCW~~(Ud-Y+i3 z0vw10=mv_ZM7eicMr8FBGsA(hO*w5&-d2^r0F{+6wuDx1G3@*J6L=BLQ^a$(t=k2| zi)7?v0!HjmAtq>;;jROg1;gZep0z(FsAxo%1E0fU+h7f$GxHt{-yJQYUU)7#RWQ;P zPggQ87i^+gr%cz_=OaLJQ+sL#O^X1>>9+GI*Yy&YiuDM(_Z>%{o!3G(lLI;K_a?ni zhJN>a)YeTi!~RwLL;QYmW%bH}RfSpvSx(pLpFq{O1Q`0={)@%dl1ZQMQnY zzGa;6_uoH(lknM)wMzz3no?xzt2vgVhjvNp(Y_(nSR%!tDJsE+tp%}WV2m0t>C@DO z@RW>@(}jCKY&h85JiOILtIy3XJhv_4wTPn!4nad_$hhm9=xAH~0qSshQKwL=bt`ro zpyaxf6Uh1U+t!i7y^^w9EU6Qc?7~M&EnA<2k&s`5nKB0!5t|UzV)2$|Na$tkJ~>3b z7LjXKY+u0t`_%2ri_*LGIE7Y!CKHiS-Vj{GBIx;7f;`NpPikAg{+KP{6o%x+LGw68 zy)_MTgsRl*(+VMXcB-|V&{A=4${2jQ>9tjh$oUWD_3K48xOdRn`*pmaazExOWzx>r z=IH%6oJ|5dIgzgG5tmtA9T9vk27Ei0t|B^+9wLV0$&pOju3TTWQ%i9{935EeK{e5p zF6roepCG_qu|A16RmVj`Z?)h7*F%}&LlTk1NHgzAqrtz2us!-If18RLd;BnL zC}l1}Eg~<%Gsd?&jzwA`#(auq0n*$4B)S@Y&1!Egt|{>2_N&v2(FUANkh8lIAv6w5 zt3W4DluN}N%|a(Y*$E{`iPW@XMz@pgcXnzVWGV(p!RZJV(JgH*MNG8N67)BV$d2|< z#CBs%lk+6hpKi7(6ObwR`s)h6w;ob6Smx{LN8@!M;@G*s(^v3cY%?=R4te)MQ(7n{k zS*OK6j}{}ChmHpk$t~lVbSZ@IzZBE&8#gx(Vz9~COnt2>>p3!yf7&FXXPspQyX?B` ze7T*2G9;;uVEyEOkJVFjvMW6vRn+oufAU~_!vNfc=RHq}CX9LM`$&07(IQn$d9b|r z6R>&17P0LTapIzDdb*t5h25rE+kPS~617am-}x5)<@x)!lRyH_XL-!YJ5GjCWn|Sl z7JHV&l>Bkt4B~2^`?Scy0Vf%gxz}ype8-UhDIr#V2OBvLBg37b9D)+-p;$jX6sd=z zP*TDj`eJVDMTFd|q*$RCBt8SA57VxHC_8<*pZ)ZX4vw*=Pj`%0{s4{n8=Da8E_@QD zg`Q)kHP8x@zz)I} zh;NBf(-^7SST64@YiHmF#Ue`8l#X2z*iQ+bB=0vB=;xLX`8qOx(Mr^lLfj(>|1Spg-{IH8#7`s2ebu2CvlSyDi?^!#a6jScOe!~Z+s1Tx<7y@F!V~seB zl-$Mk;-itvX=7L!~YHN9i4NK}+i$s3u`2 zp$v!~%yoS8Th`Yyx`=VfHzS;KYYWa>ZuduF%a)|rJ@(QH^O(RrxW<=BeoavS+4;K< zJXWUF3oL#`UqabnC)YjC+TgX)fnLQOTFP-G$jyOLgtPxVc`8$x&4_|urJhL&JKGc$ zn^t3t=d&^d9Er_SrAp-biN};omPiUM-=i5V-3E!gBM!^l(u(|KfpFi48uM($hR$qH zp*?LdyuJbIg|Ca02}XgIn8`Bcxv8r?#^_ z!7df{e1ccD29i{Auhs_PL84OcYZW=^Mo^739gU5g9~Hm82QpI>CqF^S!(I1-4K z$O96bdU~GYl)e30^Lv9UAqH{d?`(|NBgMW7;C_!~wT|Y87n9_|p{gTE+6LoM8x$r+0nLPI)yIgHzfeP~k^NS^MksBXqL-s=9v3%cr^$mMDU?U(^S@K+}9<-V%a%NRS!$S9C;HVvu>dkZJA<0=1~S0G+_ThzH2vPn))UGC1E&P=*g zXUB72)cNG%ZLppmZ6IQjxF+z_G~;G2=`*cfC=M|(5UKdY2skc<-y20E$rb@cVJIqE z>=SbG>-4y*>EY$y2uwU_DaEsvLEk50UaFi(@%m2hyIQb&ayIGEj@%@`vbA%g<;eu=D{k9`?MHcINqcIrncW z?a8-b`nr6HBkmqK>^&T_vj8<7+;}n+K2YM53vngkMNl>)p;9I&1tVA4wn@dvn;)!G zT8RGebr2FMmVIfeFF>n^p_vLy0%>IycL&N{`m^tUDpcgC#B>pnuzEB6o&5|u{5`MrE5+)(+ig7of_#%cd?@?h$;j z{GOC%k?8|#ca0)g-#EH?Z^?TFRw{0xDcT=;dTh8WPkwP-jiY`S+Jq3AMDy3lFfcDs zIj8=QVw)E|X$%vfQ&m=@jQ&WmrGV_TbHPlQsT_y-AL!+skP#SfF1cv}_kj_&ErJJ< z1{fL4csC!?7zytb{-eoi0`*@HnJ%xc1@Khg5zb0F;cl`Q>&7_K{zsUZ$iEc~N$NU- zFU3&tq~5tt%TuoAe7qEAY>W60On)r@mCr7mvqbHA*7ndPUZCuW_5VI)mL=kF>AE=B ze3aRJ68)<@0T_PHg{Dw1f+WrB3b5K46Q*uJ@;L(}by;fRWmow;jWOv5f5x|u6n<9{ zNEDI)|Jiy(4+DUll>;dD*l>~k@?zK{|2*zE8-)YfbV9DvzwH?xw+D#E7QmOee3spm z;;pv;kv~kF8bHAA!@L92qUrxAydRNKjHw$M9)OIYUt+-KJXdE04~7tt_3(ceYoZs3 zwSE9!R?G*WY*-JlN;FK6zQ6jP4T{bVC^f&TR7!1ka0x zV=xm*Pb|o#dm~JfweDyFugtCi6253ab%_$}~?s!=!y?X|5 zISvf~d5U~hpte|$YOTaetJ;Ss!Vw<=(d+_1I$dG&Q6wQmeo|(2*afIb#r@r< z)BUcrdX@oz%m^!tqJFDm==PKEq~k0jg7|H@W9P-}#h&8a0Ll?a9CS7+eiA2fqfn0u zNM+7WC#Ks1zW3*4(&@lzeR|H&bFxab1ArXqkHqIu*as8<+{Koo=A{fWo7@Hf#7J0m zU2j);(aOrp;_uqlb^fjN@~pziGj+@dh^`fkwXC{sy|6t*j^>@IMY^_5g+@O}BR}Qt zk}fXL}}jr3VE~#%wc*1DsTqiGiU>dCe~KA zLoM0(GnD`Uxq1iqxs}ThH`0Ym@e4hQ5nc({*MOR#7yqudp70KJ;0m~Xv!{Uo7EgbK z2#?N)bpNJ-`*0?`{pWVSHi-=!8yYtf#4`Z)UFQfKOu8kNJCtrlKLL|BN(fN#$>Vp2 zWTj90h_-+XD!*VBMP(muVOS`oVG5!mmdT@4Z^4{>G*J-inTEh0)%Zg|JFx-|g=2`T z-I38S)7WoMFJ@P!5T_sgW`OG=;_pXtmNtd@wBD{SrTs5Vcpu5{ql#G^hcP>;%AJS8 zep>qd9lf4TXIVj@U!J4RALxfc=HU@q#9_C}PaggZ-U@ZKy=w0hU_UP>tK+hhbf~#) zEQ7_!gtp$vsb0HuUg)HoNO{3*+;1R441WNjqYiEQr7=YvAolo;$WlXy2H{4n`!C|L zde^ht3||+V_!}N`Vh~C+=2E@K@_uJ3;e*5Hie8Sltgu_QbfbKd3 zB6YEH)^0>=6W}A7J}SMKGwI&erZIY3tx^X8kN=3r9a(!6>tH3+;NICZ0YGH)j_(-Z z9iS}6$bgG@O^D8wE&;BkDm8fQa`{FuGH$uk8x3*yvKr_Np(=;gj)XG3yAn<9mqY`n zui7&}yg7dBl-dN!8dZ%NZd8Y&Q8Yh_P-J@xZa`FB0OqX%6iX0My?y75Kv|g^wNs=aASz_3Ir$J{ z3tvZM`e1}Q_*GD2YmQU1eof|)10jbPQ~NDKe_>G&$Va-N5$6&4aWtDB^AD*@sMOD& z_B)^)0ODDdVxOf&pPF+O!)7e9oGmH774I`>tV;j9vF}#;3{TcFAh$k{U}R_)%oMt( zp9IG7y!-XV2aER?EIHw{eKSS1GSvejWeMFMiqFEX{7a_|xCdN2A=LfrfK8|BI$2P7 z_GK|;f>t}2X`1=zC&{4O4Vo%md-8_9z7Sfye()48sSPn{!z(;BvN`06CKQMutAuP#vja`b^WNm+@0$}n)) zTjzPrz6^$j3D7c7Ha1}pP!vgdcxKyuuE721p%j1B5)d zAX|cRv?3iNMp)}z=Se^v%%$+Bq5!=eK8k7|YB&tJu)(J^ zQcdYBnhRFiKhvZq(gt0&uhm$kWcmYQ>bvxu;r@)DPKy&@Zqp9MdQw$(M$4Fx4P`ZR z_V>6@6n-tT7m@wo6g=J-Z7IT1seUdQT(lnh=OOa%NZ%8Q03p~(#|r+^#fy<@qZ0Qr znpcxah<>2lJvy#@aKtn@e&SEwZQQ39#2cIKVoeIh;jxY|nPt*L0c;|gxCh$%qQ-vY z9ScYLUkye?ACmyfjm$?dEr_kh?k%O;EQRwoGe-8@s#A_d{A4?bA&NPm=GTFt60Sin zb{2HS7g4Ylt`Z-v67AV{q5ix|Wq>+c$&N+l1r|n0S3w+d4tg3j zJ%KLTq#Eup$e3B}Ubz(1r*N(kPH7e^CDTWMyB1bYM+LKqoldkwjhUnlpe-8s4B}BP z5IT@Y5YfG^J3tt`&xyvE9Si*XrBXM*f>Jd~GesdVTxnCIQ%1@XuV)&9)poH2H7{6GDAa@RldUb{xzY$40Rft7Bi%HMgDL(5?k)si-Q(ocZ(I_I z(OJ>hk%P~a2?(bd^e8ht8x(B5Ito&hV5ix^*-4&!foYcw9(}>@=w(~7WG0C!cSK9* zrMJm3V+#=KtGJ;q#4ZeNxNA?bt)L2lg;~ zLLdMet8lXd@MGjkl28rKwneGvpE`5dAal4bFIhQ91>TW_$a*g`GyXoCD!6Zgale!g z+{7@Gb;swqcuRSKih^Z#bAQ=wvPBTnX!^QKDAngtVG<+aMcx4;0BfI#cBg0(p>WU= z+B9`CU9#Zc84+1A4v`DIP)5m>2I=m*BbTbxud@1QW70v4nYCm-Qd4x|3W`>#=vf40 zi`F?#_CZ2DXrOjL)Y-BX1M4L7JEbsVWVm4?)9E>~JasmstY;Crhbn2DvyeyefC@Y( zjFTRn02^Mh<7^B}MI9I!Dsf3X{Zi;Xd=<&hQxhiyC)At^y$XZ+8BI}R!|8ZoHio5k zgdCCC#jdW-xp~oP&=bqrR&h>fW~y^b<^qq7@rC`EF*5ED>na5whKW~Xk_hqYSPE=hTC$F({n(1~q# zHzXuoxg6%C!aY76uaRN&G%8p+%i(h{fG8#J%41WNB%o&bf|$es^m@wr!Pw2j1RUN9 zmTHL4w?%GnTJ&v)APi!;$dZ`F20G$5KsZ&7zKIX6RxXDoi*0BoV&vUA76>T6xI?X& zkya07Oa#t_ZXvyx6F!kD0kQ&FAIHnRG9;pFL~Z}^jD7m2$KdTeArf9R%M0_%$EJjCKNs9JQiOu;n`_% zA>*yLabYTql7tpNe`3<{Ftx}0oL?N%bqRK>2g!w|(bWh5L@zau*FA5&33ac{Kd$Wz z)>3H^-HW8ho1E37SXu2zhLg+&QA~?}^6cpVly?=IyO*(YTZ+5i@D5uSC=hIHt7-3Z ztK6u^GTJRK7hRlmOhDJo1A7Dm^epKe({e=JH7+BuI^h`F~u8&qRH&sN6vi6aSRq)IU_ z63~6glw03AXaTx*H0O85rlRltp8c*!4qLj|ywnyhL>E6pW4v zB}MI@&j^3vlgo_vdq5>ArpH_&&B^_So14st-lIv$IC4a=@0F-B4SJzuObl{=#Ltih zJ|?-DeqeEGYDiB~#FyJh(W4->tZG@+FZ9tD^o+#7IXaG0-awJ~`8EY%a}OHD8^Ucg zm$RxGbc6f+H(vxJP3>CV*AIK~m~c2cZs|X75Ni?AL_oetx`x4@10>KB%Q!n64Z~1pPla|9Q3Fb+r*`-tFnpM6hEM$CHAu$L? zym^j^NuVX4K)G*SJWt~%=NR}WjAohzPd_99j6V~_KyCqNRlO;~IgD>h?`8V19mCX^ zyq|geC@n4ku2To;uRR$*y*Zzfom}xTH8H{_m^X>yUo#m6o#m`mCo3RKbvrBN4btq^ z54zZ6U%^#e{ArK(W!N6W)!Y%pdsc4loySOkb+eAb7qLCDWKw5Rz*t-oPd_d(Cn08J z!J@Xi-O2=tw@{l)C$Rh7Q9O0+?R#`GLJ#lj`NIpM zSP^+GG{}n>!aaO1-nnE@-+-YE#&X}W6d5?wgXAl1i-6R7&R}G_lrl`G7wd$Dh1{|D zU|e71t&d8|X%R`j5y}-B4Crq18Teuocm^LQE70BQos7<1vVyDoxe5vrT_yIfio05Q<@sW2p_99bFc|e&0O~40~l*C(v@^f5*(nM%+0Q6hi z-bcrxWDJ6UT?$`?s{dXZtwSmqhZK!Hlp zlRf{PfQRY0v>ry(=^&m7E+UFV?sPw-!_9m5lWd!wCq z#d(uWL#`0=9Z)BnazCL7=31k#0X_Mnk6^*NJyE?cZ%JJafu8JQxkp_UEbsc zGc;|Oo^0HU6&&G}oL}6teT$C07t{ro>Q2&Erj2N8m4f;R=CUuYPTJ3&>}&;W+Jzc8YhzF+IBAH`&=0K zd`s)?iQjMR$3Bo_s^({B6%~)LN*(*d|5{cVx}yJsZh&3(|Br4^tt+4x0EWfgp_w0a ze+>Ylf@u$6)o=W0-Wvi|UOL_4+#>*ed7c0MxE22BqfC@Slp9k}NCBQQIKUES=wUR^ z0AF4ZD~3q7CKi&+B)X-NQ+75B$T z`2my)2Kd(&7G+eQ1?N^tYR`;9iy{EZI3!Of(8J)zHWj0kF=hTlLux~=`9Hvl?S zd3S!bk*M2>hU^r$m9D%0(RMVoA;b}m+oZ7>v((RuKd{|&gZ43C3I<%zq6@b#f9*xzH6l>-TyUk&wI7TGukkbE8&!fSRYzswf z%PugotM=WdhFArs@tj>_RW-?qcZfa?K>(Z&Q}|5k&4Q zi;l6h8%YV&dA*#HT7&R^b_fxX{_J_=a7sld0+{<@FLVvH1{;OefS7slR-7}Xh#Nq9 zCojvh=kO2Gb>3E3tSV1o=1mHWeXT=dQ zYCgkt5(@eY5J~u>Y2{7Z)tW^1IEk*2m$s421+%1xQjo4mfY(SJ&SU$_%*jW%rmttma*f!%5wT#nRhk6O!7^#?#DW!qNOWWJ61Ga&4HdT?%CTXvNZ!znN%Idh!b z>>izP4&-2qc){6nOI7_^H)@?B8OR05dQq86(Io8`U~Q(Z@wXdP!EMuI(*Lnb&kBbQ zsj#RTl+qc1PeHFfk7k+#w&vp{DV!^kMSt=?XDxtF%R?rJ8e{k(a08T-cMUr?4If2% z9N}f2x9!xxxOs~PZv~)jI zR%8^G$pyKHmOL7LCD$fZX@K*3dvzpvt$59GF1d6E_yTr4d#Sm-ZZgS9XFr|pK)Tqr z!5Vc$uOMQUdTTtH7raWJAW}pq;*JIl0@&v)Z!z|rqM}&)Zc!}T1i#Iui{kRFl4dd9 z43XHI1YU@umjd-hGRLSA%{i(SD@AJx@%f+}7U!D*X-S7Vsac2x%*Pi>c4w|O(IORp zy0NIGM5Vo?tUF1HRjZJeoI64C>GtNhz3#D*$Se7CfMp4HW4SOW=!tK7;;%6v!hAK{ z!`}s9P3^21*FzVH z%fPUy#9sdf*u3Z5fv}Ph@OPmsqh(a=;7u{buWC}ie%}$nxoU!M0FrM5;(*Z16FQkk z{&6=dE7NoX0QYLEp;%3}wFm3#IEf!jp}!WHavWb-DbYe%p2-FJikgTOeE~vMs~GE1 z#tx7qsz(#g6wSj9-Ck1imwf?zfI3E%V}&EwPVxcBbB$PX!muUby2S3MFgAUR zaXO{pR{Mg}B9{v?NqSd!MekKnnXLyBpt`!dZ}%thL8~Rew3L+(r=p+m;*^dI9vkOG zcXD4_J$kVn-t>t)?-YoP)87cmkE6SwO@*VHJ+bV4H^H>CXZ&18ABfp*`alFesb&jPc7pm zPXdkR$!_V1UI9kc&*UbfIa3z5BI@DM1e>&uJ3Mi5pUx>!!-hrqu5>=<;%+!t4aa;4 z=lwou5bZrhzokauCSKgg&jrf zE{U1!^i$dTl44zpnRilKX|MNnsN^gRD@ic~hq z)w0CG@56l=v&E9RT07^k)d3smpD>IU7(ELJ39v-1!lf7$D%|%qjM6O4JO) z8G_eeU$>h(;|l-l6)Fxn-M}X`!cCl7?*ppeo%y>Km{qt!HK{0WxO@^#tIV(nKP25u z@mUg|BF*0K@JDa37DT7-Dd0AXqVM*H*-VQP@kPIMJp`EnwTKBLhFSe1+3bJ2%1glE zB*T$bbFXimRZ6J7CD2lc&w=s*`ArKSxDlKT9i^iagn^$8o=6n+utKY-8^sgDT{(cL z#9`&$7mXyEBnqd?Q|44ktar7YbpJzn^w={(ucfRoO@g9|qM9Z<{md*6fNl2Y3MQq!`_b_Bn3f2&p0{9_LP#%fMj~ zKOA)zIV;<~vf^K(%GN9D&MH;EBmORept~B%BOTmUe1i=<-U-FFaS~5!DO!f@$+XuH zeavT68i4L1n8@;)*%PD}P2gUXXe69LzsP}zgp$$#77!Z6_#n&Vj!mU5e5wtYVZLMI zp#3$p79JYbZr=*>w}*lM|1ysubDX63SHSMR5Alihqj`u%j&n zO+4Kb6;3cg>HSbZzb-?ELA>)x0{7!<62ULD&Ta;weBIH3`gw2V4E z*zFxq)#Wi{cqNe?q57mTZaB6w?EpUbsoO97>d%8ewCsseeoI7=CA{!`lgJm=#FC0k zm=#kagexM$WI3XP>n>B4TWk9S^wW-xdjE|E_*===FQqtAEw3piJx~BbH4TgsEEPZ; zL)#v03RqR-#KD4_ThN)_3Abhp)H_i16H8eWhq7kCI^ST4O-8dnC#98R-MvS`M`!9; zMU!TMP40u?P?9M2TiixN8ete{U=&Thkc{e7Vt}5ND_;xlhcZYTImqXj+D$#Sxn2~m z^t0{IB&$r2uf_9&UzknK0lHHlAM4OJMs&i^zAD}GLu#g#*rs&!c0^XHa2-)Iy0rMk*0LJ=N9c_SHjJPKBQBNzwZ?-V6DLjf}pci z8!WswjO(xJ56zevZiQ4B84V6@Tip(sM&9~VK8u#QHyYCYX`+QEk^kj!?(gws*o_!S z?%xNagY|xTn8tBz46yP9#^t5+p!fb-fFvb6X?~`gq0MU^$uSRKml1V=nD{EA_rhZ6 zI4RSVF+(kHMlzm_=U*>AgaDl0eB#i52&Dpp%XRuP4{6|j$mt0Ok5PPI?yweF}eS3)QJw3IvPwVeX;c}}koZXVl! zFC?q0N#OxHrY}TKx)@wf`-;+YS?Tk`;P+&Qs#7x#R#hYQ-=?=BiG2dHxP8gPo<$N~ zyI)-Eq12NvX*TI&m2n6`?qRM%^m_eyT}*XCdmaH%v`r^Ha*Cx`KT!I+-3IsQ<-6#= z5nK~pD}1}aTA|k-1yH0==nDdlGpHef7MP`}Kq5N&)S)A}9dl#czfqDZ_IZi*qh#(L zQjRBAY-|x6$VnL|4_9_E{)VpU3mVv=)cHmb0PQ=@|Dj1750K&>&j|(j%5aLB*dC2p!jbuSL={@ZmPcR3o+Y%M`}8O4ap+d z;t?ghuHIjf8M+!GxujGGXZ^17w$uQV|F%dJBh9}#G70LMaqkcYB_QlCq$7iiD@9tP z#P&Y-{S9uCU)bD2xg(j;#A9aq(5pooxv!fq0jqxzdMju}LNy@;M%ItcNfec5h)iu< z+%Y{T`rSK7ud@Fd-KKw`J@Vs34GW5XS`|$acGUeAM!HHtZWab=04@3??d!!4C0Epb zc8c|KQIjn4Hvx(X=M|?t>l8FFd5&{~R8ul(O0nPbD0g(2AdP*+q%EcV&?^M@)85l6 zgSRDychLz#DVfJkW1w=7`63(M^)6%q!S=~8neBp%{|O(RLIb0tA+2M7L{|zkY$^&` z+HlYzHfU~$HsLX1D91JY0xT!}0ZEjEfz5Pyyx2R^u%E_U2``v5hX$J6NFct^*8wU! z$LI*8>n?9>aOg02lZ3NCU&m|dNI{Q~Y29w|e`3je+=}h4;q^Fr2*iKrw z5)j%YjhQxa4EEL+ATwDE`514v^iJ+yW9rpYQWq3dQ8NKDa7mQgW*VvXjtB^%O^!D1 zvm+X)n9Xm&K&EQ>vI#5(S@X53>=o?K>&cXcZJUBwL_`xNMZG+PifG{#-FBPEFhw~L zzO5Kyo>{n?vihryHX&Cg$~-fL?Xbcm;54gRQRTV9sx6Ww5QWUB7 zXUja*rF@|ul*z?G>gO6#6KxQ&WT|Zo7I|s%-cOJK87ZgnZjdazT=#A>ky9M37kH7v zI+?UUTCDN#Ri%wI^@$Z!sbKr--^un_P+yq~z`2hJ6kE>y~bE=X3C z`3?Uy2YaIQ&IlRjjiUCa2}ubj%9MGGvjX@_aLh~Y1~Cs8sEcQH3WDvWefF)Lx?uY4 zCvJ2jE->};t9AC@o$ZOaR++P#kCTEEtm@(cWw%EXPJI`=r3dWlCIy9AT>+fqYiA=T zTE-^6g}$9xQlqkG9u!9o7KmeyvuKaJajCUo5+xH`W0%i~z^jf`$ehHQR3!iZr3?H2 z<`(;nMQVE$;2(8xQ(3p1A5VT#NDLEC%( zv-SUR|5a+&Y>7>@XlV&b?7eDNYt$BduOjvq6`NX7d)BUMZHfrBX>HmHf@+IUQuI3B zpYQi}yZ(Xe*W+g8oV-rX^YwV#@5*f z3&}51=sAi8tqt}5<_Zq#(t4F=;a~{pgY6gH3eT+lNtC$t$^x6DI_;ym?MnBANh04) zilsA8%r`!B$&pUOAOXby$!qVIr>&a|@jv73EK<@a(XNmwuG zQ@n`gPwjeJGuv4mfBiM;5UkVa|68hWDtJBJggsV{m3pD+RO)rfwQhKC#vgDp)!DRF zqtfsDWTGuE`hEt_yiA_vLZOB)yC1@ef2-!sGY54KDE_$B^7S+EYf3k11JPhnQ7dAI zygL`eo13AEIOh+Fe@C{T(XPItg&%YfH>1UT2sRRK- z*NEgG?7>6OuTM5(btlp+)-fNc)~MA}hQ5MoY03msS6$ykIn&W-oD}As+Dss-gNiZ& z86dG+KB}e`%=FDr?==hYK&bbx-eyJLRa+ey>2Z@yZjI6AG+W|QcR{bStT(dT9P%>5 zX(1YEf0Q11Adl9jH!P(!OItDVUF?c;{HX+#A4j{7UiY~F+QCMc{F=#a?^RT??*%_F z_r&Kll+QLe7x_)cI~O^#m3|9*;vU^~DOg3}kgjj$v)a!T45=7iFEo*N?(|IumL>Hy zvZ1rHwK|o>9zpZYGUPP|>}CpieJe1{=(uatstupEB1~^%%rJKgJCgZN7XIeaDa_+k zh%Jf3yv8!~!=GGk@DK1tu(b$zkIc~$C9F04 z7`Bn}*_b~6{aw+E=?~g*n?(q%hsOk+Tvrry@)|rbc20V=1u`ZZz&S*X9#pyW-~rk*x-TU{Gb3ZmfsJ{|gAe}PZftPq$X?R^4er=s8#KTLWFpMxKO)!dn7w)pjc zHqNilJqGV{5QGaAFZds+HADOPNJhS@9J{5Cqz)xHbkvZrxyG8n@WOAay8-%lq8rXb zDLJ^|rTJF1HUEUb=}KX>Uij{gopCDR%~?)~*ROFPvy%cp|1r-H;+}PTRn;ttB|(me zfd9&E{8FGfOJBM>Xfsrnficr;9ujs-kE4rz8ce#v?V=*QH}R@q z+xzfGtDKdyV38kTN#7aHQY(QYgMC_=pC>35-HQ+awqhJg!E&}Zl-Qy!<>0_>D!rIe z+=2i7I9HLf`@+1q=Uo+f^f@#>eiN#RY$cUfV^ftLAxU-PtC4Mh{5B1yyX%m#tVn72#*Bl^-(f(d6|3R*H4BN_h#?uN-QPYq0vqSMcSanv z(`SD>zDTjm!>dNfXD&{@_wG@`%<&R5JSCE0L@H*a@^XQID2((w|o!}$6e9r6{#@IoVIyXdLrO@w+H)r$-swA_02#mv2= zF}!XB;idjmVEB)v=(zCKyq@vf8}q*?r8TU2vcp^Zq2))QWk^ICbyz|qNOFsurM2ka z&Bas8i@0kc)A!ECA}$lSp2XwPJSaEhr zt!t}kP6Ci}l24z?5_z%Rc@wHIs(7aflxT6hPxmro}yt|O~?VqN-WvO2u{OE1J zrEo3?w)yFMYb(B8z;^@HGDd|?6+;NTIzm0l=x_IXjJQ=$?Cv*px;=<;Lb6!<#mN33 zu8Jm)TO~RgdwJU>y(r2tcAOVZ$3O!Gv)FG2jVbKVt4;8RkH#>*&7c1nd4#xr;mqhH z_uWtQS~`6?sUf)sU7oVyg06&M->YUuRAS4VEW1N&~uurbLfDF9It2`On)#Hej+$^$J9Mr{4g`qO6?i+-i1E@gbQ=0 zz;~cRW8eN$)*Q_@L)H%U-(=IrDn4%2?VaX7ld{}Uv~C`DcW#}JXv@7!qa+jH#vZ zOM3W@IgdBzfX9oj4nghO*`t9&2Ev9dzzM#shJUkodJjC@S%z&w3(P|y>-Iu!GS)6B zgQq0>6%o=B%s4HZk9HqHiZAJ$%M(L^NgC_lLsnWW50##cRelo9u?yLCYJ3S$IcolT z4lrV#ZyM9sX*F&Y`3!owRy9{f_z)c-Q-&5ey? zB_)Gt?)3R2r1ZRxrKnqJU?Sp3hH~3#|4La_*XuZ;gs895n>M3aFKeDWP2(XplcVRb zL%B6>gQ0G&0;doT)>M`vcO zE34Z_@?xp8zCEW?Q5{`rYl0ycnSHr~i!TwH;w8zWPkPCzEf*Y>T^A@Mq9L@U$~1zG z82F$%&bs^VnxeGd8@8u{^40g_zkxLLHae(5ke!tJVXxGdJ@u_HMQ5CM`RHr8V?#KK!29*MXVfY8n^H;FC{~VN@K#2Fha^1 zER>sdtHMow&r9SXX7Eq0*jDs`D{$!@-2Un}QbAi-#ebHj8~&`FVDQ)DZQdkaOJZZ8 zOI$z9i&03lg+&R6%jyN9$L1N|_DXy4Nj-DF2t%mPl1rt+Kx7J*G=VhV7a=YG%(e8O zoA8dpjN=4A81RM)OiJCXbl=V=`E*Sp3gqyHq3{Q4LRBwo-~+Gzt%@@LYu|^s4S^YE zd>`C}8d_*~jf~}B{ZULGcVKeN)Z%DsM+Gi&lICpA;To?AO`#iuNaU`qv(Cd5{@q#6 z!rS(_m_Wh zx90UTC`Ct^3QbbkovH^cDLh-9U5DO6?o@2G`cOIt8UBuGKGScJbBrW{U={ZV(YFmn zViS|?jdosfWbjS#nUX6N*c=d{?p*K|kduR}EeRmQ?_=e*lTe*I(U)q2P@fBB&*SD^ zaw9sS?a%e0GzCW<49qR2h}pR2!GOoS%Kei~HM-GpsM>Yq0%U+P{=LuS&R@=r$6UW{ z36t0JXq73?_~rZHVf4}(U5oxiL>`It=EaO*b+W-zuda3{w%N+31H$ZeGL1sgXpb{; zIAP}cKyZ2^0yFC5T6D6Pun>+sBPXn#Rs=famu*?3sSO&kCf)q=@kam5K3cgJ5Gz#S*#Hk%%uKx?33T0&YIg-3~{vSS(*&f4n!j(i0>_9r4Yl zW2@zlzOsmB>S?gmk%BV5=LZ+q4@Nj-jz_qZS9lkyyaw6Kuo{qd_>ZQi`iRkCT)w&$ z{hJYeXm6aNcTyCSW-Ld2EoLG&j~#E*2aun`*Z`2t$wQ>7-0jURM$MHRMl*SFH8aF^sM>-`42l+^yJO=A=j9JY{z zY?ouC|2-3ITr*9s6Ic?PR-~(_j^&Tp7Z^mI+nex_IZl9u*<}hoMsYu~I8r$jIt1<(HfNqc-!d-M?l-Hkv?Z=BC`fL(ikFbO=_&Q3$(hV={nBwCL`eZXLWVtQ);qY5y;KTMP~j zJwx%z6in;V+Nt$9In!i_xG)&-Qyv=Ulh5;8D zk}8aA!|FLf-0Af0#bbUvtf9u-d`?S#d;IP1Fm$C)Z9Rd;1)O<9Z;bH;kHtBS+|)Zb z?EFzbZQc<&Pc%EKZ|a8JJ&k`jX4s9qQvH2NvXR>GeI@t(!?fG|c3eoG!%p>K!nJ9! z`FHgFPvpBGUFbexry>PDK#OLNVH|r?(d7fV#hl+ z+`J1k2Kyq_*!`i=_AfNssjsyt8X6<08Sa|je1by5R#+!b^Kg94DH1z%KhoGW1eUKE z(p*oN!rj5@b|a``mc+%4z1X7(_3k$(=|VB}j_(t2Nzx;n*%TAP2Rz^j1vO4x{i z7b*~EA?jLWP%gn^Gs^SkA75#dXJ5^FO2k=fvaY|IthAxF9-@%zQ!GqdR+vpTcTb|HT z3H$s4*PrU9N23`jtKT&XVz0I8a^W(!oNU;#8za>Cv-*3ah3ln}6#HK!Hq^ML6qeOJ zgMSxJPN6~iyCpDqnSN_g_~|RY)E+Bi=1KZE#~>y$U6y$Y*W7ZTZXvE1~d6 zN59xF_k+!ptW5Q`frv*%C-83x#3f{~H6?}gbthPs?CAV^B3SHC9D;qRtO%E(gMNL+ z+vv8H&`OBs#7j!yh@+SnT}N;1GIgs2XR#b+nzfJm>;28H(Z}*cWI4#z40L@7BtS>g z)=nwgTPGidMU!-rQMtTW1qE6v2xxQ@Eae9iUmw3ctC$=qvAU@3`ta{@I50eMAI%sB z4VkFEv*daV6hnz_xS4{IK;C?fx8rV?M>({#GZE)9l+SyQ`WU=E%KF)r0-^VRG6(B3 z$c<{$aWL`?nTl)y>tbi6_VI>Q{wbiZ_IJgk3MHFHa9t-uXK9Ad*GC#Sw?A)0_;>uW zjl~|Atpa2J@A2Le{AS>3DjRQJ28JV90ObSy4UcBRWO_(l*4(_D`cfY!-zzTPuMjeN z+mQW!LH|E+`1L#2g-R_#g}CIiaFqSKR2b5hNJs!!A#pm&*>>;eMN_Rx4@06=^t0}4 zoIxWsfJ6OfWBaRzZ`q|3R(MWn?eRwUse9;O*C>+rW8{yiZ}dN@{Q8pPuK6oOrN@?I zlT)=wIf=GL;+U$l1jNy1mi`OJ`Wu95DVxY-vZdjgDj4$3R&Qxb#h#F#GlTG#LQBpi zlh8OQ@&x4ARk??r&GXzfy~V6y_oJAfnCHbSAk>(s>IKuhDjwtH#1k(+*jX@BT#PgC zpes_oQF^e{t^HNbl6$&IdpG`x@W9Qbg`xoUjzl%#?w41oNIP-zq7c^67Tr`X=7x9wR;Gj z`4Aq7o;5fS(TRMB`5~Wid7{BMYSh41$nm;`)!O_{%ndo*ub|Pnz_9J!{kkB<+L}f^ zZ#hoAQWe;;DO--uS7RD|8JhA4nJC%)%Q<0mYeHeE?t#4pK2NG7{OFVH=afq%)#iws zd&f?QyRp#1!xPTG=By@#BuO%97dXxA3mC%gg+R3zc`QX4zx=bCJg^A=pr5sn$c@y{T(j3 z58?Yh^Z^zVjQMf#l(SNFi$Nvne`iGG%bIP>2XA}!g4=I#2}k2>wk#ggcZBa^yXe9C z_u*3DDxBP-asHh1_sS+r+cV;a4L+=XV-St;?fj~=i!9_J)FhofH8bRWVK8sBnz8Tw zOzKirqN3~slHlpG_evV#ns9cgZ*{1{Jq^zJi|yEV06;Eq7n4c{Z?zb_kGfNZfy0j; z*)h@+mm39_bNlm%s?c(}mpEx05iz$6eX^8N`$ekSH23Wu4F0a@HJ$#ZPw^54 z8Lv9BT0b$pXrNNxUPT6TC-r;@oz6?|&(b2G5&U9TzoW{p1p&U7qf>g{pO2$Zn^zb< z$IE5MQ|JbDDx??Tr;b-Jj_h(X}t?TZ)s&;|GHa%pkfi??i!LK zyym=af84`=QQ_f%qZJ;*7oFoj&t(SOpBL1|%}T+Na4ewE8DN9VtVDz8h&9tPYMqzX+(Ldm_!a{pZTl&YZ%!>^-LGZ3l5xC zFmB?gHU^#CJAD{$mArqlUT6SLhG6naH2XoaU#TCVwAZlXTl{}#?-oct zerfpwiv~KsSwp9;u3Mu@D;K1Zf?n>c0)ifouR|H^lZch5yVO=bQAyEHOzN+R9F7{v zt8m&p?WR~}d(9FoEc7n;&*6;scNCS=fJ-nO!Y|PMUV@i)hQRVbPsu#Xc1U>lE^B=8 zNDRBy5e<2}5u@YP=3HEj2|jn0dE5yhAO96oercw_JFRzue9oqo3S z!g&b=!OHG6(iBt4VI@ZF48PTcRs+}hSF(4FYLxVe+=*5s`?7L4Mvr-6!czMcV^#eC zsdka@A?T>rIV-#(kYrf!=A4R^hiitgLE|3@IJW3~iIJWstU>2OpJ|#8`%(|L2%U}C zEdpTNdtC=$kBi4vek6(bN}rAX+#|Hl2GhMeWj%-5T$q$*k2==OC1(qqq-f1DsM37n zX~7tW*HewwIjx7&j`OX?g zyFWXqHbF!5;(1~0YRVu}h4*&1IeHO&M8P#Y8Xt+sKt2;GhH8~iKRvz6pn~^B63t6| zWZTYnQ%TNhm?kneUa50nNTRp9C9zjHR<~u$2$44f=4Qe`N$?r>Huz;R>!RIUDVU?EG0b3)!x;I^Q!hi*z%AF>L`F>S} zQWI9YhxybWJkoku5(p3fyS#49A&uR}TZ+j;U9pvn=ai%~ItrsFnb4)A$k|TfdkoJ? z^{Ha``c*}d4q=lcY+mT%gJ?zH!|>;5(|K!@tR?pibgX8b?{)G|K>XM8)0E?#)u5>a z^quSWU8i-HGlB_7Al|jZZ1!$JWIfu#l`2dybwY?c?Sp{!dcGT`{)DXvkppo;v3BlO znqR<>I2G71G>xg|t>Scm!eY#n3)xJi`!Oq-zXxhuWPth+S7C>z{QYHFkxE=0MXYgQ zTW2!yMzSmhg=;-4x;VEk}sL>g(65Iq$@G0sOj1 z32sqDyzEbx@6fqbWLGN%({}AXif3_5}<4% ze~xLj%y8MkJQp1$dny8TIk1(2FA^p4yzC_%Ve-yZLx}{O7$#Kl-}20@7e=qcmA>y# zXr)>Q8YXm97KIa}Q&gM?CJ`CS$|@1Z_y50OvopXd8wKX7nk)_}0DvitRxbyl>J4Q~ zr$iS(wpT8k#M5~UDGYCKPt=L z9*Y4>qs>g?{OFXLpr$Q8+$cJJu<*w?oR1^wO$&DW96&D<1JC;NX*{u!msvYaqZ)^F z56cq7H(xU}Z>R6-A({zoCnux5V74MIT z+hM+FfA(pu!JN>ESvFsmLlQ&auDsX7Ej>j#&AOo)tD=BN^FAlf35mngu4WcdH*{7O zWl!G`0|vRJV&okM3nY1;mGozJO+09)gyr^VJ=B=qDHUR9lo2+(f=W7=Do=vzD+g+4 zW;ja2I2{red50Sh>49}=s#qfwqD%gLZq$?Zh)%)LG?!@G$Dq*MmVya1z-wvxvBN=9Y_G_ z)-N49{m`}`#g*~9B!->Y{Iwqa#jmIGPQZCfUhH`V_V(IKFxY>+qIA%WcnM=XDrw+l z#`LBDNSU-lw@K9mq)KY^TyNslwK7bu-%Dy}LNPT>M*2ySigPs4`zK6tiYrjn!G7A0 z(p8~wI+_-53FGBMZc}nr<^BD0_A{L*2 z`;h*0`r0yd^y|3?#HZ;eoY#nvU{pRN@tTm&EoK*4mu|kOiD)_Ijedzsr;?hjVi!Mb zxvJDVCD}+#@(Ak3#)V?HOn2By4B8Ot_*9?bQ26=0_2>*Oe)$du>fx}yu>XCqGQSeZ zJHtHm4c|8rQvWK&B*N2(4i{NBKRf`_abVSC(t}zSemEz_bGj2Eb?J!A`Wn!u34CI!rv~8yR56AC{|w77i_zgD8Vh*{6fz& zOzY1QefcD`l2>&hKuq*8a~m%C7qQU)fe^nvqzA1}X zI5h|HIOusYX_`PfeLTZXbM)=I$`clh`?d!4k1JrmSv&=;*O%#q;82H@EJKG}4=$eI zQYCpmW$=A!g_!{UUip_WFiw5pt;R?>p1pxns|#~(h7>L zePkz};4#bdj3%X^OBbiFcQeY_y3A=ai95Xjrp83i=fJaAYL05}LQsXVuo0AHF!vvb z>XIR119l=vzBmPM4esce5j5E7+PS}uRuJzWD4-s3*ZB{gxhgy<-bcVxtzKQVB z)jG1^^*PH2J}5%*RT6Ca;EFb(V}&rkpEJBa@$<2l>LNQ&S*JNX#8Y^e;;Yk!&Xv?d zHL8&zE@>WyqUK3pNraP;mHo|ol^SE z<5au`89^`na8Koko1n_&l7M*FqGF9{3C?nPxI?_DHQP#t=MMHbC>b9$ZaBj0KJ1v~ zx3A#cu!7G#$5zh z1ktyak2Gc&2ddav#v1a3{kH+y8wOTcjaDswNKARlbsm{^9C9N)N9Cp&J0em6~sM>w(ra)K~zn+;wYd^i;;lA6_V=jB1_bO84kiseEymDR{ zmev9t#N!o}3M+cj--TjX>VrBFJFv}}+h@nAEl_iZq~9O-M&oc(`iwK_netK*1Z8JD z98=#*_vqO5jlXX7d~U#M#LkGKl}q6)sl$!_+v78&F8Re8qB!QT;vytH{Nm3l{6afG zdd}M4RmUx%6(1c0it+z$(HG>ysZ|v+kE8HGN^NxQEh+c3l6;qv3#pWz-J7cUn(JLmaE_?0V+lgXmxs*K+2dy~e?V1Xs>aY!%(~Ek6MT7o z$t8bV%5ad}R#h|Kx$;I)*|{Rht;nl1PdG*KsPo^&gEvO`dh>+G%R3f*XFv=u5aBn@ zJ9WNN*PA!-ugBi4%FXJJ)ZuZQV}8KeRv<2`t+3&uoB4n3Q3hBn0u_?Hg8$VcG0jz8 zT|iD&pc!iR|9??Ul`iTCJm<2i*}<`IM;oC-Ny=dSuq(HR~=@ z)}EG#K2hF$Ip_R$&CvF!^B~ETKU3cEtI=mW z98fEN+-Gt$1MKI8_*Tnsb&1p$yRPJYzfiBz*>_uieA?Gk{{|n0SZ{w1<@bL)zr)@- zDKi$9Iu&wTv1==Gm3nwperZ#@mn?t2V4HXsk>eLII#1dz`{mc_;{!r;KnHZ&CTAh= z7yOVFs26MSi%-6vmFOLoaxO}B+y6Bs%e>uf)hAOVdxIjZ!s}yTBlYi}kCLd$4cYqIOHCd@%5dGMOvrJZ~@2N1QM(?6(905OkJiXXN1N>1{lQvggI zhug6O*zV7MJ!N5(Z3t1x`{Q6ko4<1WVf~#V)OKD;$wYnWK|{ULpB<)xtdnx;Yu2fz zzZVL@h!?wZ$FJ=>k`yP3R9fXa#xZZ#$##vUc@n7NwWZiCs+4}Rx9nN+9HgWV<^Uw0 zz~dmegCxbPK&+{duGD5$Svc!}h1mNpI?>YUt#Y+nydIaDyp$VVkcm9DBllQ?4lX*_uD2iMC(!x&s5sR^%Nx0-Z-+z4|KF0K4)T9wwgekm`J z_npcQH@VvmC0{UveU9B5HBRAV9kR;I z%-(=!DZOsHM2dO+`U9SJE(^})62(o*?}lB}?k-2Rbm_5(V;>%lgT`SuXL5B;oS)CTv7cskgL)J z(n5Ebe--IEUcA5lA$h&_?d_eLW9%7c-}#k5K?#!H%X)`LAkOWawIn9`N7(pGJgIjQ z4@}ZV)_2Vv(Y(i+@Jn}TtL4lqymlb;;Jb3lXsIApwCAEco{)dE;*=6wulTU*-BOn# zd#eh^+MEYXP15Y~Ykse8bs=aK-x&W1zh~5MCa<&BNh;AzpDC(~soATJ?{dxO&HNjM z%{e0+h|C{N<9CVQ?L2oEJ_F+1^8E$N zJJXN0@kMQM7YEkXv6gecte(E%Kt#9t^JTnb2eYQ$~;=@&1ragX!o{ z&}~MGzy6=v26EtPTXc&#FX{d6p2_wp>qUuhvf3d_jIIUHAd&obWL=AIO5$ZhW1?4P(It*=*Z+r@l4< z6ih0k*TfbO$4Z=4;a^|u;DDsnza>s-9eT&Mtn|@p=oAk_;RjA zXp^amqX**~s^+->JvMqJPF!l&kH&z-C;pu6_LHpxll@a+=jA$h+IFaC8;Tk~b^=Ba zq{A!Y)aX2^z=+XP?Yqg6jtMkJg3vz+G-&yTxM%SA?b zKsbqiyqC{hmwOrh_}-QkPItX&eJlR#8 z*;>KyBT+orc{Nv|#2Q`L#gMS8*hS`ggah~J=u@(b!Ghn(DzN@j(MyaSXFlJZc(w((bg4#c(e-LE8B!PVtMNbmHP!4kzagF~NYs>!80OUTw z(ifgKOVacmdBlE0#pxp(CVcA2Qw*F@obPqw*4rqwvsUVy$kXtZjA@(PdLht#(Z@~> z0|shr!vMTYkn~BOCcVl~Vy+O9Qp2v)IaPEEC@;HuW3=@$he;rYt&=Z30lLx6=|iod6x;()JAEH72HY zrnl`ajNIIBH(qtGLK?xI4>4_?+r5%mI$BYZ*t79s+i>qi0gd6k(A~E>v>h zCj@Ei4PSu-l)r{?@J(~t88+a9_6fb3jL46N-D)I0SGq;QBgr(=Hp_^Y0?lXV#LC*t zXqweMg^jy?RindX&cqx$!W+~(SivkU8r4_&knmRhc0!-UcQGWagZq8^gPTv#CNnJG zHF6FW&-IZkmhB^}*OJPFadh)!OOQivFrOIlFhZ;gnN0Kv!TJ;xovlK5FLuzL{<)(f zh{uJ6Z->Q$n3)K2O|6<*T#$PErj>nyk5R8UU&%ryH_brTi6){|gl*r;XaoAKFR z>>JCX>MvgOpaH#5>#buMX_* z&uH^+(QCulKiPdr#nAyAfwofh+ga(Nv}7elceawK!lvst2VU!v+jMu%i4Y}(ZVk_7j+)m$983qvkanv%e@!aK86a0|a3n7D zH)7VxLF9EhA|Z_IC6M3s3@pC!I=C!bBZceznyiEJ1yc=Xg`%RQt)dvkN)cH;&Z_8o zHd#_Z;`&havA){}cCuEnEOR@3&n!!zqG~~+E3NHf+S+o z`oRim1G~|Xv{W95*_FoA6;Ve{FWHhYf-R9$N83M2XQ9iKoBj)W9396!WH-Rxa{v8J z*m+_KsF9pJ!ExoxohH|0YXoqfn)9-vk|1MwdG9qd&TK*@zIBD7-~1c3{W?y3Bz?$p z7p(w}Z%vO=x%Cdx7Q^k0M8!JiKVZ~LGE$uwBb)fhjsh4sd$J~NZRzu&V*KfCjwDoh zPdKA(mv2(o&5kM23ofU+XaBOdO>mc~)wWL0d)TU0*nDknVgcOxLWL$Edu@^2{^KL~ z=VVac21*VtrP)Sq2sTL@!TaU7=twC1J&(1Y`Y(V{*R7c=;rhNA7XG`LobNDB zGd;?)T%!%id%Q#Cr@hW*U22ZLQBcZx(O^-o@2_7pl>pI5!0I4bV!)!&QXe06FWZ?qckq!OP-{D({E?MlBN6!U;x^ISWFU#9F*C< z^2zbWFPd`{8W;)j#GK+{D z>vY`Xhp=Dt&;xK=yUeH+V`luQ4G8yf-#<~rB|&R~JWrMWxpBkDCq>cf-FNrzxPfYc z)Iv4+D@e7@kr~I9u&?bon>l;CRD7fe0n_=c)5q1FWqYf(-p4^}*!wS1#}p%Su4{@w z@FARYjYa`w6r6@APc#7<=BFgJ%a!7Mqr(@MaiKw~<~Y(f=^T-1vy<6$c23DA zBzKXp&dV!>Pd~x&N^f)FvS=QVVub21#pW@J`h>LwrO4B3cP80yRe;|H6XT0RJ#O6* znRutcda|A?`tX$Ef@yFXzC(W(7L_{XMbPNY-)?Xt4x7$w8Ha~CO2+nV>H@bc9@8sd z*gjpMZJ#6ubRZFGGspLaXclFE5!Ih0q6^T4vPbspV}?lDY9)$CJ~rjzNnb{7z3oRY zh&(ig7~e)_-G*+A(~CrtQq2q?KE2`0Ogs?p8}R~aiF}cVX+r4uC{;A*-dT3pDpAVN zi$jqWuqQPcuYCq0-fTY+DV5bP1*zquBgQ}r$bIw^(jeQBbcA28iQ-3g<1B#3pxoBo z!&R(OTfRE)bSLP3v_m+{#+C>2_CF~X*yHZ44{-@%9CD9%6rRx0ScNP|rxcu*n4G;+ z%1hDwB^#o_7tG^@Oy$E2IquMUq!n=rJ>Gpt8m)hD*UTLdq;*bP{Pht+#PQu;rr zRhQpQl1NKJLO6HU{y54_$Rr53l%3Iw?kQY}EQU|Btipqf{aT#G0FM&?q5i8}ub#~Q zl|&yQE;(osNDOf6__LQr=lNkVYC5+PCR!K<<8=qOuI&i>*DCd=On*AMWkx4u`-Xvd z?-Qh=kPcRA<|LdtLJ_4zFEpy&0@7CPAAKyYerj+_ZNbX@XP58%`PPk`np7_!L6*DlcKV*KDCk(biW*)Ty3=a?x>8mbny{j__{|3U zwjy$h2k!G=)WGZQ59gwR`TZA$3vUHx@*xH$) z@s0`b!!#rm{)#~$Wp79XA)a3?*jzw0=Y&X|7T5xeFQN2&r_Q#_NXpu${3|Lll;by%Ehk8x-zgH$c z!zK)%@NHfxg;V8DOpDZ!>3$c0i2K2RR@S$$_!dB*9`hfwZ}Q4Z&<&2A}R;a75tA$8Occ|# z1E~r>d&fUF0QBgRt+HW0OxV%5Wa>=6qN1d~KkyIb092nU6u<)9j3VO%rMY(_0L5|- zK&N`J3Ah5-;FX;s#=ij9p|l2P`02O9DHYn!^5x4XxuJl(elPb?(O((kVN!=RfX~G- ze0b$F7=}lnso=;P0Z!G4$sL$g&UK;<)G8csN&mg8jq#j#q1||)^xwq+$s*YUSnxN|fVFe|=i{ATWki5(f3?t)-YI`v9(@jNEJ|y*`^vOb z7C1A

      Mks-@bO_kmmx__6}DF^srt4FQ5J5i&@nQz%DGCk@(~q?v=y1En}IqH>Jbu zT$y-uu=-EWxiVG!a(MclSGfjX4qzp?0wpGQ9h$VxYM9YoZH2r*Orlq}3cRd7tpfFTBZ8M-{7)UjIb^_42axOPucRMkti7E`sy{wWmu3f*~JNMnx!G#@p3D6zDM#bKJ?t~@fw zT3n;tk{n47r?}cNHAqCOfcAyGQNkYHf2Shnl^U~UYn#56UZH$zVhU~(FtAih14;$K z-G9!#ctXe(E3jpx69D$*4A3fc?WXu$!TbKxdOJ+@62?GxLhx)Hdy?DfiiQPO1j3U{ z@-n}aH1p2$oYbF~^4=Y*a+-URC#rLFdu?KO-d{c|I?;G)6mp!};Qy51F%_f`M1@E2a0audIrunOR!@0dK$hi+2Eo^K-L4 z8dwDy*a41d8SqKW9&>u-4A?d0rmBv4z0(heRo-kF3KFZrloa82fFY+vVu5cmkgl00 zWpfv~|D+}vV0|uE3JkNWs8{gh9Jo*9GVgvi@t8_DfHi}Q@aUHV%JB~|w#b>1cHKsW zzl)Q#DaaQdUdpU~YVFu!W|GG&U~_!2l|icf0w~~GKL*D;yg{QvT z{}RA8O(MX&K!ipjTW20Wa|~8OLB(m}*5=e6(n$7U071iL8A0D{l>1G7oyvkQ9njw!sR}*2iF(-_DRG`a z)6M{WEsq9R;&-#QiXtwb({%d*#*2@dDw0Z*(3XwC1i=QMWL)?pUIXjYb0A_$(|B}$S!;Kr6hx7|6SAj`}usIw2B%`C3$X@jS|!3=Yw5AYMk*7mwfqHlKPa7Bw_p0~`T0In$?t7BV=7 zb!-;zh-TD~mdb;k`Cqk3aUciAk=-WWYlt<<$Fb~c%kEIE`xjvLiKo@_Jw9Z{%}-0a zJHp9#D>ydAt--nT^;V>60UmHK^)?k3Mpm0dOXPtqHf6XjOo-HszBlWQVs1#lx<1FD zaa~}1E$=R0Lrr>|&l9HfG|{@6Sm^F6o0lr`IGg2RtgeKbu45lAEfID3)1&|u~ z!K;gGX70Ze>(W^#?T*zr2L&JHKG^F88RXVo?+*8H=(e+yEt7`6xA#UUYBbHgGuUzc z@6i3vs~$pbGn^FX0FSD%TlaA;2DV~IuSwUR8>Jrq;s7R2(%AMTHzpq{{hPpb@BWP+ zY+WDo#B1^m;y6jVs>IyRb*AF{tWiov|FnZ$pkZSp>FzQqlg)uty6HSRlI<3gqQm=( z41>0|%;xluqH(}$8xHQI;T1)gJ~ypqfm5SmMQ9CBE=DC>^RmpUxpS&5-e;6O1CBOB3Zzps zkY8|fF>chVmQZ(lf1uz?2B&^AEnPobLxM1GhiT@Tn#{?!CJ04W7X?d5C;5V6rF>}t zh0II7MuVu}>m1!zTB@Ag2I<7EoG*@F!jg04>1{&b6rF9s*H@N?ts4jAgRWi*0?|xL z<5{&{6$-T90s4=d+jGteR#u`JEsrCE{^4g+x5gTtch}_qc*Tk%JoYW^jHfm@+iy(PfNkD*wf~Q# z$#a5dvN~swkJU1geq-?;Chc)1_sFdIdrwr)p>9Y$R@9&o*X`M&}HZilkzm3e95lC*l<8LE@j}(xh*ZA9xkQbs5+ZcY{~tEBg-W1xQBwA zitUZ}hA;ICVdqUr1}TG+%B?t^&Bgb%IsNUX!`8a;xfRZDtDbyaBPTF1R*lBKflpMp z#NrKTgf?@xp3({hs-I@5>+iNiKu<6n>2&xh;7M%K<^4oAjwIZm=H5!WQ-$wW`L{HK z90MUsD4)2yq+M*1)a(5Zm9pX(PZ;!Dy%Kr-*E8}l5e z#aVU1=e1i9Dk}feF0$I4qn9zrh3&28q=RMpFoZoj{rjKD1HkN*wT*MG3=oJ%?}hn2 zslux{b22wYD8b5}TWVZh>~+q7LSs^*sKy{MBPCFk;rF}b8_tsNlFlQnie2qLzFT7E z&mdeXZ1w6MW^6Q2v-@KUdP80xD9q! zOBEy3|J_x0GN8_qG|^*CC1e=49lG}QbXlnTBcC%!zjb)p_Kgy26bOdX3W4;@^QckA zsXEA8dG4s={s>O6Kd6SUT?7sBwRR`;(4~Oiz}S0I1mY=Wvh0cPai}!|$xJ~tInAv{%s9isdqZqCUJ}i6){|m<(wQC*2_!4DkQsjy{CG`ILMv2gMZdKRIl_V8F|aKpUYd+hJ^6k!Y%B}VJx(h zY+~=m4DQpu$6b9=EvI#jGGCBrAlL@Nt$P%XKPn^>Q;1Rohz#G}JTKX!XPMI+J@rO2IwG>d=wAC($pF%)XIy!xFzb$q1rq#-o#C zSs0QFNR33F6ykUl!a#zTHk}tujpGXY{Ks>wm9kgdx%1_y!pF}Ca7Z77LA?We<5Fq> zyz&lz*yjl^%t~!lw=Vyjf0wJ40KZH%*FAcj6TSWO zt#FYc zlfE6F{tPA_PMC^Q)jSoNEXdxiU?0@;v4^Uo#ub~d2(K(D3rz;Omi>&=yTSDY{nLrLP(n0xr!M$I17iGSn z#BoeaLUKRz)~NY!bM!biN1Z1lTYOKkt{6EHLf7TMV(7#o#G89L>yg~rBg?x4f!@N+ zm49w&OEI0z@S3i$6+f|zzJ;k~^3Qr(<;s>BveI%GueB4^ZtskvaeS_qZx(0b-R#xR zrl3-$y^~lKf9FbA&t2A|IKHq~@~|}BSaC{j-6%JCk_op5*Csbo6Wy}TOP71}Y1;1M z1oph@*v>6#^EzgT_`KJIpW8)a-(TYQ8LVAeKq_OT~B2&1($#IcqU;4lnf#*q89S7-!t!+S5~LqU$V+YUs)HbztENcCw+cx-Mp!mdOpRZ3C9Bp zfF(ZJuJ|(eKNzjJkZ^-D>9|Y%Ab~=vGQJafNZLJSk;_{o`uP6B-xytCZ)~fio1*! zB&=~(M}!qxPznDC6RS}VH#pcZhzu;abZ$L6tu08WY0b1P^!uSzLyt-2alcmST-GY- zgbd-?aL8t=#E@5Ak1<(8ZCXXL>e)v0Z~RuqmvcE24+eP-$NJwy$tOwsY+~g*Q-g78 znFa2-9t6YzLSmQonxFC<#{ zFcG15oL{9}$8<*J-6I{#w4SLi(h#3_k9GI$+RlBWq?ZBGFNYHyCvcjsi9mZ22%n~k~P zJ<6p)@ysd3QS1FJ+--rG*XJkRe7F`6u6l_jY_R2@pM(0X36giq{C@Opyoc_FuCE&>bSCc9_XER{0f!-E&=+w zWF)`M>Enfc-bm*|-E>8`jxSDi->b{^wfpt$%K^_~flh9#5Yw*CPiT|pTbf)I%x!*# zb(){CJ9WRLNa#G_ifX80EKfMuUD|#XDlGjE!|Rm8s?|PB5^+A-z`i;~?oXUR>;nAZ z(AP1VSya)FJH4D1j52aPv;^*^J50tx^y@1@D6Nwvnhn*VaJPs*qrl7=lHIu2Od(XL z6Ylupq-SyMzI(cWP40QHRbIYqTG!LF4-4CAUaOw7Z;yP=0m`S*+LZ43TyE6iq0{<2?Le zS^$@Vb12U(1c6Xn8B~7UcD8@EA^M5laO6lN_@LJ&HRNnRq_T@>GS}D@QwSy9cylS5 zlnYTeiY0wC^1B*Gdh{w^PXqP==&N2~`Z0=$}#|g*w*z{#+t>F2LH@po0ym74}%y)<7-| zjR=G;n~R6?C_7B)|6$&SMR+gfs?cBi9SOQ;m&>bfVAyaZPitE+nC@7kA>s1^87uef z#iqQ;9Qyij5Qg)-yX<=|blD{;Mmj;!^NB=_Ef`1uv$=>k%p{!R?0d*bWr7~;^n2T> zE6)v*84f7?THTtPS3@yG8r_z%ANFVc0;z^`pfmNSNwKy3Q2B*?fs`)?ecTQ&JPG+1*zjK~#bCwRPUFobH%-2My zDu7(jjT0k{7-6NQp2Q{usl%K2NTGm?j^Altwv(T3-Y{T?v3F>oK96PXhhaRTnYaY& zdLP$s3eYY!SHsdCiXW&!h?uX9HLk#n#p(anHTP=vrr`+ zRlirQQA~xCM$v5Ff`;tUwxdN7yk<7{KSLQ9Y!Fk{Dc^Q%=YwgfPff!kE-|snmD#te zO1j0mhn!4|(6RFNT>UURhwi$(beB??rHf3gdee_yPU<6ByxyxE72i^lOnhoWY4C2_ zl>S#MJ+Tan&dqlTCXKcQi|zT=Pg?y;A!oykYxb7D`IV8hp%+#X8?KM|?vaBr_c`v^ zkAB|Lq07Zr-I|!o7ALvjA|LJFBhR-Qa;U6a6U|bAPD8KWR%@4MU7|`-;P`}6L*=91 zq8_3?qCDAnnP^uVHB7aQ_Zp)u$X@1ooTdb(b9`thP)aSTc?bEWU*Uz#kFqYJm>t#M@|N8fiH2w26(O$%rR<(oSg z2d^PSk3~mFd!LINACoWk?$^z4__PKkyjAO4t>{s?J2{bkDBiMLn zVX5<@qd=R3g=PzCRQm)*VscsLE0>6HF-*#F+jHa^QoC)<5sFw%GCs3 z<=?ISu2EC+U++lyU3c{B4)UwO{FGf4y38V0EY)aK68Z!?Av_ zc{aJ!>V@m37?7pRz1-5OI2}o2Y6UET2xs_I-78^knxGvfin~vkMSWQX@#jMADlD*g z!Sa+QZydu@ry5mRsfCAVd_XK$K+U;!{it&9&SnbAOS*G697|Q?7n!QKM3|+`DCu#K zSn^m#i!BDuD!kZF)rgnA@@#K0^=KgtDYLoddA6lIN-?Y|`!08k4kHyBQ~2)XlSOr7 zq4!I^I#!|~LG_-7R5Jt7pHeX5R`=T)lkd*+=3l+2k>gP9Y!rpg@HRcD=q;Ap^kLUD z^r#Vm;9L(4Yy_#>zZFhaj&LQ)fg0WHFiCDwl`3`|6WkFn2ZILeW*)BBQjBjhgb$BZ zZb-h!8XiBqebVREJ_ipY`ZFx5wP96cM^xn-Q=^0&{Naa_I%7B4zOBS2rE5QP}Dx^_(kNNw#Z1*`Uc%xXr)dM)9lC$IPl!9Tkp*h(xVd{1KQ)&XmsO!NRP7}!j~qrhcO&2^ z`9t*guqnx1F82GCqLHrxKP8Hm24gDlGdZOUb(kgs+^E4 zFGsmG&P~vReA&{^%sTYEK6o#pqA%p6O!!dECR2~#66RdEo#%ddC**n9Zf^OhMI3I> zf2Yq~a>Jll)TwmXUDEG$O^C9s1_Tfim;!;{j@_>^7G@)|c$K@*n{Mq5C5gl8^wSm} zm>Lt_c(Tch57eo-J&KsOmy@O(Bw0o<0*vyMUKE2M%gU6QmgUb;HOGIVIkGZLP$vzw zU*N`G?|d=*jj1fP`z43i*VJ#^)2=)>$=}<0YfQo`ulLMrNb{1$58L9qxjFf|MVoSN zCr5q8Uvy#+I~1ZO?>+GRXJg)3IyfQS(D9dQ0ajLb_#_>{EE==OoCW6s6Px$5%Tk77E#S=iAu=b4z(e>DmWu z4ym_MSL5^=MHA${7R)%96d&%fKP%guM7C`gUbV+0)Uq?*sc^+)N#}i8heZ3Ey1^AY zv;Dd(3+cSo+lCcxmI&sjJB&LG&KY=M@1usNJu9y*@a7O|^?sdS;u9AWdW~!o*6A4c z--()C!{@nsFy>hVD%HiM+=F+R>K7lp2B`z$Cm6g&rH+OnYH95@@NPgv;}uR=T>(Q5 z9@lxzPOYASN%S7<@zR$CEmA#sdz(jbHan@-*(&e$q8b*91Cm|bs&s}j$CtP{Tg+)b z{r(ZI_%AiVh&1-x+sP#+W^d}mhw1K8bfreR_>Hv1H?$YX3^@i#QOf4~Rd5s=4apar zSRqtm^@*vc5gU0_Uo_q|rMDeeDs;VnbL4S^6Ln0+F;abs;V|&zq`1u;!+mKnj>&U@ z%?&j~Lyyw7*6pLdP@1`|*29Dr^eBU zvsXWAK2)oD@)_at{+zdNmc8Q1(7-tjE&0Pd75gyVz35=Ii#3d9;=IQ!QDQh3v4I?~ zBKHLNZOplBoJohSO{w9C=JgnD(OE_FAU#gV^X*qHo!F12%ei|cqIs8Kd8p>NbA_R& zZd&(~wy)$D>Dmw9kh#IvywYW=)|347vvXp^g@tkvrOe&7fCavVI15rMvx=v$kc50I zOxO+sdym>_9BZNW4Cd0rnsB}-0ZFrw*g9N^7tLlKK7>OU@{292dkQL*Qx#EfXoO_o zfNY<+QjA8aZj{ori_c4eByma&2;z8}CrPd+HhHX`9X-gvsSb8Jn;`!kc6jWA?{ zkM`x(`aqUZ@!8?PyFmunHT3D>cpJy%3z^ve5_7zi5j0t(NRJe^%U|Zb){G15Qly?h z_QW5vk*Rk|i5Iewpa1Yn^q5WHWB;I6T>g2s>&p2;q$=!LJjJy7@}Zvs(4HI0g;LVo z9T!tcs?G0^tzrt{cX}2J@g*E;IqfU&rJy;|$OLs+Y36FA7#oRlz8jSy$G!^gj`Wa( zCOq^L3@LS}evn14u5Pp2gF~8SIcC}pRykue!q+I$Yf=)DW0M6;9!)z7Ev#5dS-FpR z1ghR%xbTThKgrgsAG{h7gLKaBT}tI~S252(ViSrfFHi3b#$W)KLFG$Z6sBjLbHT}-IF${)ZB$(wQGIZT`)TRj ze>aX*-A9<9%&?58&$=n57*!{sa(0+WwLbM+lw&l$d9Zf#J6xE`o17vCBvaid{fbal zXdv4_=_9I_?xJRBz8%v?R2Fc^om0m(z`jU zN#mRf2jxcVJBwRk6ylY87fuH1TXEJ30ZC*L$SOywI^w694(AcBN>)iMnrYQi~X) z3#fmJvd}#n{L*4-X>@njkTFj`bE#(CSVd5i=Uv);sXa(Pbqy+C(2MbQsLJLOQ@DOHVz4(np0%$9||H#rMFFd_8Gt^ZVHqQicYkhdWlmgi^seh%`$FUlz-=g|~sD zdJ;0Jx>Hh4ROxgVs4%+VKvwSXCTetaDW!84fsjGS>UCONR&{V8$v)!7RFUP9*v~3a ziCxYESlL%Zp*{DJf7_9jZ>o~#n#y%8i|&YKP0HQK8l)t_^VzN-?R_C8mBWilqO-}& z@HB~mr+zLZw3=OqECxKB6WNldcF-n|IM0EN>j}g;{A+svO`->wU45>w&wQst%T#K6 zhs|b5COjTf+hdaKL^NRiEu5+xm-QkZ?3udZi@wc_g;!)hR1%gFMEkU`%xdQ_m zHS-?Qp!fh+E^^x(%z+543b0pmFYv`kqT(S2k^f!a**Q=$AJ;F`~tC2G^JIT2x}7$8GW>q3+6XK1tqa*I;FjA@xDu zP4_|@F_+k_mBhzxl%c8~CoHgz?Py}_CeaSe<*qqHIh<(8p5I-zEx!s2^+ZFBvFC8e z^_R;787|C*;hjz{OZMX^V^Ab|Yi;oCotwuJ_dTw)VmEf3mAmhe$|K;<%` zBJVz8?2db}WAH)(C+ag0PRKH8^HS0!^fHRMh6N&?DegPmskpuoBTwZlt{w^Da;VxY zmUk3T@Od@+PV!O>PbccFLI&JEPIND-HDx*L_w{a7MOHk+Nr|;PPMvws+HvS+&@+?3 z@%+a!v3{>49X#WI9FpM`88$twINXh`3nhQP9Ji?`wQ1ih_2wN-L%fu@-FbRtD$Ot+VM&eQOL<9w(@> z#tARiPR(c3bq4sVo1HtE{-Lm5)4s~YxNQ~exM8vEZ0H>qC-N^%H?9Y;qUS@4&i$T< z8M&2yS1-~$z5JKk)35-Jh>4NcQQZ?dVGUw|H3+Y z(%xQ*7W|hlc@OCo5=A*@nc^Lmzh4BVm#lxO%%6aIZ7U;Y?o+S*XL3XaF>BoC-wz{d zMB1xo{fB~ni3|K)zUg0%GT(pr%Dl&aKkRPA-`5gBF&6%BXY@Z?k!0v-vxtkG^xt;r ze}2dq8e#N_&KEG!oKB_%tVGxxI5Ee6uWPf$(r#xffBI+f{;tB|TEQUIDli817qx^i zJo5tKuqjD;@(o#@A1DA>PFDcr5(jkEctMjfTo1DQ_kH0(1ZW|ZJMaF>H0#MN4NLIV z5rd44YHzGTF!lW(%wOsBtgKrU?~Z8`Y$O(=ON4>4ueWDHPmtA}n0rT}BM zWFqtR2Ox;1pfu@l<#0Jdmd}vpGKlTvOeqSuJ}g@SLTxi zUdXmy3Amew@)g8j*dh?S{n7QHUqCAZkPYj4Haz?GODh^*tK}03s>C4dG{MT|>Qup; zF9a)aUkWywz|UN*(k#)MW<*Zm>(Yw9&mYPHJUxI|-YfvbsP_;F)&*vIH}{MJK)mqA z7Y~r~Oup#wB>8~QD`N5yPjmDI2Q3tGu>t&J!e{X>+}&D_ORnWnFxXXtpztyLWi(RE zXMe^&4Sf0f(=@U{b7BJbc}gMuRGZ*~#`t$2{yI75c!|&PnI^9QNPM>DF&aV$LWV%X zxXmz9<7lfb#LVl{j>`r+R-P^FeDst-!`Cpn3N;@AO+B9}q1+&4TtulZecIrGiq) z25~V+is$KVE#W&Rv0)P|$@>^&!e1fdjV!IJ4GuS+VJw)gpUE=UOC=VHZp8fn={u4e z<{<+n6VV->@58xGF&A#z>&945*on_kOD|zr8q`AFzHn*c|3?23`OMWHE(#`tnD&-u z$f=loGXuukbs$lCT#QIk41DzTF)^*3N0FS(Q<3ME$4x1agnVDxyYGg{1bESUh~dU7 zS>FBC1Im=6m;)l$n*k6f&B>)FV5IlkPJRoja|AfF)B&>W9kXSxlUD@^SHN54%kzM^ z#5!yT?}UOB`UiIwJF&W81mo+-Z=_IxL*hip#(Q?b%6ToQ%k>y1)S+3Z?XYpMnj=DF zgYqly0w$xe*xrw~UyMI=d5YBxT`@H4m&NlYvTm!+9WzFI>nv$8L;1UsG@yLiV6MPs zrm^{MF(Jj)>fwBZ-7L!CRlYITKPTjN3dGbX*L-tyEQhsLCjs{^mAIAteU%{;A6+7xZ$v|^fd8Yf?E8zfRm}WL zUV4m+m><_ZWV+Xx-Kf?W8C2)AYHLbU$<|0+V^CgJyE9HBx6Wj*VE6r$M)!%f2i}CC zy0gS|;!q^H`Xzn;fw(EjQScqeXL;Wp=q>Y}B0f=^rfYW-;Q zjw8IST-BG~kluYzm9d;s0zHt<&n&AdQH?ZZu=~4XN)Frz<+1B{C=XUWQD9M7+QXOg zxSE9v6$xVj-tnCSF{z@C+{`N6faPpcK6Qa=J}A5=aYXDx94|5$n3$yi24D?s@g<3` zxgJ(A6zqKe&D>-V;>`J}pcKHWQo)&i`B`J(VZW?!i3mEHhm-i!PC5ohHZGblmxPtLK|Mc>8oscgt1StQ3w z8Qb69$zxl(HA~L%FxNu`ZkH94a^2pw_d^c@?CnebHcaXk#1bKD2{x-#5+&NpgybAy z8S)Q~FD8d1IdO29;5e1sulF(!RB=vOUY#sveg)F`wEMOV6zqA=x~4DJ()Lvk*ij4R z67|t64MdNM4S#N^D4M+;!TMd=ceT5W3MT4(lPLUQ5^4;j zX87viN?XX3;1l|i}7$tbTz1R@4~#}GIx;NO37;`9{P4~m}oMq<(2(tCO1E?bjD1X(z~w=<#_` zZR~YCd(@3uppBjnomYIb@J11K!S4?nch_C5tNmTlsSfmom~sRtMf*RMo`Owtd1V_oJI)Md&PL9CxFzASdi$) zzR+9^7M`NpHm%1q2GCq_DYtg#X*^SA{yF+9{Rd=>sK72TCJ5ww9IQjxy|a~qmCXn4 zO45$b`E3488C|1PQGO%mwd&;*8F)=URScE3;F3?y`S{HXf6kPnVmAf2!OvdWss;Gt z-#-PXq6m-HOYq6#BG)2kaXWZq;s_sSN}lE5m3^v&~;h!&3~~P7nf-Zm4RRaZ~Q$wDWZD#5u5O}>9pjo z=hWO0iBzh?ip z{v?9gj&J|J)w}(FC9Q)pw;%plOzbU4lsBgWCx3OH#8fh!u2i1f+40V@NXS7io*t~2 zYybKG;2px20?K}o+naW>W$<47g@%7oSnasA1rfFqKrUB;wzQu{sazM>*u^%^oN|IB z#6G<{H)yEF_hI!|v6s^@0A$XoDB$&3 zqU_Ii1aS7pYfImQ3+XAG_%!SeY4rjyX?peDx6nhI^ast`op__gNTNcCDC}D9lbmA< zSZVtObX%iqtYYJwpt;v{c6!tc8DTv4f?g zGyqO2*?b0+mchqnO}{@42Q?XsYclwM-b?9cAKJ+|E&Zmwx>(%5Q`59#zPjw#Dn(6h z{#h$XRC}Srt@d{j;Fwz1WZIP>s0^&YzU55t(WWE7o+4laSCa;hq8BJ~B;jc8m>nR% zNy+qRED>ruCfsP;{XO+y{ES-emtq3|tvx^)pidMgqPy7rjiS6q@0g?j)Ly@GC+#~v zqx_T8ivTc~EhK`+ULq*F3a)_$I=i?S`Aq^=Va)!FYPw+j<0$zXv?-qaUK2RBz zu8TiQ`MWHMPuVBMmWv$Hakc5k?fPx0f0h=AD#<1C1{r`e1n;u&qcUiy21N=<&jGYq z+e3sB9!;Bd=-B`uW|o|(p>4WsVp)|1uAZX74iNC3`1yOX`aV}MgNRt6+hbP#Ggs2i z>O{KzzC9&Rb+4bP11MYY#!xMISmS8P*@uhhy-^dB^A1hky~6cEvOnIa5EW~J?dG;m zFTA!Sik^5hG%kM#0H`GetbsD3n(ju1KM;YMoW~S$<@ES!ggu`DAlwlYQda;H4&r&V z1XjiWe!qCzXsT$jiGCFcrjU;JhT#~zv4#5`s++q5UVfw?VCcC}-B-JmX*p0Tf?IJT z-vMESPz8kzI;E?{wvG?RhvOw(14Uv<2SxOJ){BP=(YKBP$}(Ul3K)ri6DC&JcLF4b zzfF0(F$|$K0FsXc&Xn@p<^xuNay!Xy`(;XL1;cfwQuuEB0lm}MQFkHTdLy_Gf(M4J z*NM{8lu?p%lN!1mx<}X%RDS&bkZOP_AwYK z(@%MwBK6~mAwp%N?$hcEfeyjC8Ehp{<2j~BC01f1gMzj*i`t=DzEEI=VBDmTyl0$B z;2mA>$&bBiZVW_NEO}_^^uXoIICOy=p-9dJ%j3(Hgy)^WilLyWQNJ1A@eO)^fVi(9 z(YHJrrvg^9ON9^)h^JvK=?dG+|4}UivYoOgmfqo8j9|qp3$LF6Xm8n%iO#= zQ!UZmjVBoRv-aP)kKUu|iB$XQAJx6a=S!N2QqkFOdgMKdQr(g7qV>-)uk{%7g!%$) zVC^jmFi5dJRi)nba6r%jTKa{$6tm^;i=G$rNSQk>bj_Sx7uv* zSob1*BrA}%{hT4k+k4`K&>uozC)?YD{cO*0Of|c5fSya*lv$#D>fN7Obo?T6*Q)U1 zymH61?UuX%jBhW-828B-z7Sz6?Ubpuzj z4@u8n+^U(u<9KP^iOmn4LCHit#(lA5R6e0NlMG^Rmai?xQrE4lMTUn4E^4@}rs zT4bRx0aUHEvv00`__W=?sKs1IJ<2FqB}m?l$n<-+71NA2nl@CcoQyND?w_-8&6o2y@AShR=9ftW=g!xHU^STY9j8P#yr>4Zck?xHyA{&-uzx0s zyhBnUI1^6(kJ5wO0Welb^;*-%)a-F7jL!r|@|<7Z<9xGSMTYR`;hmWi>mGdt+O-qY z9=OF$k*_b8p+@FfRx?3ErG5hir;C>O?}OWFS0=@hS%i9gRkP)#57n2RWSTnA9Y3Ev zh$twGF7kAh5*r~T3^7Ddg>;2oY0!^}o zG}v))v5oc`N)3CtQe?Zep{fPKm`9-b%;x>sz$QeDN%>o}wce;TC=+XE;jY`s6^!R4 zHKTSneqUiObgmsWF0H)DoHnO?L675+N%ovfHr8Pq=$5a5CF~uPlXJ?#h|LbpIDxGa ztS3?Vvczw(%O4qP8!&?hjSE9Sg?=!?$+F)F z-03LCQ&t=Orw(e#9Xq#PsIh<%oukATb@p?CE@O0ilFPSK4-4IUN$SW$PQKfW=PX_f zl9hRRC$id-TKagu_5Ix0>3%JA6G<|I=np=x{Q^so&*qZ3iBp?>H>(*H-O=&aXCX24 zE$hY5+L7B@DRajwl8&IQC(H+0hWzTiUI@$Jk4eZEpyB4~fDa&z4EsH76ztbiiNO5v z?9>T;DO5daO)o&P`h$@Mm6ITUxOT`XeP4#~MEE^Xn0rb%XZKQWc}gr3NOOC81S>5= zDtZHOZ;8pNr|+89pjH!CxGN#afyeYIIeiH6^riSf98$rT=ROgyjB*C-$I{>}X@p?% zds7uE#>b~6M>RFkk9&5%Lx*Id*rXXnG{c7b=&(+j=SQr(8wrsbRnh^+$P7DDaNk}&S9Iw4}!j1IBtJptlYX@h-}2pRvKWt z9~1{lzpayUYqthHm^;P+Zlf|e8r;NHb~82)VH&*SO>8SDkT37wIGOzC)fNDG!j!@_ z`X^jF;H0mVabJ~ov4{oc20rnR53=>B#&7gLA{t0iv8-3`NfA36)l!c^fS_gz4pbkuJIL%!T3$XBr~^#UT}GGDkI!Wa^TNj+4LV=^Gx_f-QJXtXfzuLV<3kV@2O ze4u?4yj#E-k3c|}mBXOcp6wUzY=Kti{qkWwS1w6+(sqP+OL^^>d98IocUchRW!(m) zZ_KS{)Lbghy8ncnZJm{$eB zs`3h%5ry63YBWOChwT9tX+3JGG<+xAGEw0hd^jO@6#h8)3i~7M{HnrPz{v$FZpL$k z3WZ79ovEj=lOc}ARK1zbsB%+>iLJ`uv!l7nJ$yk3>I;}DfC@3+3AkKPih7aAD)T6R z09+jeQ&uB}{285vN0#WbC*fb8(J?FY(oh>*GN8h7M7ejo3z(Ilr;TE2sN8t-kxG!* z{EW|sTW9BUK@zKh0N@44r*X}$W5zM#I1N~qx*ilh6NaQ>C~2QuJO1h4R%#Kl;n^>d zcJz#sF~ojRAN1p#)6fg%W+n14huCAb=L62_ho*6=wsg6RQ`l&x}uj zFw!n%VA9aA{MMhP%ILLWx_G=W)?f;&a5xKq&c^RouV}LmVZlp%cP(ynULkpU(OChZ zUD<<7a=yI48C11USwFp?G`XcTzEvn;ppZIlwiP`$*# zX`ulj$+wNw-z8t)zJFoxnGI;_q)2gzC}mlyUvX<{c*-V?ex;SngV&*BQ;=qZBp1j4C`r{Ez=%qqKWoB~{&aDj^^V9z zn9fS8rD6D#ohg%bRY$Rsn~HCC)st)+`1*|je^))&WbDM_=cm}?Q;@6xT~~X9nw?Hd z(fGIa%2y|HY{yuN6G`DvwlkuiNw&4hJ zQ$xybs5hv}>D7;Uv9!`|k9-^3Sw|AJ;R2W}e#)U@IW+FFfX_^lTfl#K}UhZ%8ueIF;^RK+wyiSX))GuXR2?VE_3g1Jp*}f9G63oYOg} zGw+`M!HSa^6rYMFVv)Zg3*blxCp14KRBR^Go^{jJ=4g`tLnsz*j=zL<)VfuJPvuZn z=CTt=4r5$uPkK-X8D%EzWk~nNB)y^+!z^L0N28*_R)o78P#tl|50#6bVY4?r50h4|=59h3Ky!A8kUa=&iC0}~8~ zp2J8cCQZbD)1X-uLD&iQ{iYM6(_4&w@41i-VZglldXYW??fqCWppFrUKCc|GFB!Gs z8I>chH>mfvIJCOb+40F-Hjse{S7UCwq?PNPWvjfexllzrTK!4WuVduq9f;|Ouvj6G zPFLfMtI69{8c{XaEBlotU505x_46x%lJ6c>8yIPK7##R8>>;!@(g>l~re;;Xja25$ z2u8}4gK94&ynB(Y`p3P1j<4@%2bG_zcIAh_gbQi%4C{`zKs#&gzd+9Gch*Y{t!chx zg)Vnj{`btW<`_HAHHfl!<5M3l6Nk9W&)xjx1niZL*tg^cYzHk#7w;6NJY@;>$bW@O(#)k>4{rmIr!P4(AVOlQr8 z|Bf9iu?Tc5MQU7<+FDoeWR(@qo?csF{tQaG5}Jkw&ySywtyRM5M?JB;x@x96>@tpVh7mAwP zv@`#g(v^Vmko#~1W(lL5273f)g~e~eZL@Yi`aa@~<@+-=e29`HuowTa(%SZ;$R+{ZGvj z#%o$f8bV0QF*@%MJJ0}ZwHn#L?zdOWsaV*nXYK~(bbG}NhpZ6`ipNr=bMLE1-+^Yq z_#CIo#zJew!z52}u`#*v@dL#p%bk#;$HmBs8)tm9izNU1wFD8`!H|)}c+gvFy7Sc74)Ch?#<8kxbIbnC$1Ca8CsgTm4aJ{t z6p9AN_UW7icYQuX**&&>MUlD;Ov6rIK9(c=nqXPj30bBK;iUmQ4Ke6F9i;1ZSrJWNUXI3qa8mWxXx+NMw4^pJ!U9NfQI_DYZOG@+kL z;EEOQz*b`~?M$_6B+BxjcAq$-I+Zzz=6hjEY#;{psIj^mg}_1po)IRFuj5+lMnh(ZnZzahFEyIAXm+USRFse-uYMzf^XmJ(+Vvu z<4oj*il_JPNiP+RfA<<%&9QlSl!Tts;!NJ*c-YjuGw+mA7^jE*-kzo)q&`bfYdFUF z_cU?FPto<9|CZSH+o0iBo_`PPR*1)2>%%vegn$6~L_zD2tzq;wax0bm?09|^C1_@h z5UsKwAf@zDew{Jp5G=q+;kDT0>SbL+c{czIx4t)2Jtcu%&J0*d7Zf!IT(llyzf*I> zK%M;#aZnzpH%1)zD#T*hy*gn3r@QxzhpT&|hEs?^#28Vc50Vg!F1i@R3=u)1_ZmHj zZnz_Q9le`GOT-YJQKNTa61_zyTJ+9)+_|6s^YQ)szMss`aLztw?|ofst-bcXgn8fr zLQawl-!0SZHP>7>0sLOr8X?)4a@H-6j}lu-cD_1F1wgkdJH z3jn051_-92r&7U6uA$VB+>?Tn%UKj_>DuEIBj1$3&fvrJUPDJfLk@Cmk;Zr~-BbOh z&HOP{%q8zIp@clPB5yC5c#uI?sTdI)bze*OkW5F!$118%RNYvEd~u>#nNLbwv3t< zqX#UCAnH?WQN5Y4$+_b)gj)J53C7PV%EY8TEY)k`Ew0s2FV*4k&KLXXF1T$i>r~OL zeDg*-%BG&z(&=d+<^mJuh*0hNde#=|49=a6Yz5HvYdkk#&?6xwH4qI83!{@3=B13i zH5l)EyklV$4Vlc8@~+b&74rlmiV?BmZtJhth6`Qp%?*;T+jgR%2LSh}Erz;u(zx@o zK0nK0Cl;CzytPWXDEVPEvvj`1tix_+p-aT|_e)+vRujc2hV9Y?Kyd!GN`1PH&kY}7 ze8)PJ^|DJ_Xuqrv=dvuhn8ki?KZtk`UmkBv_423g*4Hxo&L}%&t}jlWPhh1=HibD~ zU_P4mpYV^?-DE2mYYZGbXL%_IIJ0xw?*tuoD%*@Y^aYyg-ECb|2bUt=Ttng#HSDeM zT&VR_77ne_0?CvwMTJ#m_g=v`xdvz^3eRkq>Ay6)+rp?P92@HFx4!lj$C=#mabw3d zQ)j|+(v06?!Qq%FUCc zE$$M{zK2tfPNU+9p-haaJlgTUISTBjYKCSMSquxbzPb_1IwRZ=nBgLWwJqj=&qSmt zS!amQ5|`zEm~4&;f^1QeJ?bsVb{02c{O*)>r|MEi1BJ{|=RpWXmg~itC-1%3cz!0D zN9<8MY*Lzoqjt*k(yO%oZKCV+*Uh51)ifHxg|f;Z>U{jW9D$@r%6ux=y&QR*g{$TZ zL&x0N{ogFl4Ti18PaKst3aM5rxjGRFeT+%z2L*!bK9&h&GYPi!B9^+1Uj++WQg18Y ziG`f+zql7*)BW+r8jiDvgzNYF@}Y^*b5D_rCx+-;=e0W6kD$%Yl6QJ#_EWi#B)%C~ z$b^>c=*7rSy@RL8GZ%V`Fy*bH?&7A2(!z3ZaJGAq zJTSra!(bg)jj+ZRRGoic7xi>qG); z4;Rmxhawrn7S*&dJ8#Lpb`ZYPp>JKNxNlv#>y^StzE(#OVEMB_l8fA*pmTHub$oD< z`b;%(ln5?j<5<)urDi<9`>Z0{L;}xo;U9K``SCD6!$3NV&Q}<+s!vOar?IZzlA){0YWabl`o$Dv z)^VAAq9M&fHghvodvMgzryz!M4_6duz0Y0RH+Y-|ih2fFM2dpk+WS>bmJ8$F^F%}%f^%RG23{us@8 z@&!>3E-SMd82|oJ&fo(zOn+srHJjeUOOhCZZ{4jtO2;$dTP0Tp=1`{x8&V%x6HF!9 z9gcSv4Fw{Y0>U~6_4WZ|q5J81#+k5xhxR1ly#zTO8l3zdxQd8M5o#){OiZ1N6OqkZ z;haNRA|n}s37wu4t2fV3cD57IBg(?wPv&@rqJ0Z5`HvGxUv?DNQRfhh zeS8Z74Ue)&Wei^+i=`(rY}pPLyu^Q68{~!e9@ttKCZ1^)H#-Y{ZJ*Z5unvE}5L0}< zi=8-tgG-;=3aG@U8kis$qpx8bIYg$qvVk=0le^n{a)&Kffp>kz z65~k32_H9h1oN~{xz_)53-I)*hW12XGUrV?hnk;DrLK__}7M>of0FJT)8E+qDI(94oX{FZZs za6Z>@%^jUW(`9$&OptXYNhiyk9FWfN-(W&p`7Ce_zRsT_?wEa4L)&0USc8U==1+0rwXn zz?sogFX2vaImaK^Z@n@+O6Nz+aahMb9ZYUmc^f0u$TD_j!y3;AV>sWF^8yRsTSC~eFG?@E+~Q|kGaH8L|dQM(Wvg=MWe9o0GfAXT5uPu+U|IpH@63KO;0cjIAGJ=)N z^r;*yIUVe`VkcnQMn;_5hIxIn4^f6K?$av%XhD(2R6WLkhkeRkArrqg#tx=`-)<~$ z($KEd=P6N^eLG5h-Be}`M(tfDMs~~_u)W3aoW8X>L+nNo_RP^I&io&*4C?}`m24jXE%1fl*M%YJyT)+Y<2KPx2x>@ zBx=SW9v%{mNhYCYVUE9!OgUMt`Xtu)9X z{YEcJMLd3s7-I3nFzz-~+4emc#ULNt@tB1&2a%(XdTezsa@Nd0!2I##6iuY6jY8NE zZ|B&jT4%e?D2Aka>YrpyjBZw%d#X~KJ$0YmZj=mO3ulv^^sg><#D9{VaKR4bai5B= z+oEXSKlM=;OQy6f_9uBiDGN|0z3=o~*0cXiwcb3=v{WOJV(2Hww|i#mcS{C> zqnY?=xS{fE-_`x8n%F2gcA@;-$5gY-&t%;Y)nGou-RQ`jRB_(6?biXIVWjmaHLm7y z+bqw(;M|>th&ehx>~(8eQqvZ%G`(=Mt8|oQt zxmeAt7l=eq_C=m+l=j}9nQ;LD`HX-#5lpP4OqvLWhhU-zltTy<{O<>Vx5NK`@lp91 z;aY!&gr=^pjn-Gg3XMHW65SaE zkm~y0>W@m#T}ygln|PIEzNR95oaz4lKAD~{8NMVnm9Fu#kj3rFf})~>z!4e3%7TJ| zvhHrBTqjlsv@tPM{tR!|1ebiCDQOL?=$7=nR8t#tm%jzYxvnLuqzJU-sbU{nXwS#3f^MFsPTN#CX;Hp3$F zzyiO{EA1!j=2}A=wwjyas*9qA#<$ze(pIXEBlvZWqENfKA&F1^9c9X8fJhIcFDNWjUv%L5a2 zp1XFNlQ_4P?@&D)u(M>ll~TmK6YN<2>18NG35!9D{Gi}dL1{=e>eP+dY^ui9w*A`m#jyvwHoI#lbw}SR6_@6b2)jE2GmT{XM1^fqbc=gBCNEwn(BlQWHXKCJD5PAB z@I!}QoS*8+%Dz*+b;DmD%0o&6+nX*}STLvgn5`JCJJWzVM`=9CLv(SFmo~n;Ni@FL zlVqS@ZC2vGH9h@8HN|Hf%5DRY`{$Gzlt3@Fm8ayVFsQyupwB$X64+dPvml0IIboS6aoU;{X$_-#se zceissur#-PmNk;AOoQRVkW$$G*L1yNxAoCke+A;m91t-)2a$q~{`vDI4J?uJ;q&U- zQw^wElK`Uk{D9l%=1itO1T^$M$B!yY$*uY!q{?52Q2zS6OHE0D=RrT<$?J7POMj!V;#W^Od+bn(vOd>U%^K#{^V>lamuBk6@ZtWRcDgcP#|~9EwXj=aqhdWnb!IKAnZkLa1wY zeE1?@+bF%mD1OACRj9j|PxX}oD~&oC1tNg~(>*{WWmx59MD1gGM}|-Q z1#loZ&sHcrlVf)9ML*#~rDAdS&2`iE1`imGi@8HEIrBjY2Pf-$pP<)~_XOLc1DD+@ z9A~DL0RgzQ(-zOs9UOu4Id-Obq!hUx-J#BRYghJ~bwo5lcr5!34tZ?M-{8RAbVL5e zDoa~dK=2Cs0rb^3+lw8eI**bb($bv|EUzcu9RY`lpNxVSFfrmW0#NZBx%iu&DvuPh z+NIF~2Z}m;5N;-@?C-$6I>3ZAeNEL9tiwt%?{vq0qO!tmWBfS%-YIZ2`(Y`Iln%Rg z=Uo?5jQ%M2X{EviSg8Nzs)1RPy8nIM8~^nkH8%?(`~#X)o%tk%gPfH%N4%40@iBX@ z6X#Zku|efWhLNLwIeFW@RN)I+!tU6~HpMS(7Zlt~F;8p)j=tX=5G>ZFInI6@CUN%K zJo==vx)$w9!L!so8h;5EW;%TGUh4dnouU|;lpbX%gex;zQiOMm(u>&rK?%SjFNCIk zpn3n#dx20ku@=G&5nhNeFu7N@_6ljG~3A@6+aX@oy*CjvLq?9`sPt(Er7If*Wm9 z?vpBrF?8M*$F{6=02ny_{3=TV`K5qg?FM_m>wACaTX{0jTe{SLUlW8I3c36Lr;j`j zwB0u+tv&7sye9tpysi4hHa0fgVq#;!%xEl5)3Y3azU<1ru`LOi0%-_4xEjWZ)NjmZ;T~wA=X6OU)QcwXW^zK5@U-L zY5r>+B{%E>LG0{wcI1?lB52jG4P>;QCRJn!I21@YV`!+HzW%i)794yU9MhA;I{~y7 z?VJ1w8(^okUi)7F7m3wyzQ#j(q1WicKsB2PW9<3q;Y93x<@MbGnW|{%lg@+9 zDO(Bm&2opSnq#Xf$C-n}_2^?3_|-whfuuAw3-a@CO62Ce_Et=$YTXadOB{y>dV0!q z$}Dw)?=adO{h5_^Y@e)l%Epwv?rjUFIrX6>!kN`_YUCZc<+w9&S@Z)y#rKUNGd#GCTtsIE1Rmv|6yVsj z2L`fhiZ|d)(AVeKhU#!>VvC0gv}zZ=-wdkTmLh%?-|ut=f|x3Vz6Ijn!RgH9^kH;> z({%=Z(|{|~ShcucYSDuQU;)eru?lDuC>S@;>;nnDjwnW3088#|fF<#d<;i9jn!8J& z@Ak4o70LhWJqm7hs#fFQKl3w>(9J9gAPV^VY8Fm*DV2AmAhKP+)0rGS0>Gpz6vHUt z)@yOAX&lJ#S0xN!FWH|l`yPGlA;pxDVc67dM~e0X)(o3i$xQW`c%0^1iJ8MMfO-!( zrk!_?4D+l8A*@Imj6#Q8zT?@^w(m!|Z;0G0tm3XwDiaVV6z=kE;1H0+C*mV8G`xm; zxC|M;i;3M%{b}D*`z=N`Msw!%Q^2~i?L+}Hk95`6lJxp7AcPvLm1fU?N?7}3X=~oD znm%@%-a8cf64x$N!OZoD;$UrLAdU;q;uQS+JzCyd)!`oPXyt`bBR#=odXkiegj>Uo?*s5u-o`L<=P|EXk0ZjW^h$7M7 zm)=LseG-hO!QW*EHL+OBGJz@8nOX_2LkDe?!l(do?pY4}pS$PD#!wXyN&X9VPec!J z{WB~7z+Xbt+)AM_#!zWC#i%{Q&r;q%1sG}6nK#TP;$D;3lT41WL6`QnsQs0+EG)vb z0-z2_a#8QM(E7COZC*Qdg3EMjO)dSuOjFf=o?LO#SUbCxvQibpiMuTpmouQjygg zq#d*OLf!1PFHkt3Yz7yOE~yqByo^ssSX>k}kIekU5tzjg4BnRV59Ahhh$m|Q$b0+P zgwY(RXSWdgGiq0EC*aMXOj}u#D7jE=Ss$=~we&THV}T@}Jz*|g!11J5^cLN?Snysf zzld3(UR6<7*9Q;L|Juym#2U%^DipSd03pBE1N64k-+b`<`3Dwgj?x}&4CMN$`7?IX zZKSgD?kyLX$dmUHtp1ZwxN;I~AI})=X;OB`)h)t&qkntmJF^M3^G!e!Fmk@I@gk^L@%)Lg%WfqcDJ(8csNk0 zv&l=cG(q4YN4aDE`^9o$t$`7ER++#Mn!jlnm|KYd$jblMKZ3C;X(D4l+ToFqsGZe- z0x0XBD=p$a1Z({x4|#7}Uv0!QBZtQh>IxA)luKyDeu-*#R$H~OB}T#}vwv=XKZ4;gKeF$Pwu=@^Yar9kF73G~Gh~N(#m< zfhr*2g@&p;^Dcf}sUQFtJ=wO}SfQ*#;@$`Asnghl zH8r)E#l^+r0YvO*9v0h6LPB!!tkt8>J)Vo#ui)=8C1#U=jbM-iYP*J@cR!Fb@eQDt-6j zPh3t2-V9LeeJ}u@+e2|1)ckxJL2CkV(aQVEi5{F_G!sE&sYR8;6c*5duJ8axaE*`2 zq7T^CG7`r_cL3~QQJ$!B#PmRL1RF)9j%q=674$0#_ve)vUW;~YC3cP z*|F|nAj4q*F(m+&k0l_SSN+^5$xnj?Fk$UyI{+A1ECYsGH;U@FtLiPf2Z|4JS9=Os3PHOh#6^O~Lhk?Z={g>4}PSbUs(p6Wy z_3V$BdW%7H=LoQ&$pRRA6>FZ58@79}!K%5oC z+ucB{WS2M`PP$R%VmlfTaYT}eqZlQ;h^b`dNyHwsD>R5WPOskwj!ggLw?hvC1g<%k zD_ih-ZF^ zUTr1YQ#r^u$$wYm!=bxYo>%B?4$TMQiHflYR9O8+-+E>lvnz-K#MrDh2zM+^w-f04 z)~ce-qj*q9B>ghVpp)QSiM!0QZ%61+jbKa;Nxm5dD9eKB8qIUTpCiBR8M{1c6 z3ID8p#4u>a&_4*!AIW^PXG`De&`;XsKF7w!`k*$y0OifNxNjnD0D>b)%F#Cz)U-cH)?<2t`$@Q`uH<#%H2%=LezmixR0n zJO}vSEVJ$?JPP6%q-@8*@f<3pQj1Dap{l%@7M}WpW(%nB6?E-NVl(=Cw~Uk zXo5plEV6u_rpk*&Fx>|VpeN?Rkr5qIXr@8XogCp#$SUo8tOJy{K(o*p3NL!CuK1iz zF58R!ekWw&3bSS^LAm2uXS}zhE*bJ`-^}{=FsN)?p}B|8K+HRG;tKC2JCsi3F;uZb z*^1;wm>_rg=tI!MUAcHPKZM__IQeFDrm<8j>DZj`0NK36(m&6jehd#o=}#>)5%*3X zG{NiQ0k#e#7=>qqS1d4dlZALsd@xz%k(~d&hEf3NPT#yxr-p;=?dJ9i#0NxVmZHFm zakDh<5h8+6Uk(Ug>ij^4#IieS>@|KSVuq}C@tE&Wn@I{}Xw9Ovab_Q8F)r-? z4n@{HpkVR~>KsLq)hEWU85D)GmXX4NL`X}zuav~!qn#REeeF)Y8&6A6Qxb;k+G^y( zhxRibY2J;FXUFHm6hKF`8f5}2GWaL4^7&COgIWpmKm2@1QLVSLaCww!<*@2=l@Q2z z0oJ?(ILo zSHK;+&psFry?QyG5kwV;(Ej)FbyH4BG*=rharWW~W^D=kWCbKKAO8EtLn>@}f@-=qcyq)imZey zJRR`b0`P}e4DE|-nSZP=6PP;j$=HCr(luDle}y{2ta%QJ_-IA#PsUqM0gjEwW3R~c z+L?Cv4^H_8V>>7_z6P(ypNsu%>a#M!g3qPXc?^$=QxtbM5YD*$nOF!LqK&cthfRnZx?whwZ>(-R_v%hWX>-T7gylE))$V4gtEA-LztBcWx^%ZqgR z_z$UUQD#b<9h-kOlq6&XJ5M;ww(cS~dYC>Rn7G5{67@}GiRj*XDXb;!Snmb_=$&=d zqn4=LcyHvsta0t`thN;sS8>nmnef49Jd0fVh^qUtwx=kOO5jY#E~&;wJ>Mtkw9>+j zu(xU6S>Fei<^EMF!u}!+Km5@F z=XIs*Q+I;-d;A#&;|^4kM`nvLTw<>@8Ra2}FWQF)+Tdd?k%;IQC0o6GnC#hFgU8+L z*>5tD1Y(+%jmfW8^PxMf>BkI%?B{HRJ)~xev2M_^?h8Jdp@V7e-TfuZqf#2`JkKu* zHf~Z?E<_(%&+6-wZm9(Jj`O<$VN7BLXGELgD6}amjc8)$!kg$RMZ@hEKbhcU5?l!kcPb_6} zmoHQ2c(t5fyeXM+uJ|ebwXZy?K+wLULcrV2@Cz`77HKAl2t7URty3dq(93f>ZG-Sr z89|2$z}a$2cxLIFP+ub12h3R~lMm$U`rts%ha?+|3i%?U2*d=78Jqj!Em@p51;&?s zX8ET??_!mU`uZzK>6?!a8RhhAiUxMx5}8P*sm&5keXhr8GUeE`;aD%D+I`LQ+_n8S z+Dz$dc?W8WdPtP>nB8C2gcGa{<*vF3b>7VXN#BFVDvv5w6>sYG{6I0ZMtZuEEU%pl zr&LOZu;aI7(ORubPYn}DUnTu9*m@J8>XWj*qjcr?6n5hf6P@LxdXUulAClh}=ou}Yv{T3+%kCKiest*_qX zROnz~+X^Iou=*@IQs+Pc9g-KH1-`qGXI3qWA$4vhJc-K?^L2XqrTQN>iX{IR*jnwm zxi=gk*H_2BetI~T$HL6jPvvb|_7DU(C%r%uUr2!(T@{mQyGHu)mL2L`cAWMPxE((My-y}b^e9^phH?&TuXbbo3W zk9N#XP#yFjt9+i}>AGF){QkIkCM$m7k$kma4W!V;kx>m74f~!1^)zs65N?yWL%I3j z(%+a>A2I7aJL%)O?l42YYI67{lQT*BplySNPX`v-HVbTag6HU_N88I1AV0PT;aDs| zuTO_oWfRpUIn5-ayiJptO{|)33lWevUz6?)q`FTZch7 zR(-t|Us0m7d!D%2!%8-vL!$?ix78D@jEF){r?3kwwyO=QzKsa#dRKmA$$$CIl9)Pj zG(NA!zH_g12p93DgdAS6@+`)H#Q#Z`^{+$*`VzqrjROAD9er)4a(R%xabttJsh>95 zlvI^QciA01<-aZfBqAF6E4lP`EHm2aw-JX8S<1=9-}h(8F}I%@C(H!zMU zZ}eGMXZAx?a+G3dCV{0uZ9fpigRhgL?>D zIXkKLfF~b&X!eVtcry-|zda^W{bc!!{w*b}a_P0+i~w8tjvhQHz@w%S^c~N5=^G!W zPLB|nC|pAhu+&!%pV;+Rat3c^w(!gLiU#3XdgFD){2uRqK}mYGR;R@?l~B$m%Z#U6 z*td9|4wbVf30~BlDJQq=Pd>Vo8?~29L@~+J9Y4@H9r5hCSPo62O^y67nQ=FLDXg8R z@laCi3LMIOi7sVfxs;R`yP$>r3L&<5y!n%je-@qw3HZeM{nrH?99+r8SvWN{GRNWs z_)P()-KSB&nm0{3q+Q&;IZ(ApUsk^ydXb+*{b{VUtSz&h#T)_l7Z&Smo{(kTB+(2S z*w$+jPhR$S713YebgE~JiZs71`vi1y%Tu2!C!C3sZZLSOd*AEC!3k6NprbsSF&1&e2yovW_2~5`?)i`D>585&@|`YJLP}sm=H+nkbtV; z>R2=$pY_=q_^3a6cSSYp=RT%my7=QP+>jc!!me=X?G<}ILj2f37oFgmq*O-}BJg9` zdk3qWOq2D*OxT)?_-?Ks>?nk2bz)8Snjf?I`i}Pp6Vd5 zw`2;K{ml*dbvv)X$F^*0y`dLhC}wH1+g%A3UeJ=}i_`g*GTmsqNZzexVRgLKlzoQV z(!?driDSC}<7`w}k4g}9E*uo(*6QSg)_`E+tWDNgN(7^+PPXFTM$3o0C_=hy zqf(Z9+g+Nvziy}9;W$@gHH63?t-dL$j*E4<^lPabb35G^Ncs~ItIJF1OM9T458*W1 z^y&DEaYGS+Qfh1DtCNB9EdLhAcH&k2E$#s-&R{i^$UOl?vGCh{mQ{I`0}`J1jh0MB@qjF7zf2jTVAR8D((4?P8^v^*&J12^)$3wz5h`$DTL!<*jP4 zI!S>6HB#N{mh6-Mr@{Liyu-so-an4Hl+{tUHx11t6VvgvQcn#=taLB?#)i4E)5B9GK*cqeq$VXN$#q3MVnP7B$vZa~-L0vAGRj}hV3w`l@M_bVp9IBIZhYR<=8^BGtk ztYi@Cn-gl;6X`xS${qEvpXzxF zhbjVXqtZ`BFMCs5y7}MyxaMNsI3}wk7R_#-t{jjyzpW@5(3B!^U+dD3;E#?F<-hY; zGY>EU>%VbP+7d~L`{LsyG!u7^Y2t~T5c!S8D5(J1vrz3$xn~49@A4u7?bJ!`6Xy6x zys?eCoMGLz`Y2ZH$sOHwWvKvolkbb-%!~tLe=6Co@SpDp{9gtNy}xv^QU~KHw*NdK zQAn-aSIU2k-Tm{EV?Rvd|589NFgB^7dei^DFys)DK&&%on0fz-FaOIAw;NA!Jfdi8 z!kHf}Z1QmEUottVRlEsobk)?*oL)2k2Z3X`dcK-)JGbH1jzqOU=w1DLxY+B zJ}N-JnSB4=_#Sbh$I*WcXV;#aRs8$MS8R7`CS`FsEg{KvFm|-(tMC4l%*4L{m#6of zFg*Ob(PafSPiW&GtK&?WiB}WuCzrf=fbpyR^&lRiY@-$_C472Hpd6kU>~_qRCS_`& za>=9f>gww(1!Zi~b(2*bfA;Uj$XdhuP57NoZujQWUn7otN6}_QGDQmES63?U6xcbL z_mem~nZM%fy%2)6=fEa=L4fOL **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -For many IT Pros, gaining visibility into feature updates early, before they’re available to the Semi-Annual Channel, can be both intriguing and valuable for future end user communications as well as provide additional prestaging for Semi-Annual Channel devices. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test devices, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to the Semi-Annual Channel, organizations can test their deployment on test devices for compatibility validation. -The Windows Insider Program for Business gives you the opportunity to: -* Get early access to Windows Insider Preview Builds. -* Provide feedback to Microsoft in real-time via the Feedback Hub app. -* Sign-in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. -* Register your Azure AD domain into the program, to cover all users within your organization with just one registration. -* Starting with Windows 10, version 1709, enable, disable, defer and pause the installation of preview builds through policies. -* Track feedback provided through the Feedback Hub App, across your organization. - -Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. - -The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. ## Getting started with Windows Insider Program for Business -To get started with the Windows Insider Program for Business, you can follow a few simple steps: +To get started with the Windows Insider Program for Business, follow these steps: -1. [Register your organizational Azure AD account](#individual-registration) to the Windows Insider Program for Business. +1. [Register your organization's Azure AD account](#individual-registration) to the Windows Insider Program for Business. 2. [Register your organization's Azure AD domain](#organizational-registration) to the Windows Insider Program for Business.
      **Note:** Registering user has to be a Global Administrator in the Azure AD domain. 3. [Set policies](#manage-windows-insider-preview-builds) to enable Windows Insider Preview builds and select flight rings. >[!IMPORTANT] ->The **Allow Telemetry** setting has to be set to 2 or higher, to receive Windows Insider preview builds. +>To receive Windows Insider Preview builds, set the **Allow Telemetry** setting in Group Policy to 2 or higher. > ->The setting is available in **Group Policy**, through **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds - Allow Telemetry** or in **MDM**, through [**System/AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). +>In **Group Policy**, this setting is in **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds - Allow Telemetry**. In **MDM**, the setting is in [**System/AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). -Below are additional details to accomplish the steps described above. ## Register to the Windows Insider Program for Business The first step to installing a Windows 10 Insider Preview build is to register as a Windows Insider. You and your users have two registration options. ### Register using your work account (recommended) -• Registering with your work account in Azure Active Directory (AAD) is required to submit feedback on behalf of your organization and manage Insider Preview builds on other PCs in your domain. +Registering with your work account in Azure Active Directory (AAD) is required to submit feedback on behalf of your organization and manage Insider Preview builds on other devices in your domain. >[!NOTE] >Requires Windows 10 Version 1703 or later. Confirm by going to Settings>System>About. If you do not have an AAD account, [find out how to get an Azure Active Directory tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant). @@ -62,42 +49,46 @@ The first step to installing a Windows 10 Insider Preview build is to register a Use the same account that you use for other Microsoft services. If you don’t have a Microsoft account, it is easy to get one. [Get a Microsoft account](https://account.microsoft.com/account). ## Install Windows Insider Preview Builds -You can install Windows 10 Insider Preview builds directly on individual PCs, manage installation across multiple PCs in an organization, or install on a virtual machine. +You can install Windows 10 Insider Preview builds directly on individual devices, manage installation across multiple devices in an organization, or install on a virtual machine. -### Install on an individual PC +### Install on an individual device -1. Open [Windows Insider Program settings](ms-settings:windowsinsider) (On your Windows 10 PC, go to Start > Settings > Update & security > Windows Insider Program). Note: To see this setting, you need to have administrator rights to your PC. +1. Open [Windows Insider Program settings](ms-settings:windowsinsider) (On your Windows 10 device, go to Start > Settings > Update & security > Windows Insider Program). Note: To see this setting, you need to have administrator rights to your device. 2. Link your Microsoft or work account that you used to register as a Windows Insider. 3. Follow the prompts. -(images/WIP4Biz_Prompts.png) +[![Settings UI showing Windows Insider Program item selected in lower left](images/WIP4Biz_Prompts.png)](images/WIP4Biz_Prompts.png) -### Install across multiple PCs +### Install across multiple devices -Administrators can install and manage Insider Preview builds centrally across multiple PCs within their domain. Here’s how: +Administrators can install and manage Insider Preview builds centrally across multiple devices within their domain. Here’s how: 1. **Register your domain with the Windows Insider Program** +Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. + To register a domain, you must be registered in the Windows Insider Program with your work account in Azure Active Directory and you must be assigned a **Global Administrator** role on that Azure AD domain. Also requires Windows 10 Version 1703 or later. -**Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +**Register your domain**. ->[!Notes] ->• At this point, the Windows Insider Program for Business only supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis) (and not Active Directory on premises) as a corporate authentication method. +>[!Note] +>• Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. >• If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. ->• If you do not have an AAD account, install Insider Preview builds on individual PCs with a registered Microsoft account. +>• If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. 2. **Apply Policies** Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). ### Install on a virtual machine. -This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a PC. -• For guidance on setting up virtual machines on your PC see: [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). -• To download the latest Insider Preview build to run on your virtual machine see: +This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a device. + +For guidance on setting up virtual machines on your device, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). + +To download the latest Insider Preview build to run on your virtual machine, see [Windows Insider Preview downloads](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewadvanced) ## Manage Windows Insider Preview builds -Starting with Windows 10, version 1709, administrators can control how and when devices receive Windows Insider Preview builds on their devices. +Starting with Windows 10, version 1709, administrators can control how and when devices receive Windows Insider Preview builds. The **Manage preview builds** setting gives enables or prevents preview build installation on a device. You can also decide to stop preview builds once the release is public. * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* @@ -114,60 +105,63 @@ The **Branch Readiness Level** settings allows you to choose between preview [fl * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* * MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) -![Select when Preview Builds and Feature Updates are received group policy](images/waas-wipfb-policy1.png) +![Group Policy dialog showing the "Select when Preview Builds and Feature updates are received" configuration panel](images/waas-wipfb-policy1.png) ### Individual enrollment If you want to manage Windows Insider preview builds prior to Windows 10, version 1709, or wish to enroll a single device, follow these steps: 1. Enroll your device by going to **Start > Settings > Update & security > Windows Insider Program** and selecting **Get Started**. Sign-in using the account you used to register for the Windows Insider Program. -2. After reading the privacy statement and clicking **Next**, **Confirm** and schedule a restart. -3. You are ready to install your first preview build. To do so, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Windows Insider level. The device receives the most recent Windows Insider build for the Windows Insider level you select. +2. Read the privacy statement and then click **Next**, **Confirm**, +3. Schedule a restart. You are now ready to install your first preview build. +4. To install the first preview, open **Start** > **Settings** > **Update & security** > **Windows Insider Program** and select your Windows Insider level. The device receives the most recent Windows Insider build for the Windows Insider level you select. >[!NOTE] ->To enroll your PC, you’ll require administration rights on the machine and it needs to be running Windows 10, Version 1703 or later. If you are already registered in the Windows Insider Program using your Microsoft account, you’ll need to [switch enrollment to the organizational account](#how-to-switch-between-your-msa-and-your-corporate-aad-account). +>To enroll your device, you’ll require administration rights on the device, which must be running Windows 10, Version 1703 or later. If you are already registered in the Windows Insider Program using your Microsoft account, you’ll need to [switch enrollment to the organizational account](#how-to-switch-between-your-msa-and-your-corporate-aad-account). >[!TIP] >Administrators have the option to use [Device Health](/windows/deployment/update/device-health-monitor) in Windows Analytics to monitor devices running Windows 10 Insider Preview builds. ## Flight rings -Flighting rings are used to evaluate the quality of our software as it is released to progressively larger audiences. We will flight a Feature Update, application, etc. to the first ring if it passes all required automated testing in the lab. The flight will continue to be evaluated against a set of criteria to ensure it is ready to progress to the next ring. +Flight rings are used to evaluate the quality of our software as it is released to progressively larger audiences. We will flight a Feature Update, application, etc. to the first ring if it passes all required automated testing in the lab. The flight will continue to be evaluated against a set of criteria to ensure it is ready to progress to the next ring. These are the available flight rings: ### Release Preview -Best for Insiders who enjoy getting early access to updates for the Semi-Annual Channel, Microsoft applications, and drivers, with minimal risk to their devices, and still want to provide feedback to make Windows devices great. +Best for Insiders who prefer to get early access to updates for the Semi-Annual Channel, Microsoft applications, and drivers, with minimal risk to their devices, and still want to provide feedback to make Windows devices great. -Insiders on this level receive builds of Windows just before Microsoft releases them to the Semi-Annual Channel. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. +Insiders on this level receive builds of Windows just before Microsoft releases them to the Semi-Annual Channel. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider devices. -* The Release Preview Ring will only be visible when your Windows build version is the same as the Semi-Annual Channel. -* To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. +The Release Preview Ring will only be visible when your Windows build version is the same as the Semi-Annual Channel. + +To move from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for device) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. ### Slow -The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. +The Slow Windows Insider level is for users who prefer to see new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. * Builds are sent to the Slow Ring after feedback has been received from Windows Insiders within the Fast Ring and analyzed by our Engineering teams. * These builds will include updates to fix key issues that would prevent many Windows Insiders from being able to use the build on a daily basis. -* These builds still may have issues that would be addressed in a future flight. +* These builds still might have issues that would be addressed in a future flight. ### Fast -Best for Windows Insiders who enjoy being the first to get access to builds and feature updates, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great. +Best for Windows Insiders who prefer being the first to get access to builds and feature updates--with some risk to their devices--in order to identify issues, and provide suggestions and ideas to make Windows software and devices great. -* Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. -* Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. +* Windows Insiders with devices in the Fast Ring should be prepared for more issues that might block key activities that are important to you or might require significant workarounds. +* Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features might work on some devices but might fail in other device configurations. * Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. -* Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community forum. +* Remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community forum. >[!NOTE] ->Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. +>Once your device is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your device will be auto-targeted for the next available flight for your selected ring. For the first build on any given device, this might take up to 24 hours to complete. ### How to switch between flight rings -During your time in the Windows Insider Program, you may want to change between flight rings for any number of reasons. Starting with Windows 10, version 1709, use the **Branch Readiness Level** to switch between flight rings. +During your time in the Windows Insider Program, you might want to change between flight rings for any number of reasons. Starting with Windows 10, version 1709, use the **Branch Readiness Level** to switch between flight rings. + * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* * MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) @@ -179,57 +173,6 @@ To switch flights prior to Windows 10, version 1709, follow these steps: * [Windows Insider Slow](#slow) * [Release Preview](#release-preview) -## Explore new Insider Preview features -Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: - -**Objective: Release Channel** -Feature Exploration: Fast Ring -Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration. - -**Objective: Users** -Feature Exploration: Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary machines. - -**Objective: Tasks** -Feature Exploration: -• Install and manage Insider Preview builds on PCs (per machine or centrally across multiple machines) -• Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications -• Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary current features. - -**Objective: Feedback** -Feature Exploration: -• Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible. -• Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.) -• [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) - -## Validate Insider Preview builds -Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: -• Get a head start on your Windows validation process -• Identify issues sooner to accelerate your Windows deployment -• Engage Microsoft earlier for help with potential compatibility issues -• Deploy Windows 10 Semi-Annual releases faster and more confidently -• Maximize the 18-month support Window that comes with each Semi-Annual release. - -(images/WIP4Biz_deployment.png) -Windows 10 Insider Preview builds enable organization to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. - -**Objective: Release Channel** -Application and infrastructure validation: SLOW RING -Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production machines by skilled users. - -**Objective: Recommended Users** -Application and infrastructure validation: In addition to Insiders who may have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample. - -**Objective: Recommended Tasks** -Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. - -**Objective: Feedback** -Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. - -**Objective: Guidance** -Application and infrastructure validation: -• [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps) -• [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/en-us/windows/deployment/update/device-health-monitor) -• [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793) ## How to switch between your MSA and your Corporate AAD account @@ -243,11 +186,11 @@ If you were using your Microsoft Account (MSA) to enroll to the Windows Insider ## Sharing Feedback Via the Feedback Hub As you know a key benefit to being a Windows Insider is Feedback. It’s definitely a benefit to us, and we hope it’s a benefit to you. Feedback is vital for making changes and improvements in Windows 10. Receiving quality and actionable feedback is key in achieving these goals. -Please use the [**Feedback Hub App**](feedback-hub://?referrer=wipForBizDocs&tabid=2) to submit your feedback to Microsoft. +Use the [**Feedback Hub App**](feedback-hub://?referrer=wipForBizDocs&tabid=2) to submit your feedback to Microsoft. -When providing feedback, please consider the following: -1. Check for existing feedback on the topic you are preparing to log. Another user may have already shared the same feedback. If they have, please “upvote” the existing feedback to help prevent duplicate submissions. Adding additional comments to existing feedback can help others by providing clarity to existing information or additional scenarios to review. -2. Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. +When providing feedback, consider the following: +* Check for existing feedback on the topic you are preparing to log. Another user might have already shared the same feedback. If they have, “upvote” the existing feedback to help prevent duplicate submissions. Adding additional comments to existing feedback can help others by providing clarity to existing information or additional scenarios to review. +* Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. >[!TIP] >You can then track feedback provided by all users in your organization through the Feedback Hub. Simply filter by **My Organization**. @@ -259,7 +202,7 @@ When providing feedback, please consider the following: ### User consent requirement -Feedback Hub needs the user’s consent to access their AAD account profile data (we read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: +Feedback Hub needs the user’s consent to access their AAD account profile data (we read their name, organizational tenant ID, and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: ![Feedback Hub consent to AAD pop-up](images/waas-wipfb-aad-consent.png) @@ -282,7 +225,7 @@ To do this through the **classic Azure portal**: 2. Switch to the **Active Directory** dashboard. ![Azure classic portal dashboard button](images/waas-wipfb-aad-classicaad.png) 3. Select the appropriate directory and go to the **Configure** tab. -4. Under the **integrated applications** section, enable **Users may give applications permissions to access their data**. +4. Under the **integrated applications** section, enable **Users might give applications permissions to access their data**. ![Azure classic portal enable consent](images/waas-wipfb-aad-classicenable.png) To do this through the **new Azure portal**: @@ -298,7 +241,7 @@ To do this through the **new Azure portal**: ## Not receiving Windows 10 Insider Preview build updates? -In some cases, your PC may not update to the latest Windows Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: +In some cases, your device might not update to the latest Windows Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: ### Perform a manual check for updates Go to **Settings > Updates & Security**. Review available updates or select **Check for updates**. @@ -310,25 +253,25 @@ Go to **Settings > Updates & Security**. Review available updates or select **Ch Go to **Settings > Updates & Security > Activation** to verify Windows is activated. ### Make sure your corporate account in AAD is connected to your device -Open **Settings \ Accounts \ Access work or school**. If your PC is not listed as connected to your account in AAD, click Connect and enter your AAD account. +Open **Settings \ Accounts \ Access work or school**. If your device is not listed as connected to your account in AAD, click Connect and enter your AAD account. ### Make sure you have selected a flight ring Open **Settings > Update & Security > Windows Insider Program** and select your flight ring. ### Have you recently done a roll-back? -If so, please double-check your flight settings under **Settings > Update & Security > Windows Insider Program**. +If so, double-check your flight settings under **Settings > Update & Security > Windows Insider Program**. -### Did you do a clean install? -After a clean-install and initial setup of a Microsoft or corporate account (even one that has been used previously for flighting) the appropriate targeting needs to take place for your PC. This background process is known as Compatibility Checker and will run during idle time on your PC. This process may take up to 24 hours. Please leave your PC turned on to ensure this occurs in timely manner. +### Did you do a clean installion? +After a clean installation and initial setup of a Microsoft or corporate account (even one that has been used previously for flighting) the appropriate targeting needs to take place for your device. This background process is known as Compatibility Checker and will run during idle time on your device. This process might take up to 24 hours. To ensure that this occurs in a timely manner, leave your device turned on. ### Are there known issues for your current build? -On rare occasion, there may be an issue with a build that could lead to issues with updates being received. Please check the most recent Blog Post or reach out to the Windows Insider team on Twitter for verification (*@WindowsInsider*). You can also check the **Feedback Hub** for announcements and known issues. +On rare occasion, there might be an issue with a build that could lead to issues with updates being received. Check the most recent blog post or contact the Windows Insider team on Twitter for verification (*@WindowsInsider*). You can also check the **Feedback Hub** for announcements and known issues. ## Exiting flighting -After you’ve tried the latest Windows Insider Preview builds, you may want to opt out. In order to do that, go to **Settings > Update & Security > Windows Insider Program** and select **Stop Insider Preview Builds**. Follow the on-screen instructions to stop flighting to your device. +After you’ve tried the latest Windows Insider Preview builds, you might want to opt out. In order to do that, go to **Settings > Update & Security > Windows Insider Program** and select **Stop Insider Preview Builds**. Follow the on-screen instructions to stop flighting to your device. -To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. +To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for device) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. ## Unregister @@ -352,9 +295,9 @@ Collaborate and learn from experts in the [WINDOWS INSIDER TECH COMMUNITY](https ## Additional help resources -* [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders may encounter while using the build. +* [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders might encounter while using the build. * [**Microsoft Technical Community for Windows Insiders**](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) - Engage with Windows Insiders around the world in a community dedicated to the Windows Insider Program. -* [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between PC, Office, Edge, and many others. +* [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between device, Office, Edge, and many others. ## Learn More - [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) From 79c03b438d158c45df9dccdf409d1b09916f4c4f Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 28 Feb 2018 14:43:44 -0800 Subject: [PATCH 055/119] fixing bullets in note --- .../deployment/update/waas-windows-insider-for-business.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index 90a9961063..ec4bd495f6 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -71,9 +71,9 @@ To register a domain, you must be registered in the Windows Insider Program with **Register your domain**. >[!Note] ->• Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. ->• If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. ->• If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. +>- Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. +>- If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. +>- If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. 2. **Apply Policies** Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). From c5eccb8e9891cda99bcd2b510b7bc2cef0b8ebc3 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Thu, 1 Mar 2018 08:44:09 -0800 Subject: [PATCH 056/119] many editorial fixes; fixed link formatting --- .../olympia/olympia-enrollment-guidelines.md | 32 ++++++++++--------- .../waas-windows-insider-for-business.md | 19 ++++++----- 2 files changed, 26 insertions(+), 25 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 7fc29c58f5..c44e3b60c4 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -6,14 +6,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 10/10/2017 +ms.date: 02/28/2018 --- # Olympia Corp ## What is Windows Insider Lab for Enterprise and Olympia Corp? -Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release Enterprise Privacy and Security features*. To get the complete experience of these Enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. +Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release Enterprise Privacy and Security features. To get the complete experience of these Enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. As an Olympia user, you will have an opportunity to: @@ -23,15 +23,16 @@ As an Olympia user, you will have an opportunity to: - Provide feedback. - Interact with engineering team members through a variety of communication channels. -\* Enterprise features may have reduced, or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. +[!Note] +>Enterprise features may have reduced, or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. -For more information about Olympia Corp, please see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). +For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). -To request an Olympia Corp account, please fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia). +To request an Olympia Corp account, fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia). ## Enrollment guidelines -Welcome to Olympia Corp. Here are the steps needed to Enroll. +Welcome to Olympia Corp. Here are the steps needed to enroll. As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade. @@ -45,9 +46,9 @@ Choose one of the following two enrollment options: ### Set up an Azure Active Directory REGISTERED Windows 10 device -- This is the Bring Your Own Device (BYOD) method - your device will receive Olympia policies and features, but a new account will not be created ([additional info]).(https://docs.microsoft.com/en-us/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) +This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information. -1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). +1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). ![Settings -> Accounts](images/1-1.png) @@ -66,7 +67,7 @@ Choose one of the following two enrollment options: 5. Read the **Terms and Conditions**. Click **Accept** to participate in the program. -6. If this is the first time you are logging in, please fill in the additional information to help you retrieve your account details. +6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details. 7. Create a PIN for signing into your Olympia corporate account. @@ -81,9 +82,9 @@ Choose one of the following two enrollment options: ### Set up Azure Active Directory JOINED Windows 10 device -- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account ([additional info]).(https://docs.microsoft.com/en-us/azure/active-directory/device-management-azuread-joined-devices-setup) +- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. -1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your PC (see [local administrator](https://support.microsoft.com/en-us/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). +1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). ![Settings -> Accounts](images/1-1.png) @@ -106,15 +107,15 @@ Choose one of the following two enrollment options: 6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. -7. If this is the first time you are signing in, please fill in the additional information to help you retrieve your account details. +7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details. 8. Create a PIN for signing into your Olympia corporate account. 9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. -10. Restart your PC. +10. Restart your device. -11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your PC will upgrade to Windows 10 Enterprise*. +11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise. 12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. @@ -123,5 +124,6 @@ Choose one of the following two enrollment options: 13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. -\* Please note that your Windows 10 Enterprise license will not be renewed if your PC is not connected to Olympia. +[!Note] +> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia. diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index ec4bd495f6..3b3f5cb1ec 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -53,25 +53,24 @@ You can install Windows 10 Insider Preview builds directly on individual devices ### Install on an individual device -1. Open [Windows Insider Program settings](ms-settings:windowsinsider) (On your Windows 10 device, go to Start > Settings > Update & security > Windows Insider Program). Note: To see this setting, you need to have administrator rights to your device. -2. Link your Microsoft or work account that you used to register as a Windows Insider. -3. Follow the prompts. +1. Open [Windows Insider Program settings](ms-settings:windowsinsider) (On your Windows 10 device, go to Start > Settings > Update & security > Windows Insider Program). To see this setting, you must have administrator rights to your device. +2. Click **Get started** and follow the prompts to link your Microsoft or work account that you used to register as a Windows Insider. + [![Settings UI showing Windows Insider Program item selected in lower left](images/WIP4Biz_Prompts.png)](images/WIP4Biz_Prompts.png) ### Install across multiple devices -Administrators can install and manage Insider Preview builds centrally across multiple devices within their domain. Here’s how: +Administrators can install and manage Insider Preview builds centrally across multiple devices within their domain. To register a domain, you must be registered in the Windows Insider Program with your work account in Azure Active Directory and you must be assigned a **Global Administrator** role on that Azure AD domain. Also requires Windows 10 Version 1703 or later. + +To register a domain, follow these steps: 1. **Register your domain with the Windows Insider Program** Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. -To register a domain, you must be registered in the Windows Insider Program with your work account in Azure Active Directory and you must be assigned a **Global Administrator** role on that Azure AD domain. Also requires Windows 10 Version 1703 or later. - -**Register your domain**. >[!Note] ->- Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. +>- Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. >- If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. >- If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. @@ -81,10 +80,10 @@ Once you have registered your enterprise domain, you can control how and when de ### Install on a virtual machine. This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a device. -For guidance on setting up virtual machines on your device, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). +For guidance on setting up virtual machines on your device, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/). To download the latest Insider Preview build to run on your virtual machine, see -[Windows Insider Preview downloads](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewadvanced) +[Windows Insider Preview downloads](https://www.microsoft.com/software-download/windowsinsiderpreviewadvanced) ## Manage Windows Insider Preview builds From d3f0a2a9fadc11faad285d8d691f04ccce93243b Mon Sep 17 00:00:00 2001 From: jaimeo Date: Thu, 1 Mar 2018 09:07:25 -0800 Subject: [PATCH 057/119] fixed more glitches; removed a bunch of en-us --- .../olympia/olympia-enrollment-guidelines.md | 6 +++--- .../update/waas-windows-insider-for-business.md | 14 +++++++------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index c44e3b60c4..b62d56b89b 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -38,9 +38,9 @@ As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Ent Choose one of the following two enrollment options: -1. [Keep your current Windows 10 edition](#enrollment-keep-current-edition) +- [Keep your current Windows 10 edition](#enrollment-keep-current-edition) -2. [Upgrade your Windows 10 edition from Pro to Enterprise](#enrollment-upgrade-to-enterprise) +- [Upgrade your Windows 10 edition from Pro to Enterprise](#enrollment-upgrade-to-enterprise) @@ -124,6 +124,6 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi 13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. -[!Note] +>[!NOTE] > Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia. diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index 3b3f5cb1ec..261e6495d9 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -35,7 +35,7 @@ To get started with the Windows Insider Program for Business, follow these steps >In **Group Policy**, this setting is in **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds - Allow Telemetry**. In **MDM**, the setting is in [**System/AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). -## Register to the Windows Insider Program for Business +## Register in the Windows Insider Program for Business The first step to installing a Windows 10 Insider Preview build is to register as a Windows Insider. You and your users have two registration options. @@ -43,7 +43,7 @@ The first step to installing a Windows 10 Insider Preview build is to register a Registering with your work account in Azure Active Directory (AAD) is required to submit feedback on behalf of your organization and manage Insider Preview builds on other devices in your domain. >[!NOTE] ->Requires Windows 10 Version 1703 or later. Confirm by going to Settings>System>About. If you do not have an AAD account, [find out how to get an Azure Active Directory tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant). +>Requires Windows 10 Version 1703 or later. Confirm by going to Settings>System>About. If you do not have an AAD account, [find out how to get an Azure Active Directory tenant](https://docs.microsoft.com/azure/active-directory/develop/active-directory-howto-tenant). ### Register your personal account Use the same account that you use for other Microsoft services. If you don’t have a Microsoft account, it is easy to get one. [Get a Microsoft account](https://account.microsoft.com/account). @@ -66,7 +66,7 @@ Administrators can install and manage Insider Preview builds centrally across mu To register a domain, follow these steps: 1. **Register your domain with the Windows Insider Program** -Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. >[!Note] @@ -75,9 +75,9 @@ Rather than have each user register individually for Insider Preview builds, adm >- If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. 2. **Apply Policies** -Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/en-us/windows/deployment/update/waas-windows-insider-for-business). +Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). -### Install on a virtual machine. +### Install on a virtual machine This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a device. For guidance on setting up virtual machines on your device, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/). @@ -274,11 +274,11 @@ To go from a Preview build to the Semi-Annual Channel, use the [Media Creation T ## Unregister -If you no longer plan to manage Windows Insider Preview policies for your organization, you will need to [unregister your domain with the Windows Insider Program](https://insider.windows.com/en-us/insiderorgleaveprogram/). +If you no longer plan to manage Windows Insider Preview policies for your organization, you will need to [unregister your domain with the Windows Insider Program](https://insider.windows.com/insiderorgleaveprogram/). Unregistering will not allow any other administrators at your organization to continue to set policies to manage Windows Insider Preview builds across your organization. -Your individual registration with the Insider program will not be impacted. If you wish to leave the Insider program, see the [leave the program](https://insider.windows.com/en-us/how-to-overview/#leave-the-program) instructions. +Your individual registration with the Insider program will not be impacted. If you wish to leave the Insider program, see the [leave the program](https://insider.windows.com/how-to-overview/#leave-the-program) instructions. >[!IMPORTANT] >Once your domain is unregistered, setting the **Branch Readiness Level** to preview builds will have no effect. Return this setting to its unconfigured state in order to enable users to control it from their devices. From faadb2f3198fda3fce3e320e1c3318caec2986cc Mon Sep 17 00:00:00 2001 From: jaimeo Date: Thu, 1 Mar 2018 09:40:27 -0800 Subject: [PATCH 058/119] still more small fixes and updated TOC --- windows/deployment/TOC.md | 1 + windows/deployment/update/WIP4Biz-intro.md | 8 ++++---- .../update/waas-windows-insider-for-business.md | 15 ++++++++------- 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index c2d63ceca8..df889e6bbf 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -224,6 +224,7 @@ ### [Manage device restarts after updates](update/waas-restart.md) ### [Manage additional Windows Update settings](update/waas-wu-settings.md) ### [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) +#### [Introduction to the Windows Insider Program for Business](update/WIP4Biz-intro.md) #### [Windows Insider Program for Business Frequently Asked Questions](update/waas-windows-insider-for-business-faq.md) #### [Olympia Corp enrollment](update/olympia/olympia-enrollment-guidelines.md) ### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md) diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index 4623481b66..08b8659f6e 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -7,7 +7,7 @@ ms.sitesec: library author: jaimeo ms.localizationpriority: high ms.author: jaimeo -ms.date: 02/26/2018 +ms.date: 03/01/2018 --- # Introduction to the Windows Insider Program for Business @@ -35,7 +35,8 @@ Microsoft recommends that all organizations have at least a few devices enrolled The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. - +[![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png)
      +Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. ## Explore new Windows 10 features in Insider Previews @@ -57,8 +58,7 @@ Along with exploring new features, you also have the option to validate your app - Deploy Windows 10 Semi-Annual releases faster and more confidently - Maximize the 18-month support Window that comes with each Semi-Annual release. -[![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png) -Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. + |Objective |Feature exploration| |---------|---------| diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index 261e6495d9..52a170184a 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -66,17 +66,18 @@ Administrators can install and manage Insider Preview builds centrally across mu To register a domain, follow these steps: 1. **Register your domain with the Windows Insider Program** -Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.
      **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally. ->[!Note] ->- Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. ->- If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. ->- If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. - 2. **Apply Policies** Once you have registered your enterprise domain, you can control how and when devices receive Windows Insider Preview builds on their devices. See: [How to manage Windows 10 Insider Preview builds across your organization](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). +>[!Note] +>- The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +>- Currently, the Windows Insider Program for Business supports [Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/active-directory-whatis)--but not on-premises Active Directory--as a corporate authentication method. +>- If your company has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services--you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. +>- If you do not have an AAD account, install Insider Preview builds on individual devices with a registered Microsoft account. + ### Install on a virtual machine This option enables you to run Insider Preview builds without changing the Windows 10 production build already running on a device. @@ -289,7 +290,7 @@ Windows Insiders are a part of a global community focused on innovation, creativ The Windows Insider program enables you to deepen connections to learn from peers and to connect to subject matter experts (inside Microsoft, Insiders in your local community and in another country) who understand your unique challenges, and who can provide strategic advice on how to maximize your impact. -Collaborate and learn from experts in the [WINDOWS INSIDER TECH COMMUNITY](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) +Collaborate and learn from experts in the [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) ## Additional help resources From 444cc522a85bbc6021433a789d9cb846cfa02c88 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Thu, 1 Mar 2018 21:48:52 +0000 Subject: [PATCH 059/119] Changed title, changed first sentence for voice & tone. --- ...ion-management-reference-windows-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index ad3743b16b..a44c4d99bb 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Windows Defender AV reference for management tools -description: Learn how Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the comman line can be used to manage Windows Defender AV +title: Manage Windows Defender AV in your business +description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the comman line to manage Windows Defender AV keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -14,7 +14,7 @@ ms.author: iawilt ms.date: 08/26/2017 --- -# Reference topics for management and configuration tools +# Manage Windows Defender AV in your business **Applies to:** @@ -24,7 +24,7 @@ ms.date: 08/26/2017 - Enterprise security administrators -Windows Defender Antivirus can be managed and configured with the following tools: +You can manage and configure Windows Defender Antivirus with the following tools: - Group Policy - System Center Configuration Manager and Microsoft Intune From 61c363e5c2c0cace9f0eeb7bb664049671c75227 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Thu, 1 Mar 2018 22:17:05 +0000 Subject: [PATCH 060/119] Updated author info. --- ...ation-management-reference-windows-defender-antivirus.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index a44c4d99bb..09fefe72e5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -9,9 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: iaanw -ms.author: iawilt -ms.date: 08/26/2017 +author: andreabichsel +ms.author: v-anbic +ms.date: 03/01/2018 --- # Manage Windows Defender AV in your business From 92d38083696d7baadafc2027bc879c5ac222321a Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 1 Mar 2018 22:43:18 +0000 Subject: [PATCH 061/119] Merged PR 6119: MultiSIM CSP - new in Windows 10, version 1803 --- windows/client-management/mdm/TOC.md | 2 + ...onfiguration-service-provider-reference.md | 28 ++ .../mdm/images/provisioning-csp-multisim.png | Bin 0 -> 13445 bytes windows/client-management/mdm/multisim-csp.md | 58 ++++ windows/client-management/mdm/multisim-ddf.md | 291 ++++++++++++++++++ ...ew-in-windows-mdm-enrollment-management.md | 4 + 6 files changed, 383 insertions(+) create mode 100644 windows/client-management/mdm/images/provisioning-csp-multisim.png create mode 100644 windows/client-management/mdm/multisim-csp.md create mode 100644 windows/client-management/mdm/multisim-ddf.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 1ac5a9f388..ca5fd03714 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -155,6 +155,8 @@ #### [Maps DDF](maps-ddf-file.md) ### [Messaging CSP](messaging-csp.md) #### [Messaging DDF file](messaging-ddf.md) +### [MultiSIM CSP](multisim-csp.md) +#### [MultiSIM DDF file](multisim-ddf.md) ### [NAP CSP](nap-csp.md) ### [NAPDEF CSP](napdef-csp.md) ### [NetworkProxy CSP](networkproxy-csp.md) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 16f80bc1f1..e7ed3131c8 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -1295,6 +1295,34 @@ Footnotes: + +[MultiSIM CSP](multisim-csp.md) + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      check mark4check mark4check mark4check mark4check mark4check mark4check mark4
      + + + + [NAP CSP](nap-csp.md) diff --git a/windows/client-management/mdm/images/provisioning-csp-multisim.png b/windows/client-management/mdm/images/provisioning-csp-multisim.png new file mode 100644 index 0000000000000000000000000000000000000000..86473079f4eef12f8df06c8861fb74e7361b9476 GIT binary patch literal 13445 zcmch8c{tSl+xAEyLUL!xR#Yn6lp^c66B3b>HO3Hzat$IvT9ZCzv4+2&?9e z>vtfK1K|(|-B+dq;G2BGBh%n7I@BGFYmkCA{weU`pzWWx{)9k^V_CKkhrs8<&Nqxv z5C~fx?GIfOGUovVa`}Yj^*`@EHlG_>KyezT<}6YdC~9Q2_aE+ged^Bd%)(ZXl3u<0 zeD{Xg1|A zkI&aAbTnvQJR}NN>DMM#m%wCY%dyz3T5$+Ori^WQv?-QFANOr5WKFWx<;S4YMIRmI z<)sKb;?9-A6#q7bO(8!jr9xWXJ-?{5^j+NyzI0n(i^f`tzxk$2>pNeP z;^s9OnC~`OyUgSsToMvk5kjc0tdzfar8Zz)ZBF4*UFQUQ+Jbw*xQvWUCpRnPq(L;a zu&@xGRK3zaHBpMJKavq`Bp)eL;=};qyNhm+HD1g&@U82rJtVE&!ZAahk+rRs5`?Hk z-9;~uHg`t91$5U^J>+$qN)q@wWhfq%zvAV6pB?o7E==C4UuDu)*0=I0fyI^*=3Pq(&;|HEfDJxuF z2ylvw>CX`~7xLm?E8!lTywx#*h+N)CGHbicT}pS-<`R+Jzk2s4w*aGNns%|liRLc@ zCcg%4a;mU$0-?CY_(9)Cg?|nXFeOvn{viJny%nmj@WMB4xg}HO){sOA{k-EMRd3Ti z4dvKBT(ycrE3A$+b1sM-h8$(#CFk;rQqt-ZSQKD_t-ODkYI8qof(tHm#N;lvh+orI1QC?17a$X}>ktc?c-x^7%%B5~Dgj?bw{BoVv% zw)C^gInhsAc|nKZMT7oxgfM2sqVdMtCsn01qbPsGX*ls;cM_NXFgZ_AVdLX|t|e0P z393=U<7qwnIF{K@uvFJ%U5e8+qc@$3|tq0{gkbimR8?Z5rwt9?py6b`IkT;!fk8;OZne|N?F-E48yQ$ZWgu|}2I@wy=spN<`zeA2b_ zH@|n**Wce?A^qO3e9mEI8XTmO&64`LQ>)K9mpNx|kKXpC3`QuLL>_&XD`d=%Egpx`tF&^>CDeugh;)oikx3$9zJvW{vYMOq{}ig0uru=#5F>1ZSH1`mHKMx zAqv)dhxADWyBr4!p)1*JVRF;Y4R%!zJrh$my~wCs6YbZZUA|pon)ZBDgNuu+y6`ka zMf?HU(9p1n*?7*Upzk`|dam#EuQPVfw+wq-%@wxq`@22~pt3+l&eVzD$IC5;wXZ!I z_9}<{ykaeUHb_b{c??hJmUf%k#^FA!t5M-z{K zf8_A?7mO`nx#bhz^yppJ0y2`wB?R*q-)YRMy$XSJUk~La5L~T$(vzjwhYW=1Ar`y{ zr!Xizq%sOxu8O9En5m-&P7xu2k|M;pqc#wgL=LhClQiT_3lmBqm>2TZIv6KFI0Bix zL>OcP;l=Hrygp@u?&c++PdTv7N2Fq!Xh_@ zzYc=w`4Hx&rY*P3NU*K9-3(dfC1AkB*O8^XD(zsSmh7l96Zb4sVOn42y&z3OwZ{f7 zB6sm-=G!(d$jSkPlPCoW-!~m4i+JhHF!<|NE}eY`0?khn=j!>$U0q$p*9^q|3~05$ zVU61!@_F{YPPy%z$gS7>c`-tNn+hJ?rFB4u7}n z)AYF{%X}I9{eCBOT^w6zpVE)nK)jifStQi+*Uh}PhdYEXU!KXMAYaXbaVb1?)kQ_l zu3O<;fs(Pwji>Z(<6q5RmE$1%S$ucy95E=aW&HaMgJIH2Z;W|F7xh;p@u|=PMw$^a zq=p`dxJb;rGxh89pArx=L8<5^SC==wmKix#k2CJ?bW8o&V!oke3M-i3=&iXU(bVer zrpooFDbm^RfP%yJ%M}|Eu4t{>b2w*zFgv#8fc$N|DSNW}}jX$1s<7-->Gv%x7Q}60m4|EJRj=9f>S;6|x>YHmK z$#ctvgJ_BOQU@TDl7zuC%gf6e_zgp_;8c|p;{zWXTr(=L1b!n<4MprWSZcNBVszEo z{QkzP9{BlfKafmMTi ztBs$w$NAJ;`w-do+Ba9;By$oG&?L)Ou9K_1w?0(!4+#@V*3;hlrlkftqvuxyup2ik zm4J&#!sPVw4Z7^;1LuW_LnRdzkNrm~66ns_?cAk{cST0qtb z64ov%B=F!#VoiB*adBzs-D%ZbN>_?mnA5Y}_pzJL)=l*?@90fHAjh6U>jopH4sqBl z!dEXs-dF|mk^!RC$3W}&5e$L795!eXBIKw7;Rp%`{CmMwFIFE|~dRT@Ltjt05d-bI6SoOs9n~ zhr>M!#$$Y`n})hdn64*NJK=a9vkOr#$bvZ?^dB#Q(PRkXT(*X1rE0t=ha}jw*=^gK zZFS6*T{pv!U780hz&Nv(#Uf6vFyuD1rSz!Z*>NFE@}Qt#SADeeUTB60K<>T{s^&9-cZy_x!I_LYv3pIH$Tsv$=Bnmkj+U z;ks<%2)@KuiDBwrK8=2U(!Fq}jH{Wud?qY@pz8|i;trhc3G#0F;|>#3RZrA92lV3w za2=}8W3Qv(8)KWpsa3;2qb9s53@D|V^iC?Dwaa$2lizk%$$edn5kt98hye%dET_q; zwmC*C|g<_&T6IZ+{IP8Dc{HXb5)N?671VDwC7*e}FiZ zD%8OEH42&`!tJD3Yi^EP{gusTOGxVV-0+fs3?%_VI{22mlB!X;RW;@jV8=JuDpBC+ z-p_~6_-PTwHc%l};mb}k$iSlu+Q1z}Mn+DHK~x5rq>mvUH3AQQ%N1Cl-SO(N!ML&0 zqP_&uULtSpYIP0A>SvEot}53ngW*ow1wSy%VS~dG)tMOSSNM;}lmoM;h&O^6VWiz( zk-y#+X^99M!WX_Ae3t2$;q|HF%fRXzhVMpFrH11h6pPNMBIRM%NRKNU%|1P5L~gRU zIMNL@c&&Dpc-cM)usT>21{L9`XV%WED`jxAdfQz!{}4G}xxk8<`Tpq;rpL7M^ZTL~^B%hh1C!{jcO@A>ty$8#y4mm>Lj* z(_?f40B%j0Q1W5W4As5WWTTj*<*)yHU*6%c5iK`vVSU7B_3D$WW69a9%kfr>e)-d7kn4d(>rpQQux?KUIyh#2XxhBfZzq zY4UMl$3Ulq1637QZKY6lDJcaFS#{i;%@lR>Ra<4Gwg@WQw;dJKFzcXBd-r0 zUlbo%&*W(GK`8m_zWTlX@iI-)^$5M%luSnP5%iG&a$+Fy_-- z!1E*t>Wo=o#)X8Xt3mG0KZI%AJc?j&;D|K) z);XB6TM2ML=d34YD^W|xet5e|G5SGh%L%p;qms}@3F}#e6IDEzSAh|{u}G-yAX$;7 zpW&1Z42i3!h`n+&yJ6b`SB_bk@sou{2+rl)+7DBvl8T`vVo)d@;et+M^fBM@0 zVIaWd0zAgogHTmTwde@KRfIatytVGr68l~F{C#Rn^4~vabPxhNix4A1 z?f^5#0;0nJ9%ex>SOoqzKZ1!03^2e0&#Xj*gdB1wLqvepo+*GvB3Jq%+Sy|H!St?e z2l4d>QcePgxEPuQ-|W?>EA+b_wl}rT#J+(YCA+a9)c+q}Qfw_A;0)YKqfG_(O}^o} zBT|}yy>DlKh!sOLV@p}9tNMUZ8qvY7#DIl}T~bE}InriUkRZ0GCS}c;@)3?W(1T+* zMFj6z@X=07D9o6Fh<`LkxhhOdvb^<&;Z6^}R)TMqBpLl+rpgOZu#h#JnR*UQoc-$S zH_@kZD+AloM^4XU{k`B8v8MTOXwxO17;@>tPO+{C@xy~p9$&tZtSE_ibNiak+<9-$ z=8P-X=FjL0bSS-8JL*}rTOOpc`E=l^E=QSJmAzQlhpWN70>WUOQtW<(t6h(GCNw&v zQr2-?fsaLtEEDLG(*&4E10D@|$_^%|u=l(bFXmu3cliQ)=lydW3xzH`@>w?1ReI67 zZ|_qRYiMhQp@!o3ugai4?caHDW-YecbvbjESf6vrs_1X0XvW9szpj;_jg@PIR&lJ> z@!uyics?v6M)#9^4gLBR>-+!q{b1-OVn&gu>lZ5rT`HP3sr02ADJJdc4Kz5c-R9bd zs!VvDc=83QL$Z=gm{&3~3|hD{XrelQVWi~~Ez`oj)kUGV!qZN17%Hc**!MH;sWx1@E$Jk2^5Ab9AF1*^ylv(0Z=NFe z5lF)SyJqi6(|0#O(!N^wC!rRH!)0ck*}3A-3$z5&JQ`8;4OsI)T#z;RY)(x1?jL)= z3aPxYGzWT4zyY+N-$1gjr$A98vN1501EQ@L) zsa;n`TvGBqCw+YoaM50-<;KRwo?&ev>e3pZC>icgrkZJVeVMZf2*c(nr)YV8(HRQV z5OZ(BWPaCo$3CA`yL|#y>%G=J$2YA=mqMGdILtWjWv;8`L~k!6EMWnof5?r70D#Kl za7$k^*UEUH5wD7`dAPgZOM!m;gLZlsi7#(jTRz$<>u9$-GnvRM-Xqh(>p0q$Je;!G zK#aBn8L~cY>P9GReQ_rYzM|Pn%Y^&06x1{vwKdTV50>kIVmVz(r%rRZC`9Tj7YaK* z=gP^r=jXd0Edy0}E+}q%@J*GU7=pyRsQg-Ky>46K@8|C$5_*bR63ZZ`-NsyTAjp+x zixPogF@C=lu=M?43lx8AKq^>N?r0RClQ&Pq6c}k@?1z%CAT=von(ZL}{>VU;2ZTAi&l?JzM*`TyFk1&^fmD;U(QT@a$*8WXa&}3z#MSu`) zXg9auhoj%d#J0_j=XtliM1zNXXR0YyWBA*Nzld>uj+Hz7=BzzZx5KpV? zy5c{s_{K#0In%hC*8zE&>sYdvoa_g66k_&hfIrAFP598ML?Gr`FW1q`RQjM>)SefV zO#G~Kby`|#%2)`$@G!-qQiic@PFc>s9`|ZuO;Ok!+)jfzIs_!1ccwJ-Ld4q8M#T}= z_yy&9HI_d$5Mlf-{@cwH{gknGklc@Orh2+|G&IxVmvZ3xQJark7({_79L_B!qZfV$ zj`QEtSZt<_r{bK$sgD{qnDC`c}BJ z`s?$j{R&qjCA__4-667_S|NQwd6!)%p^N&_`aeJenI z$2M-FtLvV-QxRa#AUiHcoG0#5A0q~-BdsM;595H|A>5wGEV3tu9L4S>5@Z>NVB@=9 zrvu0|IR!`}3c%k`{v%f%N%FwNub~IRm53M&#?t!ii8nOGF?>0`m0e0gBDW+2yO$O? ziI4zndQ8L;iduuHcFJjcRIMB3u6>QBEubz(1!JN^TD$QkjEGV{2IR1=(vph z_fI8yDkWjs9?1=FanL0Fi6h_kSJnsxCmpSjVL~5&MW^82CF}gi7_45Jv)@w*KCEAat;pT=`R=+j`PUd(+u^G9P_Dpt(LO11_iyQq ze64Eme>Wt^IL#OCSv0okfdULf;^+-wmHlCiwil)gRLghff8AOae2)~Ne1xLf zBXsp9P)pw*1OR!^A)9aL^9I9a=cNGEZ@F@z?yYw}(z%6k+av z{Jhsss?X8+*N~<0$dBYNdaJCZif#k=8>zFNi8XRE9+Tfhb{yNXY1v*dP63o!mvnSk zRGu`>6};MTw=2Hr9No`~?H8?>UM;UW%%1m7wJC4m2kb&Ks(}}HyP+)`$KDOkzXEti zlHdK%4LNI960qKo%d3$hef_sz*#prIlv*U{wZHF|THV`@M(nmvRTro-P#72`_Rjx5;h|4yRO!VOUU>#Knn>>DBZi5E+6)J zovWh(C#a5ac%T1Nhi#dJ-(?Ud&nWMLB8#Vgg+yDpyln4@J;EbF$N&hic zLj75rT*s}^z#Y3@h^>)Q_ianTcr8+G(;Y(h_ILVdOIfC}+hxOJaK#b)^k^;N816Sm zt?LCs<6?uz4n|r1)gG1{u?m)J-8;?Di-gxUd&p78gV2%Qn->uU&F0%<6wBuFioHa;NQ^d20v*{ArylWJ(% z+5qLY;6{WN-wp0-b_A7%{zkM-(fxtEi1X18R;%I_!E}+(x?UaT5{CzJ8ICVFZTBh| z?ePMykf-H*4L|(Lpt>o)5Ou4p0!dJM5F5ZOx+$OQo^fcH3x0XXw~5%FM}W`9E3PkK z%@b>9hM8w}6qir3+&=XQ)A1-n{_(c)Saf)maH<+V{_@CUsl28IO-`GSl7u5x=IGta z2DLOso3;Lp8>KF9}2BJQxVqw2e!YClb3z)pPZE5r>E%w@%eRL2*2J@=;f}@)&g-WqozrrE` ziK8VxFT7EaB3>>}xdD2(NdX~K`HJbDb+tX=jk z)e|osDV17b^W!<(o-W+;fS3($5w$PqM~$N)ak?(+if7I%pd#&Ltl;Uw=jOxuDI4i; zv9iOfovMBNs36{We7UOb`H<-#K>bkwq zX&Ztli!nr3nH%*$y;aTj?_tIFhwUyzB;0zL_=Jx;_}(o(zNeXkCTJ~@m>#u@pEC1% zW;fQ^^*G$iKM&{*NZKZceUSN=i%g2J|9uX?q}l-Tnf-^z_fH>;6eEHGPacoLe*1D2*J|Q)d!RRe|6n{+&}s4CfzXqWoznScS6OZcY@CM%P*aGu zKkUnZ_P0j)_<5;A^&ywda}5p~3r0{R!`9V_C$?n9Ido7aK_7u7s1-S6hZuM3m{pMO z3x25(BZohDcBm9@d-AWKj55-xQnPv9!8yBF$NPp-(Zpjm78AgKJ+|H-DOo>u%yIrf z%&j)Of+F>MM4CO_B;oR%epkQQ?0)>4xoAEeSZ`8ays3-V0L-M5Eq%_?cENAvE1V6x zVzh=l63pA13*4w?)7sc~vHl8u+Lj563isKg4L=mVq{q1*3B9db@%YWgZ2^f#Vd3_p z=}_ci@%=9h9#9ZZE*7A7-AGf5&x~WrkGU5fx2L`^TPc|%Q4GGX9?tj6@CeVb(?^&8 zG9nzAwE#ABU4JiE*yz1G0)!+RUHg*icz!07K5po6Fs_S@V<4GO9nu6gw|7ETb+ZOV zMv_xyTLB=A`x&CK%r9JcDNzs_W?=^j+O?z z%HQK-jS}?3Yd*JfcAEcaTa@T8O&*q2iNKC2Pr){ zGYwsy9a2$|<-0R`RBGg@sA%mMyW#EU%JZ?dJ~L!41l!gx>}$|k zMsdlO^8cQ^ht4ba19k$4OV`|Hpj8d|q8=?`oa+8Sc#OFB`~fRaLFzyRpe0EW3BH z=$-XX4u6m6bzT8<4A5escMNo`XD@AuN);h))9803G-HAZ6~MY@=96-SLHNIYl=Gh$ z@;4M{Cu+=jFoyuS*V`F2zG*3_xJko2aKm>Ku z^4iTTXp+=bs)Ijzsx1l>?1FO#hkQI~%@56x5t`~V8$xYdX=-bsfa+Hxa@_AzULK{$4y@5z-asg;WrW0^M&)UaZ0lWGs zf_oZhgE|^X^xytAxlkqptw{kL1q$&n{Zy&k=Lg+re5PKIEF?Hc9s4d+b^)r1RuWBX zCWj>^By{E;kf%}I5!U7BqPmh~9XndfljV@&MLF}_`dyJjH$VZQ_m~wL)Ae3D#b=u+ zDZ#LP<#&6nOkXU65#sxGf1fY{&! zpUj^BYmnDdoqEb~uU=QrLk6WzP|PV~Sn+t$G7PF1VvahhXxNtU@{gv?e~6(VAN(w5 zNO|q6Zm)tA^)-{%&+B@oGfGO}^#9!Udb>_ar}ZkR`0q)rfE5`V^R~jj9{9Q(!B$d5 zx|djidb+b?In90;CR2pRUo29s|MvPdz8H&Be36S>SPjR+j=!#!M+MRff*;m8s)UJn zIh5`nmCwCKS5jn^Yu+AuGr<{!sm_1TTgfcYE9f0g8v3|nKC~@xZS4yS+5BmV>awYi zVU_59??EJ_7xaSkE=^~9UPoIcal^!G_tH9V1t+(e(H=v|2Tw6$U(d{gn*WWw{y*`C z{H>d}1wH&d-qZ%XwR!7|BkW!dVFSMKmTx@GNom%tfMmSxFd{uy70{l|(euMWmbkI= zQ^^|rl$tmybW5;rD83>Sm45qnwh)j@gWhqrNEI`6)NZc%jvQX57!dQ-m93uiZ_yf> z?~$z3HJGHoGBWGqXyW^cuLE`hHpo*m$i&Tq{+BRn=<;Pj)J)&a>Z+>?_j`S2s*s&_ z^ifA`-mnkWcuv$rA|J9&&K(?ie`{N~WM}z%K7pS!Jj~Pk$r0tph?J8wY>tjzJ??dk zY&qWv4C?Q9KV$mZ9)I64v{6q6y-iT}Xj$|(U@$9T3k#&3lT~mry5~6vT$B-*2L@<; zZqnAyPi`Q~A5N-+^KZ@1=gFI@FoI>vjvboIEvB_c(dzD7KbLEI3UqUq_iTI{bX?Uq zJ6?OB!b0DH0j+^au^PM7jnKmUlHld;zIo zKWcN58FZ=92lIvlEn@|;C!j)%lc6K&f^`r5d5^>{L!s;N=B951_3Ev_qXH5KjYg4mlT` zq)7nG<~Eb`^I(wIy*X-g_Ar1fm8lNsUIdK7UL;Ks^xf>fxm0pyp=-m6OO4vmd`=gK+Y`+k^m$!DYu`@=+Tgxu~$8RwBAao1SQ%9=Ju|cge|# zI8PK{Ma)YOj=W*quxuFQk9F1?yk|FQiFDTTYwr$wwCXIU>+>vYZam#U_k^NO)zd!& z*2bIdw&qR=6XP~D6xGIdOgE%u3U(9KZ9sdu5q4vkFTis>>mf?K#CGy83ae~r9Og1F z!|sJr{u+-@%p2oOhD|A4Va!U3JcOKVrr8WwnbAubST6p|lKcCrE%Pr`TRkV!wAA!s z@YB)#aHqn;DEh+FrFb7ASyyjzTy2ZDrj*kLQk46ln2OPLviG}^3i5y(o1uI?>k*GG zJo9(C*H{;+|3*Iju)s}FjTIDRN?rSv<7Z;VhxETwc4ou<(VwjIyi5@Esf^q%Qk zxUB=iW7K3=5NF9Yi=BgsfOa}%OHlNcTy1N&a5R&A z2?oSVg7YuCyiGbA)zt=>yf}$yX3eW%kJ>+8xb2QnZvFObP;{k})FzR3cPQp@ieCCX zj#VMyrh(d*+e2w@oPu$eN7kjpmpXVBZS!^`>bbnCc5GvTx&=14lj&g71ej&uI)_c; zW7=1-Q0d0KlM7C|CuBIbyPyv?v~T`(g2j7d*gq0uKT|`TIvWU|7gu;Lwm8Q6_V{^n}|ap0mBW8{nry5KT3m>jl>= Gp8OvgG%= [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +The MultiSIM configuration service provider (CSP) is used by the enterprise to manage devices with dual SIM single active configuration. An enterprise can set policies on whether that user can switch between SIM slots, specify which slot is the default, and whether the slot is embedded. This CSP was added in Windows 10, version 1803. + + +The following diagram shows the MultiSIM configuration service provider in tree format. + +![MultiSIM CSP diagram](images/provisioning-csp-multisim.png) + +**./Device/Vendor/MSFT/MultiSIM** +Root node. + +**_ModemID_** +Node representing a Mobile Broadband Modem. The node name is the modem ID. Modem ID is a GUID without curly braces, with exception of "Embedded" which represents the embedded modem. + +**_ModemID_/Identifier** +Modem ID. + +**_ModemID_/IsEmbedded** +Indicates whether this modem is embedded or external. + +**_ModemID_/Slots** +Represents all SIM slots in the Modem. + +**_ModemID_/Slots/_SlotID_** +Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is "0", "1", etc., with exception of "Embedded" which represents the embedded Slot. + +**_ModemID_/Slots/_SlotID_/Identifier** +Slot ID. + +**_ModemID_/Slots/_SlotID_/IsEmbedded** +Indicates whether this Slot is embedded or a physical SIM slot. + +**_ModemID_/Slots/_SlotID_/IsSelected** +Indicates whether this Slot is selected or not. + +**_ModemID_/Slots/_SlotID_/State** +Slot state (Unknown = 0, OffEmpty = 1, Off = 2, Empty = 3, NotReady = 4, Active = 5, Error = 6, ActiveEsim = 7, ActiveEsimNoProfile = 8) + +**_ModemID_/Policies** +Policies associated with the Modem. + +**_ModemID_/Policies/SlotSelectionEnabled** +Determines whether the user is allowed to change slots in the Cellular settings UI. Default is true. \ No newline at end of file diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md new file mode 100644 index 0000000000..ccdbecbaee --- /dev/null +++ b/windows/client-management/mdm/multisim-ddf.md @@ -0,0 +1,291 @@ +--- +title: MultiSIM DDF file +description: XML file containing the device description framework +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 02/27/2018 +--- + +# MultiSIM CSP + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +This topic shows the OMA DM device description framework (DDF) for the **MultiSIM** configuration service provider. + +The XML below is for Windows 10, version 1803. + +``` syntax + +]> + + 1.2 + + MultiSIM + ./Device/Vendor/MSFT + + + + + Subtree for multi-SIM management. + + + + + + + + + + + com.microsoft/1.0/MDM/MultiSIM + + + + + + + + + + Node representing a Mobile Broadband Modem. The node name is the Modem ID. Modem ID is a GUID without curly braces, with exception of "Embedded" which represents the embedded Modem. + + + + + + + + + + ModemID + + + + + + Identifier + + + + + Modem ID. + + + + + + + + + + + + + + text/plain + + + + + IsEmbedded + + + + + Indicates whether this Modem is embedded or external. + + + + + + + + + + + text/plain + + + + + Slots + + + + + Represents all SIM slots in the Modem. + + + + + + + + + + + + + + + + + + + + Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is "0", "1", etc., with exception of "Embedded" which represents the embedded Slot. + + + + + + + + + + SlotID + + + + + + Identifier + + + + + Slot ID. + + + + + + + + + + + text/plain + + + + + IsEmbedded + + + + + Indicates whether this Slot is embedded or a physical SIM slot. + + + + + + + + + + + text/plain + + + + + IsSelected + + + + + + Indicates whether this Slot is selected or not. + + + + + + + + + + + text/plain + + + + + State + + + + + Slot state (Unknown = 0, OffEmpty = 1, Off = 2, Empty = 3, NotReady = 4, Active = 5, Error = 6, ActiveEsim = 7, ActiveEsimNoProfile = 8) + + + + + + + + + + + text/plain + + + + + + + Policies + + + + + Policies associated with the Modem. + + + + + + + + + + + + + + + SlotSelectionEnabled + + + + + + true + Determines whether the user is allowed to change slots in the Cellular settings UI. Default is true. + + + + + + + + + + + text/plain + + + + + + + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 4ff04b5dba..46bd55a93f 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1436,6 +1436,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

    Updated the AssigneAccessConfiguration schema.

    + +[MultiSIM CSP](multisim-csp.md) +

    Added a new CSP in Windows 10, version 1803.

    + From db84b10467d243b3d1d90b8c52533f3a51b599c8 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Fri, 2 Mar 2018 00:14:42 +0000 Subject: [PATCH 062/119] Changed topic title. --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index fdfc93411b..5734a9da08 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -245,7 +245,7 @@ -### [Reference topics for management and configuration tools](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) #### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) #### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) #### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) From 26c7dbceed80822f52fc7e2235ee5579550fa84f Mon Sep 17 00:00:00 2001 From: Eric Scherlinger <35633680+ericsche@users.noreply.github.com> Date: Fri, 2 Mar 2018 13:54:38 +0000 Subject: [PATCH 063/119] Update wcd-accounts.md Replace %SERIALNUMBER% with %SERIAL% %SERIALNUMBER% does not exist and if you use it the ppgk fail. in WCD tool it is %SERIAL% that is documented and works. --- windows/configuration/wcd/wcd-accounts.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index 5be53d2953..2df8e81ee7 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -42,7 +42,7 @@ Specifies the settings you can configure when joining a device to a domain, incl | --- | --- | --- | | Account | string | Account to use to join computer to domain | | AccountOU | string | Name of organizational unit for the computer account | -| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIALNUMBER% characters in the name.

    ComputerName is a string with a maximum length of 15 bytes of content:

    - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

    - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

    - ComputerName cannot use some non-standard characters, such as emoji.

    Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](http://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | +| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIAL% characters in the name.

    ComputerName is a string with a maximum length of 15 bytes of content:

    - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

    - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

    - ComputerName cannot use some non-standard characters, such as emoji.

    Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](http://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | | DomainName | string (cannot be empty) | Specify the name of the domain that the device will join | | Password | string (cannot be empty) | Corresponds to the password of the user account that's authorized to join the computer account to the domain. | @@ -55,4 +55,4 @@ Use these settings to add local user accounts to the device. | UserName | string (cannot be empty) | Specify a name for the local user account | | HomeDir | string (cannot be ampty) | Specify the path of the home directory for the user | | Password | string (cannot be empty) | Specify the password for the user account | -| UserGroup | string (cannot be empty) | Specify the local user group for the user | \ No newline at end of file +| UserGroup | string (cannot be empty) | Specify the local user group for the user | From 8e180c493aad40d08eecad5f9ec63d5702c58412 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Fri, 2 Mar 2018 16:50:06 +0000 Subject: [PATCH 064/119] Merged PR 6127: Added note about ShellLauncher in AssignedAccess CSP added note about ShellLauncher in AssignedAccess CSP --- windows/client-management/mdm/assignedaccess-csp.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 99f4d3a1a1..554704a16d 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/22/2018 +ms.date: 03/01/2018 --- # AssignedAccess CSP @@ -62,7 +62,8 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps).Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). > [!Note] -> You cannot set both KioskModeApp and Configuration at the same time in the device in Windows 10, version 1709. +> You cannot set both KioskModeApp and Configuration at the same time on the device in Windows 10, version 1709. +> You cannot set both ShellLauncher and Configuration at the same time on the device. Enterprises can use this to easily configure and manage the curated lockdown experience. @@ -98,6 +99,9 @@ Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. +> [!Note] +> You cannot set both ShellLauncher and Configuration at the same time on the device. + **./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration** Added in Windows 10, version 1803. This node accepts a StatusConfiguration xml as input to configure the Kiosk App Health monitoring. There are three possible values for StatusEnabled node inside StatusConfiguration xml: On, OnWithAlerts, and Off. Click [link](#statusconfiguration-xsd) to see the StatusConfiguration schema. From d66a0c4bf4862491ddf5fc4bf1b70ad1de971e26 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Fri, 2 Mar 2018 13:08:05 -0800 Subject: [PATCH 065/119] adjusted headings further and fixed broken note --- .../update/olympia/olympia-enrollment-guidelines.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index b62d56b89b..fadfe3f2c5 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -23,7 +23,7 @@ As an Olympia user, you will have an opportunity to: - Provide feedback. - Interact with engineering team members through a variety of communication channels. -[!Note] +>[!Note] >Enterprise features may have reduced, or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). @@ -38,13 +38,13 @@ As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Ent Choose one of the following two enrollment options: -- [Keep your current Windows 10 edition](#enrollment-keep-current-edition) +- If you need to keep your current Windows 10 edition, follow the steps to [set up an AAD-registered device](#enrollment-keep-current-edition). However, you will not be able to log on to the device with your Olympia account. -- [Upgrade your Windows 10 edition from Pro to Enterprise](#enrollment-upgrade-to-enterprise) +- If you want to upgrade your Windows 10 edition from Pro to Enterprise, follow the steps to [set up an Azure Active Direcotry-joined device](#enrollment-upgrade-to-enterprise). You will be able to log on to the device with your Olympia account. -### Set up an Azure Active Directory REGISTERED Windows 10 device +### Set up an Azure Active Directory-REGISTERED Windows 10 device This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information. @@ -80,7 +80,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi -### Set up Azure Active Directory JOINED Windows 10 device +### Set up Azure Active Directory-JOINED Windows 10 device - This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. From 007ba53bd749048378f382a0c6d576045da9c4a1 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Fri, 2 Mar 2018 13:28:16 -0800 Subject: [PATCH 066/119] fixed typo --- .../update/olympia/olympia-enrollment-guidelines.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index fadfe3f2c5..960b9a929f 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -5,8 +5,8 @@ ms.author: nibr ms.topic: article ms.prod: w10 ms.technology: windows -author: nickbrower -ms.date: 02/28/2018 +author: jaimeo +ms.date: 03/02/2018 --- # Olympia Corp @@ -40,7 +40,7 @@ Choose one of the following two enrollment options: - If you need to keep your current Windows 10 edition, follow the steps to [set up an AAD-registered device](#enrollment-keep-current-edition). However, you will not be able to log on to the device with your Olympia account. -- If you want to upgrade your Windows 10 edition from Pro to Enterprise, follow the steps to [set up an Azure Active Direcotry-joined device](#enrollment-upgrade-to-enterprise). You will be able to log on to the device with your Olympia account. +- If you want to upgrade your Windows 10 edition from Pro to Enterprise, follow the steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). You will be able to log on to the device with your Olympia account. From c3e38ffe79b151d532ebb6dce1bbfb4fa3b3db11 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Mon, 5 Mar 2018 10:02:01 +0100 Subject: [PATCH 067/119] Update policy-csp-deliveryoptimization.md verified with the latest RS4 build the DO settings have changed to a better naming scheme: DOPercentageMaxBackDownloadBandwidth -> DOPercentageMaxBackgroundBandwidth DOPercentageMaxForeDownloadBandwidth -> DOPercentageMaxForegroundBandwidth --- .../mdm/policy-csp-deliveryoptimization.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 1a7ca48cee..94134afb5a 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -76,13 +76,13 @@ ms.date: 01/30/2018 DeliveryOptimization/DOMonthlyUploadDataCap
    - DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth + DeliveryOptimization/DOPercentageMaxBackgroundBandwidth
    DeliveryOptimization/DOPercentageMaxDownloadBandwidth
    - DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth + DeliveryOptimization/DOPercentageMaxForegroundBandwidth
    DeliveryOptimization/DORestrictPeerSelectionBy @@ -1015,7 +1015,7 @@ The default value is 20.
    -**DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth** +**DeliveryOptimization/DOPercentageMaxBackgroundBandwidth** @@ -1063,7 +1063,7 @@ Note that downloads from LAN peers will not be throttled even when this policy i **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** -This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryoptimization-dopercentagemaxforedownloadbandwidth) and [DOPercentageMaxBackDownloadBandwidth](#deliveryoptimization-dopercentagemaxbackdownloadbandwidth) policies instead. +This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) and [DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) policies instead. @@ -1071,7 +1071,7 @@ This policy is deprecated. Use [DOPercentageMaxForeDownloadBandwidth](#deliveryo
    -**DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth** +**DeliveryOptimization/DOPercentageMaxForegroundBandwidth**
    From f98eada4800bc319badedfb530894464a0ef209c Mon Sep 17 00:00:00 2001 From: Eric Scherlinger <35633680+ericsche@users.noreply.github.com> Date: Mon, 5 Mar 2018 16:33:35 +0100 Subject: [PATCH 068/119] Update manage-settings-with-mdm-for-surface-hub.md Reboot the device immediately is now supported in intune --- devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 7e530429bf..735c1a071f 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -147,7 +147,7 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML\*? | | --- | --- | --- |---- | --- | --- | -| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | No | No | Yes | +| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes | No | Yes | | Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
    [Use a custom policy.](#example-intune) | Yes.
    [Use a custom setting.](#example-sccm) | Yes | | Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
    [Use a custom policy.](#example-intune) | Yes.
    [Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. From 16b8330ae34681a99fadc0f8a622c94323f6ee30 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Mon, 5 Mar 2018 09:50:56 -0800 Subject: [PATCH 069/119] adjusted text per PM; fixed reversed acronyms --- .../update/olympia/olympia-enrollment-guidelines.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 960b9a929f..d0f1443d45 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -17,14 +17,14 @@ Windows Insider Lab for Enterprise is intended for Windows Insiders who want to As an Olympia user, you will have an opportunity to: -- Use various Enterprise features like WIP (Windows Information Protection), ATP (Advanced Threat Protection), WDAG (Windows Defender Application Guard), and APP-V (Application virtualization). +- Use various Enterprise features like Windows Information Protection (WIP), Advanced Threat Protection (ATP), windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). - Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. - Validate and test pre-release software in your environment. - Provide feedback. - Interact with engineering team members through a variety of communication channels. >[!Note] ->Enterprise features may have reduced, or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. +>Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the Enterprise features at any time without notice. For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ). @@ -38,9 +38,9 @@ As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Ent Choose one of the following two enrollment options: -- If you need to keep your current Windows 10 edition, follow the steps to [set up an AAD-registered device](#enrollment-keep-current-edition). However, you will not be able to log on to the device with your Olympia account. +- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympa) account. -- If you want to upgrade your Windows 10 edition from Pro to Enterprise, follow the steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). You will be able to log on to the device with your Olympia account. +- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. From b4c335d82a5cf9b0072ca3448fd127098bea4f67 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Mon, 5 Mar 2018 10:14:24 -0800 Subject: [PATCH 070/119] fixed another typo --- .../deployment/update/olympia/olympia-enrollment-guidelines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index d0f1443d45..dea0940ed3 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -38,7 +38,7 @@ As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Ent Choose one of the following two enrollment options: -- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympa) account. +- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account. - If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. From e988832a49d35c7e737169d951f6d84466dd7d83 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 5 Mar 2018 13:04:32 -0800 Subject: [PATCH 071/119] add data protection and encryption --- ...privacy-windows-defender-advanced-threat-protection.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index a15378b6ad..de6f546342 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -40,6 +40,14 @@ Microsoft uses this data to: Microsoft does not use your data for advertising or for any other purpose other than providing you the service. +## Data protection and encryption +The Windows Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. + +Among the various data protection technologies used ensures that customer data is always encrypted. For more information on the encryption technologies used by Windows Defender ATP, such as encryption at rest, encryption in flight, and key management with Key Vault and other technologies, see [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/security-azure-encryption-overview). + +In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum. + + ## Do I have the flexibility to select where to store my data? When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not under any circumstance, transfer the data from the specified geolocation into another geolocation. From be808fcc29247e593c8855f1636061fac77bebad Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 5 Mar 2018 14:16:04 -0800 Subject: [PATCH 072/119] update second sentence --- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index de6f546342..9527ae1022 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -43,7 +43,7 @@ Microsoft does not use your data for advertising or for any other purpose other ## Data protection and encryption The Windows Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. -Among the various data protection technologies used ensures that customer data is always encrypted. For more information on the encryption technologies used by Windows Defender ATP, such as encryption at rest, encryption in flight, and key management with Key Vault and other technologies, see [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/security-azure-encryption-overview). +Among the various data protection technologies used ensures that customer data is always encrypted. For more information on the major areas of encryption, including encryption at rest, encryption in flight, and key management with Key Vault and other technologies used by the Windows Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/security-azure-encryption-overview). In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum. From 3920896b23a318ad173ddb659f34da788244b678 Mon Sep 17 00:00:00 2001 From: Barry Langer Date: Mon, 5 Mar 2018 15:16:28 -0800 Subject: [PATCH 073/119] spelling error in article description --- ...nfigure-real-time-protection-windows-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md index 96199b29be..ab4cd78ac7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Configure always-on real-time protection in Windows Defender AV -description: Enable and configure real-time protectoin features such as behavior monitoring, heuristics, and machine-learning in Windows Defender AV +description: Enable and configure real-time protection features such as behavior monitoring, heuristics, and machine-learning in Windows Defender AV keywords: real-time protection, rtp, machine-learning, behavior monitoring, heuristics search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -100,4 +100,4 @@ The main real-time protection capability is enabled by default, but you can disa ## Related topics - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) From 78d02f6453c9443d19e3080d870876e07cf0c424 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 6 Mar 2018 06:35:12 -0800 Subject: [PATCH 074/119] add threat analytics --- ...ows-defender-advanced-threat-protection.md | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..13b4081355 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md @@ -0,0 +1,51 @@ +--- +title: Windows Defender Advanced Threat Protection Threat analytics +description: Get a tailored organizational risk evaluation and actionable steps you can take to minimize risks in your organization. +keywords: threat analytics, risk evaluation, OS mitigation, microcode mitigation, mitigation status +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 03/05/2018 +--- + +# Threat analytics for Spectre and Meltdown + +**Applies to:** + +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[!include[Prerelease information](prerelease.md)] + +[Spectre and Meltdown](https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/) is a new class of exploits that take advantage of critical vulnerabilities in the CPU processors, allowing attackers running user-level, non-admin code to steal data from kernel memory. These exploits can potentially allow arbitrary non-admin code running on a host machine to harvest sensitive data belonging to other apps or system processes, including apps on guest VMs. + +Mitigating these vulnerabilities involves a complex multivendor update. It requires updates to Windows and Microsoft browsers using the [January 2018 Security Updates from Microsoft](https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/858123b8-25ca-e711-a957-000d3a33cf99) and updates to processor microcode using fixes released by OEM and CPU vendors. + +## Prerequisites +Note that the following requirements and limitations of the charts and what you might be able to do to improve visibility of the mitigation status of machines in your network: + +- Only active machines running Windows 10 are checked for OS mitigations. +- When checking for microcode mitgations, Windows Defender ATP currently checks for updates applicable to Intel CPU processors only. +- To determine microcode mitigation status, machines must enable Windows Defender Antivirus and update to definition version 1.259.1545.0 or above. +- To be covered under the overall mitigation status, machines must have both OS and microcode mitigation information. + +## Assess organizational risk with Threat analytics + +Threat analytics helps you continually assess and control risk exposure to Spectre and Meltdown. Use the charts to quickly identify machines for the presence or absence of the following mitigations: + +- **OS mitigation**: Identifies machines that have installed the January 2018 Security Updates from Microsoft and have not explicitly disabled any of the OS mitigations provided with these updates +- **Microcode mitigation**: Identifies machines that have installed the necessary microcode updates or those that do not require them +- **Overall mitigation status**: Identifies the completeness by which machines have mitigated against the Spectre and Meltdown exploits + +Click a section of each chart to get a list of the machines in the corresponding mitigation status. + + + From 35d0918f3f3910aab6ab805b3ee18def2258954f Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 6 Mar 2018 06:38:36 -0800 Subject: [PATCH 075/119] add ta in toc --- windows/security/threat-protection/TOC.md | 1 + ...t-analytics-windows-defender-advanced-threat-protection.md | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 5734a9da08..455e43f8c8 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -40,6 +40,7 @@ #### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) #### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md) #### [View the Security analytics dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) ###Investigate and remediate threats ####Alerts queue diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md index 13b4081355..407b49a995 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 03/05/2018 +ms.date: 03/06/2018 --- # Threat analytics for Spectre and Meltdown @@ -23,7 +23,7 @@ ms.date: 03/05/2018 - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -[!include[Prerelease information](prerelease.md)] + [Spectre and Meltdown](https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/) is a new class of exploits that take advantage of critical vulnerabilities in the CPU processors, allowing attackers running user-level, non-admin code to steal data from kernel memory. These exploits can potentially allow arbitrary non-admin code running on a host machine to harvest sensitive data belonging to other apps or system processes, including apps on guest VMs. From 1042e5d0460186a106a7177679122728bc794fd0 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 6 Mar 2018 06:40:41 -0800 Subject: [PATCH 076/119] typo --- ...eat-analytics-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md index 407b49a995..6fa550565a 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md @@ -30,7 +30,7 @@ ms.date: 03/06/2018 Mitigating these vulnerabilities involves a complex multivendor update. It requires updates to Windows and Microsoft browsers using the [January 2018 Security Updates from Microsoft](https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/858123b8-25ca-e711-a957-000d3a33cf99) and updates to processor microcode using fixes released by OEM and CPU vendors. ## Prerequisites -Note that the following requirements and limitations of the charts and what you might be able to do to improve visibility of the mitigation status of machines in your network: +Note the following requirements and limitations of the charts and what you might be able to do to improve visibility of the mitigation status of machines in your network: - Only active machines running Windows 10 are checked for OS mitigations. - When checking for microcode mitgations, Windows Defender ATP currently checks for updates applicable to Intel CPU processors only. From e97a0505df283507ebf864f7e3151ef537db40f8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 6 Mar 2018 15:10:51 +0000 Subject: [PATCH 077/119] Updated TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 455e43f8c8..e0c3ba2050 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -40,7 +40,7 @@ #### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) #### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md) #### [View the Security analytics dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) -#### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-windows-defender-advanced-threat-protection.md) ###Investigate and remediate threats ####Alerts queue From c2d82b4081e68940da5b35ff2518db97517c1ed5 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 6 Mar 2018 08:07:55 -0800 Subject: [PATCH 078/119] update data encyrption --- ...ge-privacy-windows-defender-advanced-threat-protection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 9527ae1022..a650f8fe1f 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/14/2017 +ms.date: 03/06/2018 --- # Windows Defender ATP data storage and privacy @@ -43,7 +43,8 @@ Microsoft does not use your data for advertising or for any other purpose other ## Data protection and encryption The Windows Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. -Among the various data protection technologies used ensures that customer data is always encrypted. For more information on the major areas of encryption, including encryption at rest, encryption in flight, and key management with Key Vault and other technologies used by the Windows Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/security-azure-encryption-overview). + +There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Windows Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/security-azure-encryption-overview). In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum. From aec2f06ef702205ab315941fb0a4df43c4535233 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 6 Mar 2018 17:25:43 +0000 Subject: [PATCH 079/119] Merged PR 6178: fix format --- .../provisioning-packages/provision-pcs-with-apps.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index d933b0bc8f..4c5d461287 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -73,7 +73,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ![enter settings for first app](../images/wcd-app-commands.png) -### Add a universal app to your package +## Add a universal app to your package Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or third-party apps. This procedure will assume you are distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. @@ -108,7 +108,7 @@ Universal apps that you can distribute in the provisioning package can be line-o -### Add a certificate to your package +## Add a certificate to your package 1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. @@ -123,11 +123,11 @@ Universal apps that you can distribute in the provisioning package can be line-o 5. For **KeyLocation**, select **Software only**. -### Add other settings to your package +## Add other settings to your package For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). -### Build your package +## Build your package 1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. From d6ac216e4d1a770e9dc4e490bec7ddb11e72b333 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 6 Mar 2018 18:32:08 +0000 Subject: [PATCH 080/119] Merged PR 6182: Add section for new diagnostic tool --- devices/surface-hub/change-history-surface-hub.md | 8 +++++++- .../create-and-test-a-device-account-surface-hub.md | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index b82d427482..d0cb5eb932 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 02/16/2018 +ms.date: 03/06/2018 ms.localizationpriority: medium --- @@ -16,6 +16,12 @@ ms.localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). +## March 2018 + +New or changed topic | Description +--- | --- +[Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Added section for account verification and testing, with link to new Surface Hub Hardware Diagnostic app. + ## February 2018 New or changed topic | Description diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md index 470db2937e..cc5d233b08 100644 --- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md +++ b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 07/27/2017 +ms.date: 03/06/2018 ms.localizationpriority: medium --- @@ -57,7 +57,9 @@ For detailed steps using PowerShell to provision a device account, choose an opt If you prefer to use a graphical user interface (UI), some steps can be done using UI instead of PowerShell. For more information, see [Creating a device account using UI](create-a-device-account-using-office-365.md). +## Account verification and testing +There are two methods available that you can use to validate and test a Surface Hub device account: [account verifications scripts](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts) and the [Surface Hub Hardware Diagnostic app](https://www.microsoft.com/store/apps/9nblggh51f2g). The account verification script will validate a previously-created device account using PowerShell from your desktop. The Surface Hub Hardware Diagnostic app is installed on your Surface Hub and provides detailed feedback about signin and communication failures. Both are valuable tools to test newly created device accounts and should be used to ensure optimal account availability.   From 9f842442dfdad4df35b8d057d49a95758705a675 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 6 Mar 2018 19:36:07 +0000 Subject: [PATCH 081/119] Merged PR 6187: Added two videos about setting ADMX-backed policies in Intune --- ...ew-in-windows-mdm-enrollment-management.md | 25 +++++++++++++++++++ .../mdm/understanding-admx-backed-policies.md | 10 +++++++- 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 46bd55a93f..4528a29fd8 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1389,6 +1389,31 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation +### March 2018 + +
    ++++ + + + + + + + + + + + +
    New or updated topicDescription
    [Understanding ADMX-backed policies](understanding-admx-backed-policies.md)

    Added the following videos:

    +
      +
    • [How to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune](https://www.microsoft.com/showcase/video.aspx?uuid=bdc9b54b-11b0-4bdb-a022-c339d16e7121)
      • +
    • [How to import a custom ADMX file to a device using Intune](https://www.microsoft.com/showcase/video.aspx?uuid=a59888b1-429f-4a49-8570-c39a143d9a73)
      • +
    +
    + ### February 2018 diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index f88849e2b1..6e079fbf78 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/11/2017 +ms.date: 03/02/2018 --- # Understanding ADMX-backed policies @@ -47,6 +47,14 @@ An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policy Windows maps the name and category path of a Group Policy to a MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\\`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX-backed policies supported by MDM, see [Policy CSP - ADMX-backed policies](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#admx-backed-policies). +Here is a video of how to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune. + + + +Here is a video of how to import a custom ADMX file to a device using Intune. + + + ## ADMX files and the Group Policy Editor To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX-backed Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named “Publishing Server 2 Settings.” When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**. From 506ade4afc88786a6ec1ff1e22e14fe56cce7cf3 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Tue, 6 Mar 2018 20:31:57 +0000 Subject: [PATCH 082/119] Merged PR 6191: fixing index refs to recently changed deliveryOpt policies fixing index refs to recently changed deliveryOpt policies --- .../mdm/policy-configuration-service-provider.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 4b54639bbb..58bb01a6d1 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -832,13 +832,13 @@ The following diagram shows the Policy configuration service provider in tree fo DeliveryOptimization/DOMonthlyUploadDataCap
    - DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth + DeliveryOptimization/DOPercentageMaxBackgroundBandwidth
    DeliveryOptimization/DOPercentageMaxDownloadBandwidth
    - DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth + DeliveryOptimization/DOPercentageMaxForegroundBandwidth
    DeliveryOptimization/DORestrictPeerSelectionBy From f93cf1b83bc6cde83459af9cf5513bef051465a4 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Tue, 6 Mar 2018 20:58:05 +0000 Subject: [PATCH 083/119] Merged PR 6194: Adding GP properties to known MDM policies. --- .../policy-configuration-service-provider.md | 775 +++++++- .../mdm/policy-csp-abovelock.md | 10 +- .../mdm/policy-csp-activexcontrols.md | 12 +- .../mdm/policy-csp-applicationdefaults.md | 11 +- .../mdm/policy-csp-applicationmanagement.md | 74 +- .../mdm/policy-csp-appvirtualization.md | 114 +- .../mdm/policy-csp-attachmentmanager.md | 16 +- .../mdm/policy-csp-authentication.md | 10 +- .../mdm/policy-csp-autoplay.md | 14 +- .../mdm/policy-csp-browser.md | 295 ++- .../mdm/policy-csp-camera.md | 10 +- .../mdm/policy-csp-cellular.md | 42 +- .../mdm/policy-csp-connectivity.md | 74 +- .../mdm/policy-csp-credentialproviders.md | 12 +- .../mdm/policy-csp-credentialsui.md | 10 +- .../mdm/policy-csp-cryptography.md | 8 +- .../mdm/policy-csp-datausage.md | 20 +- .../mdm/policy-csp-defender.md | 280 ++- .../mdm/policy-csp-deliveryoptimization.md | 215 ++- .../mdm/policy-csp-desktop.md | 6 +- .../mdm/policy-csp-deviceguard.md | 28 +- .../mdm/policy-csp-deviceinstallation.md | 10 +- .../mdm/policy-csp-devicelock.md | 12 +- .../mdm/policy-csp-display.md | 72 +- .../mdm/policy-csp-education.md | 10 +- .../mdm/policy-csp-errorreporting.md | 22 +- .../mdm/policy-csp-eventlogservice.md | 20 +- .../mdm/policy-csp-experience.md | 107 +- .../mdm/policy-csp-exploitguard.md | 11 +- .../mdm/policy-csp-handwriting.md | 10 +- .../mdm/policy-csp-internetexplorer.md | 1691 ++++++++++++----- .../mdm/policy-csp-kerberos.md | 34 +- .../mdm/policy-csp-licensing.md | 18 +- ...policy-csp-localpoliciessecurityoptions.md | 308 ++- .../mdm/policy-csp-location.md | 10 +- .../mdm/policy-csp-lockdown.md | 10 +- .../client-management/mdm/policy-csp-maps.md | 10 +- .../mdm/policy-csp-messaging.md | 10 +- .../mdm/policy-csp-networkisolation.md | 63 +- .../mdm/policy-csp-notifications.md | 10 +- .../client-management/mdm/policy-csp-power.md | 63 +- .../mdm/policy-csp-printers.md | 14 +- .../mdm/policy-csp-privacy.md | 682 ++++++- .../mdm/policy-csp-remoteassistance.md | 18 +- .../mdm/policy-csp-remotedesktopservices.md | 30 +- .../mdm/policy-csp-remotemanagement.md | 166 +- .../mdm/policy-csp-remoteprocedurecall.md | 16 +- .../mdm/policy-csp-remoteshell.md | 69 +- .../mdm/policy-csp-search.md | 91 +- .../mdm/policy-csp-security.md | 10 +- .../mdm/policy-csp-settings.md | 28 +- .../mdm/policy-csp-smartscreen.md | 27 +- .../mdm/policy-csp-speech.md | 10 +- .../client-management/mdm/policy-csp-start.md | 26 +- .../mdm/policy-csp-storage.md | 14 +- .../mdm/policy-csp-system.md | 92 +- .../mdm/policy-csp-systemservices.md | 38 +- .../mdm/policy-csp-textinput.md | 12 +- .../mdm/policy-csp-update.md | 367 +++- .../mdm/policy-csp-userrights.md | 176 +- .../client-management/mdm/policy-csp-wifi.md | 18 +- ...olicy-csp-windowsdefendersecuritycenter.md | 158 +- .../mdm/policy-csp-windowsinkworkspace.md | 19 +- .../mdm/policy-csp-windowslogon.md | 18 +- .../mdm/policy-csp-wirelessdisplay.md | 18 +- 65 files changed, 5768 insertions(+), 886 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 58bb01a6d1..4f14d81f4f 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/26/2018 +ms.date: 03/05/2018 --- # Policy CSP @@ -95,7 +95,7 @@ The following diagram shows the Policy configuration service provider in tree fo

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall** -

    Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed polices for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md). +

    Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md). > [!NOTE] > The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](https://technet.microsoft.com/en-us/library/cc179097.aspx). @@ -130,7 +130,7 @@ The following diagram shows the Policy configuration service provider in tree fo

    Supported operations are Add and Get. Does not support Delete. > [!Note] -> The policies supported in Windows 10 S are the same as those supported in Windows 10 Pro with the exception of the policies under ApplicationDefaults. The ApplicationDefaults polices are not supported in Windows 10 S. +> The policies supported in Windows 10 S are the same as those supported in Windows 10 Pro with the exception of the policies under ApplicationDefaults. The ApplicationDefaults policies are not supported in Windows 10 S. ## Policies @@ -3627,6 +3627,775 @@ The following diagram shows the Policy configuration service provider in tree fo - [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) - [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +## Policies supported by GP + +- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) +- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) +- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) +- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) +- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) +- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) +- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) +- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) +- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) +- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) +- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) +- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) +- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) +- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) +- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) +- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) +- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) +- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) +- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) +- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) +- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) +- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) +- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) +- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) +- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) +- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) +- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [DataUsage/SetCost3G](./policy-csp-datausage.md#datausage-setcost3g) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) +- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) +- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) +- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) +- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) +- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) +- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) +- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) +- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) +- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) +- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) +- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) +- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) +- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) +- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) +- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) +- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) +- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) +- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) +- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) +- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) +- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) +- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) +- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) +- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) +- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) +- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) +- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) +- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) +- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) +- [LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableadministratoraccountstatus) +- [LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableguestaccountstatus) +- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) +- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) +- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) +- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) +- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) +- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) +- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) +- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) +- [LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallysignsecurechanneldatawhenpossible) +- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) +- [LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-maximummachineaccountpasswordage) +- [LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-requirestrongsessionkey) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) +- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) +- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) +- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) +- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) +- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) +- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) +- [Location/EnableLocation](./policy-csp-location.md#location-enablelocation) +- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) +- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) +- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) +- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) +- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) +- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) +- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) +- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) +- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) +- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) +- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) +- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) +- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) +- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) +- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) +- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) +- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) +- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) +- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) +- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) +- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) +- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) +- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) +- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) +- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) +- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) +- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) +- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) +- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) +- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) +- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) +- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) +- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) +- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) +- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) +- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) +- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) +- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) +- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) +- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) +- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) +- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) +- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) +- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) +- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) +- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) +- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) +- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) +- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) +- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) +- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) +- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) +- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) +- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) +- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) +- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) +- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) +- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) +- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) +- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) +- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) +- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) +- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) +- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) +- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) +- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) +- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) +- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) +- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) +- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) +- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) +- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) +- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) +- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) +- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) +- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) +- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) +- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) +- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) +- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) +- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) +- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) +- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) +- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) +- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) +- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) +- [Start/StartLayout](./policy-csp-start.md#start-startlayout) +- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) +- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) +- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) +- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) +- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) +- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) +- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) +- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) +- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) +- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) +- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) +- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) +- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) +- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) +- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) +- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) +- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) +- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) +- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) +- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) +- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) +- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) +- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) +- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) +- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) +- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) +- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) +- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) +- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) +- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) +- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) +- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) +- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) +- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) +- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) +- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) +- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) +- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) +- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) +- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) +- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) +- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) +- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) +- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) +- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) +- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) +- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) +- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) +- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) +- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) +- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) +- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) +- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) +- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) +- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) +- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) +- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) +- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) +- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) +- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) +- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) +- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) +- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) +- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) +- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) +- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) +- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) +- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) +- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) +- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) +- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) +- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) +- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) +- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) +- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) +- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) +- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) +- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) +- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) +- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) +- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) +- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) +- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) +- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) +- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) +- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) +- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) +- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) +- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) +- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) +- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) +- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) +- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) +- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) +- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + ## Policies supported by IoT Core diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index bdcbc5f8c4..d0b77e50dc 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - AboveLock @@ -127,6 +127,14 @@ The following list shows the supported values: Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech. + +ADMX Info: +- GP English name: *Allow Cortana above lock screen* +- GP name: *AllowCortanaAboveLock* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 4bea893b54..925504ac0d 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - ActiveXControls @@ -63,11 +63,11 @@ ms.date: 01/30/2018 -This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. +This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. -If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. +If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. -If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation. +If you disable or do not configure this policy setting, ActiveX controls prompt the user for administrative credentials before installation. Note: Wild card characters cannot be used when specifying the host URLs. @@ -79,14 +79,14 @@ Note: Wild card characters cannot be used when specifying the host URLs. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Approved Installation Sites for ActiveX Controls* - GP name: *ApprovedActiveXInstallSites* - GP path: *Windows Components/ActiveX Installer Service* - GP ADMX file name: *ActiveXInstallService.admx* - +

    diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 0e45ce047c..dba53edc54 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - ApplicationDefaults @@ -68,6 +68,15 @@ Added in Windows 10, version 1703. This policy allows an administrator to set de If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied. + +ADMX Info: +- GP English name: *Set a default associations configuration file* +- GP name: *DefaultAssociationsConfiguration* +- GP element: *DefaultAssociationsConfiguration_TextBox* +- GP path: *File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + To create create the SyncML, follow these steps:
      diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 9ee5181bd2..5822ec21c5 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - ApplicationManagement @@ -98,6 +98,14 @@ Specifies whether non Microsoft Store apps are allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow all trusted apps to install* +- GP name: *AppxDeploymentAllowAllTrustedApps* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + The following list shows the supported values: @@ -152,6 +160,14 @@ Specifies whether automatic update of apps from Microsoft Store are allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off Automatic Download and Install of updates* +- GP name: *DisableAutoInstall* +- GP path: *Windows Components/Store* +- GP ADMX file name: *WindowsStore.admx* + + The following list shows the supported values: @@ -204,6 +220,14 @@ Specifies whether developer unlock is allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allows development of Windows Store apps and installing them from an integrated development environment (IDE)* +- GP name: *AllowDevelopmentWithoutDevLicense* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + The following list shows the supported values: @@ -260,6 +284,14 @@ Specifies whether DVR and broadcasting is allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Enables or disables Windows Game Recording and Broadcasting* +- GP name: *AllowGameDVR* +- GP path: *Windows Components/Windows Game Recording and Broadcasting* +- GP ADMX file name: *GameDVR.admx* + + The following list shows the supported values: @@ -312,6 +344,14 @@ Specifies whether multiple users of the same app can share data. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow a Windows app to share application data between users* +- GP name: *AllowSharedLocalAppData* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + The following list shows the supported values: @@ -479,6 +519,14 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. + +ADMX Info: +- GP English name: *Disable all apps from Microsoft Store * +- GP name: *DisableStoreApps* +- GP path: *Windows Components/Store* +- GP ADMX file name: *WindowsStore.admx* + + The following list shows the supported values: @@ -532,6 +580,14 @@ Allows disabling of the retail catalog and only enables the Private store. Most restricted value is 1. + +ADMX Info: +- GP English name: *Only display the private store within the Microsoft Store* +- GP name: *RequirePrivateStoreOnly_1* +- GP path: *Windows Components/Store* +- GP ADMX file name: *WindowsStore.admx* + + The following list shows the supported values: @@ -584,6 +640,14 @@ Specifies whether application data is restricted to the system drive. Most restricted value is 1. + +ADMX Info: +- GP English name: *Prevent users' app data from being stored on non-system volumes* +- GP name: *RestrictAppDataToSystemVolume* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + The following list shows the supported values: @@ -636,6 +700,14 @@ Specifies whether the installation of applications is restricted to the system d Most restricted value is 1. + +ADMX Info: +- GP English name: *Disable installing Windows apps on non-system volumes* +- GP name: *DisableDeploymentToNonSystemVolumes* +- GP path: *Windows Components/App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 5ec36f8881..bbb346e93c 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - AppVirtualization @@ -154,14 +154,14 @@ This policy setting allows you to enable or disable Microsoft Application Virtua > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable App-V Client* - GP name: *EnableAppV* - GP path: *System/App-V* - GP ADMX file name: *appv.admx* - +
      @@ -212,14 +212,14 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable Dynamic Virtualization* - GP name: *Virtualization_JITVEnable* - GP path: *System/App-V/Virtualization* - GP ADMX file name: *appv.admx* - +
      @@ -270,14 +270,14 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable automatic cleanup of unused appv packages* - GP name: *PackageManagement_AutoCleanupEnable* - GP path: *System/App-V/PackageManagement* - GP ADMX file name: *appv.admx* - +
      @@ -328,14 +328,14 @@ Enables scripts defined in the package manifest of configuration files that shou > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable Package Scripts* - GP name: *Scripting_Enable_Package_Scripts* - GP path: *System/App-V/Scripting* - GP ADMX file name: *appv.admx* - +
      @@ -386,14 +386,14 @@ Enables a UX to display to the user when a publishing refresh is performed on th > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable Publishing Refresh UX* - GP name: *Enable_Publishing_Refresh_UX* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -454,14 +454,14 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Reporting Server* - GP name: *Reporting_Server_Policy* - GP path: *System/App-V/Reporting* - GP ADMX file name: *appv.admx* - +
      @@ -512,14 +512,14 @@ Specifies the file paths relative to %userprofile% that do not roam with a user' > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Roaming File Exclusions* - GP name: *Integration_Roaming_File_Exclusions* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* - +
      @@ -570,14 +570,14 @@ Specifies the registry paths that do not roam with a user profile. Example usage > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Roaming Registry Exclusions* - GP name: *Integration_Roaming_Registry_Exclusions* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* - +
      @@ -628,14 +628,14 @@ Specifies how new packages should be loaded automatically by App-V on a specific > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify what to load in background (aka AutoLoad)* - GP name: *Steaming_Autoload* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -686,14 +686,14 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable Migration Mode* - GP name: *Client_Coexistence_Enable_Migration_mode* - GP path: *System/App-V/Client Coexistence* - GP ADMX file name: *appv.admx* - +
      @@ -744,14 +744,14 @@ Specifies the location where symbolic links are created to the current version o > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Integration Root User* - GP name: *Integration_Root_User* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* - +
      @@ -802,14 +802,14 @@ Specifies the location where symbolic links are created to the current version o > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Integration Root Global* - GP name: *Integration_Root_Global* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* - +
      @@ -878,14 +878,14 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Publishing Server 1 Settings* - GP name: *Publishing_Server1_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -954,14 +954,14 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Publishing Server 2 Settings* - GP name: *Publishing_Server2_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -1030,14 +1030,14 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Publishing Server 3 Settings* - GP name: *Publishing_Server3_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -1106,14 +1106,14 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Publishing Server 4 Settings* - GP name: *Publishing_Server4_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -1182,14 +1182,14 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Publishing Server 5 Settings* - GP name: *Publishing_Server5_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* - +
      @@ -1240,14 +1240,14 @@ Specifies the path to a valid certificate in the certificate store. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Certificate Filter For Client SSL* - GP name: *Streaming_Certificate_Filter_For_Client_SSL* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1298,14 +1298,14 @@ This setting controls whether virtualized applications are launched on Windows 8 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection* - GP name: *Streaming_Allow_High_Cost_Launch* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1356,14 +1356,14 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Location Provider* - GP name: *Streaming_Location_Provider* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1414,14 +1414,14 @@ Specifies directory where all new applications and updates will be installed. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Package Installation Root* - GP name: *Streaming_Package_Installation_Root* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1472,14 +1472,14 @@ Overrides source location for downloading package content. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Package Source Root* - GP name: *Streaming_Package_Source_Root* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1530,14 +1530,14 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Reestablishment Interval* - GP name: *Streaming_Reestablishment_Interval* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1588,14 +1588,14 @@ Specifies the number of times to retry a dropped session. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Reestablishment Retries* - GP name: *Streaming_Reestablishment_Retries* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1646,14 +1646,14 @@ Specifies that streamed package contents will be not be saved to the local hard > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Shared Content Store (SCS) mode* - GP name: *Streaming_Shared_Content_Store_Mode* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1704,14 +1704,14 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable Support for BranchCache* - GP name: *Streaming_Support_Branch_Cache* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1762,14 +1762,14 @@ Verifies Server certificate revocation status before streaming using HTTPS. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Verify certificate revocation list* - GP name: *Streaming_Verify_Certificate_Revocation_List* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* - +
      @@ -1820,14 +1820,14 @@ Specifies a list of process paths (may contain wildcards) which are candidates f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Virtual Component Process Allow List* - GP name: *Virtualization_JITVAllowList* - GP path: *System/App-V/Virtualization* - GP ADMX file name: *appv.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index 3cd9a8202d..c80e44f614 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - AttachmentManager @@ -85,14 +85,14 @@ If you do not configure this policy setting, Windows marks file attachments with > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not preserve zone information in file attachments* - GP name: *AM_MarkZoneOnSavedAtttachments* - GP path: *Windows Components/Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* - +
      @@ -149,14 +149,14 @@ If you do not configure this policy setting, Windows hides the check box and Unb > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Hide mechanisms to remove zone information* - GP name: *AM_RemoveZoneInfo* - GP path: *Windows Components/Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* - +
      @@ -197,7 +197,7 @@ ADMX Info: -This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant. +This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant. If you enable this policy setting, Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened. @@ -213,14 +213,14 @@ If you do not configure this policy setting, Windows does not call the registere > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Notify antivirus programs when opening attachments* - GP name: *AM_CallIOfficeAntiVirus* - GP path: *Windows Components/Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 881ae7ff19..02a363e078 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Authentication @@ -286,6 +286,14 @@ Added in Windows 10, version 1607. Allows secondary authentication devices to w The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD). + +ADMX Info: +- GP English name: *Allow companion device for secondary authentication* +- GP name: *MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice* +- GP path: *Windows Components/Microsoft Secondary Authentication Factor* +- GP ADMX file name: *DeviceCredential.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index ea02a39c19..2e2ecaf426 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Autoplay @@ -84,14 +84,14 @@ If you disable or do not configure this policy setting, AutoPlay is enabled for > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disallow Autoplay for non-volume devices* - GP name: *NoAutoplayfornonVolume* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* - +
      @@ -156,14 +156,14 @@ If you disable or not configure this policy setting, Windows Vista or later will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set the default behavior for AutoRun* - GP name: *NoAutorun* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* - +
      @@ -229,14 +229,14 @@ Note: This policy setting appears in both the Computer Configuration and User Co > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off Autoplay* - GP name: *Autorun* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 762300cba0..22fc158c08 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/31/2018 +ms.date: 03/05/2018 --- # Policy CSP - Browser @@ -188,6 +188,14 @@ Added in Windows 10, version 1703. Specifies whether to allow the address bar dr Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Address bar drop-down list suggestions* +- GP name: *AllowAddressBarDropdown* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -241,6 +249,14 @@ Specifies whether autofill on websites is allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Configure Autofill* +- GP name: *AllowAutofill* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -366,14 +382,7 @@ The following list shows the supported values: - 0 - Disable. Microsoft Edge cannot retrieve a configuration - 1 - Enable (default). Microsoft Edge can retrieve a configuration for Books Library - - - - - - -
      @@ -421,6 +430,15 @@ Specifies whether cookies are allowed. Most restricted value is 0. + +ADMX Info: +- GP English name: *Configure cookies* +- GP name: *Cookies* +- GP element: *CookiesListBox* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -487,6 +505,14 @@ Specifies whether employees can use F12 Developer Tools on Microsoft Edge. Turni Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Developer Tools* +- GP name: *AllowDeveloperTools* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -540,6 +566,14 @@ Specifies whether Do Not Track headers are allowed. Most restricted value is 1. + +ADMX Info: +- GP English name: *Configure Do Not Track* +- GP name: *AllowDoNotTrack* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -600,6 +634,14 @@ To verify AllowDoNotTrack is set to 0 (not allowed): Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed. + +ADMX Info: +- GP English name: *Allow Extensions* +- GP name: *AllowExtensions* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -651,6 +693,14 @@ The following list shows the supported values: Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge. + +ADMX Info: +- GP English name: *Allow Adobe Flash* +- GP name: *AllowFlash* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -702,6 +752,14 @@ The following list shows the supported values: Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. + +ADMX Info: +- GP English name: *Configure the Adobe Flash Click-to-Run setting* +- GP name: *AllowFlashClickToRun* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -755,6 +813,14 @@ Specifies whether InPrivate browsing is allowed on corporate networks. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow InPrivate browsing* +- GP name: *AllowInPrivate* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -811,6 +877,14 @@ If you enable or don’t configure this setting, Microsoft Edge periodically dow Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Microsoft Compatibility List* +- GP name: *AllowCVList* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -864,6 +938,14 @@ Specifies whether saving and managing passwords locally on the device is allowed Most restricted value is 0. + +ADMX Info: +- GP English name: *Configure Password Manager* +- GP name: *AllowPasswordManager* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -926,6 +1008,14 @@ Specifies whether pop-up blocker is allowed or enabled. Most restricted value is 1. + +ADMX Info: +- GP English name: *Configure Pop-up Blocker* +- GP name: *AllowPopups* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -990,6 +1080,14 @@ If this setting is turned on or not configured, users can add new search engines Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow search engine customization* +- GP name: *AllowSearchEngineCustomization* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1043,6 +1141,14 @@ Specifies whether search suggestions are allowed in the address bar. Most restricted value is 0. + +ADMX Info: +- GP English name: *Configure search suggestions in Address bar* +- GP name: *AllowSearchSuggestionsinAddressBar* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1096,6 +1202,14 @@ Specifies whether Windows Defender SmartScreen is allowed. Most restricted value is 1. + +ADMX Info: +- GP English name: *Configure Windows Defender SmartScreen* +- GP name: *AllowSmartScreen* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1156,6 +1270,14 @@ To verify AllowSmartScreen is set to 0 (not allowed): Added in Windows 10, next majot update. Always show the Books Library in Microsoft Edge + +ADMX Info: +- GP English name: *Always show the Books Library in Microsoft Edge* +- GP name: *AlwaysEnableBooksLibrary* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1209,6 +1331,14 @@ Added in Windows 10, version 1703. Specifies whether to clear browsing data on e Most restricted value is 1. + +ADMX Info: +- GP English name: *Allow clearing browsing data on exit* +- GP name: *AllowClearingBrowsingDataOnExit* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1279,6 +1409,15 @@ If this setting is not configured, the search engines used are the ones that are Most restricted value is 0. + +ADMX Info: +- GP English name: *Configure additional search engines* +- GP name: *ConfigureAdditionalSearchEngines* +- GP element: *ConfigureAdditionalSearchEngines_Prompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1338,6 +1477,14 @@ Added in Windows 10, version 1703. Boolean value that specifies whether the lock Most restricted value is 0. + +ADMX Info: +- GP English name: *Disable lockdown of Start pages* +- GP name: *DisableLockdownOfStartPages* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1391,6 +1538,14 @@ This policy setting lets you decide how much data to send to Microsoft about the If you enable this setting, Microsoft Edge sends additional diagnostic data, on top of the basic diagnostic data, from the Books tab. If you disable or don't configure this setting, Microsoft Edge only sends basic diagnostic data, depending on your device configuration. + +ADMX Info: +- GP English name: *Allow extended telemetry for the Books tab* +- GP name: *EnableExtendedBooksTelemetry* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1446,6 +1601,15 @@ The following list shows the supported values: Allows the user to specify an URL of an enterprise site list. + +ADMX Info: +- GP English name: *Configure the Enterprise Mode Site List* +- GP name: *EnterpriseModeSiteList* +- GP element: *EnterSiteListPrompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1604,6 +1768,15 @@ Starting in Windows 10, version 1703, if you don’t want to send traffic to Mi > Turning this setting off, or not configuring it, sets your default Start pages to the webpages specified in App settings. + +ADMX Info: +- GP English name: *Configure Start pages* +- GP name: *HomePages* +- GP element: *HomePagesPrompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + +
      @@ -1657,6 +1830,14 @@ If you disable or don't configure this setting (default), employees can add, imp Data type is integer. + +ADMX Info: +- GP English name: *Prevent changes to Favorites on Microsoft Edge* +- GP name: *LockdownFavorites* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1708,6 +1889,14 @@ The following list shows the supported values: Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features. + +ADMX Info: +- GP English name: *Prevent access to the about:flags page in Microsoft Edge* +- GP name: *PreventAccessToAboutFlagsInMicrosoftEdge* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1761,6 +1950,14 @@ Added in Windows 10, version 1703. Specifies whether to enable or disable the Fi Most restricted value is 1. + +ADMX Info: +- GP English name: *Prevent the First Run webpage from opening on Microsoft Edge* +- GP name: *PreventFirstRunPage* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1814,6 +2011,14 @@ Added in Windows 10, version 1703. Specifies whether Microsoft can collect infor Most restricted value is 1. + +ADMX Info: +- GP English name: *Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start* +- GP name: *PreventLiveTileDataCollection* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1867,6 +2072,14 @@ Specifies whether users can override the Windows Defender SmartScreen Filter war Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from going to the site. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about potentially malicious websites and to continue to the site. + +ADMX Info: +- GP English name: *Prevent bypassing Windows Defender SmartScreen prompts for sites* +- GP name: *PreventSmartScreenPromptOverride* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1918,6 +2131,14 @@ The following list shows the supported values: Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process. + +ADMX Info: +- GP English name: *Prevent bypassing Windows Defender SmartScreen prompts for files* +- GP name: *PreventSmartScreenPromptOverrideForFiles* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -1973,6 +2194,14 @@ The following list shows the supported values: Specifies whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. Turning this setting on hides an user’s localhost IP address while making phone calls using WebRTC. Turning this setting off, or not configuring it, shows an user’s localhost IP address while making phone calls using WebRTC. + +ADMX Info: +- GP English name: *Prevent using Localhost IP address for WebRTC* +- GP name: *HideLocalHostIPAddress* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -2037,6 +2266,15 @@ If you disable or don't configure this setting, employees will see the favorites Data type is string. + +ADMX Info: +- GP English name: *Provision Favorites* +- GP name: *ConfiguredFavorites* +- GP element: *ConfiguredFavoritesPrompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + +
      @@ -2087,6 +2325,14 @@ Specifies whether to send intranet traffic over to Internet Explorer. Most restricted value is 0. + +ADMX Info: +- GP English name: *Send all intranet sites to Internet Explorer 11* +- GP name: *SendIntranetTraffictoInternetExplorer* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -2148,6 +2394,15 @@ If this setting is not configured, the default search engine is set to the one s Most restricted value is 0. + +ADMX Info: +- GP English name: *Set default search engine* +- GP name: *SetDefaultSearchEngine* +- GP element: *SetDefaultSearchEngine_Prompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -2205,6 +2460,14 @@ Added in Windows 10, version 1607. Specifies whether users should see a full in Most restricted value is 0. + +ADMX Info: +- GP English name: *Show message when opening sites in Internet Explorer* +- GP name: *ShowMessageWhenOpeningSitesInInternetExplorer* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -2261,6 +2524,14 @@ Added in Windows 10, version 1703. Specifies whether favorites are kept in sync > Enabling this setting stops Microsoft Edge favorites from syncing between connected Windows 10 devices. + +ADMX Info: +- GP English name: *Keep favorites in sync between Internet Explorer and Microsoft Edge* +- GP name: *SyncFavoritesBetweenIEAndMicrosoftEdge* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: @@ -2322,6 +2593,14 @@ To verify that favorites are in synchronized between Internet Explorer and Micro This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. + +ADMX Info: +- GP English name: *Allow a shared Books folder* +- GP name: *UseSharedFolderForBooks* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 635f9d4118..02a242ec12 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Camera @@ -68,6 +68,14 @@ Disables or enables the camera. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Use of Camera* +- GP name: *L_AllowCamera* +- GP path: *Windows Components/Camera* +- GP ADMX file name: *Camera.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 0a1606c00c..5b9aa0d665 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Cellular @@ -90,6 +90,13 @@ If you disable or do not configure this policy setting, employees in your organi If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.” + +ADMX Info: +- GP name: *LetAppsAccessCellularData* +- GP element: *LetAppsAccessCellularData_Enum* +- GP ADMX file name: *wwansvc.admx* + + The following list shows the supported values: @@ -141,6 +148,13 @@ The following list shows the supported values: Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + +ADMX Info: +- GP name: *LetAppsAccessCellularData* +- GP element: *LetAppsAccessCellularData_ForceAllowTheseApps_List* +- GP ADMX file name: *wwansvc.admx* + +
      @@ -184,6 +198,13 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + +ADMX Info: +- GP name: *LetAppsAccessCellularData* +- GP element: *LetAppsAccessCellularData_ForceDenyTheseApps_List* +- GP ADMX file name: *wwansvc.admx* + +
      @@ -227,6 +248,13 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string. + +ADMX Info: +- GP name: *LetAppsAccessCellularData* +- GP element: *LetAppsAccessCellularData_UserInControlOfTheseApps_List* +- GP ADMX file name: *wwansvc.admx* + +
      @@ -270,13 +298,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX. If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page. - -If this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default.” - -Supported values: - -- 0 - Hide -- 1 - Show +If this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default. > [!TIP] @@ -286,14 +308,14 @@ Supported values: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set Per-App Cellular Access UI Visibility* - GP name: *ShowAppCellularAccessUI* - GP path: *Network/WWAN Service/WWAN UI Settings* - GP ADMX file name: *wwansvc.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index df9e662f31..249cc6cac3 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Connectivity @@ -216,6 +216,14 @@ Allows or disallows cellular data roaming on the device. Device reboot is not re Most restricted value is 0. + +ADMX Info: +- GP English name: *Prohibit connection to roaming Mobile Broadband networks* +- GP name: *WCM_DisableRoaming* +- GP path: *Network/Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + The following list shows the supported values: @@ -545,6 +553,17 @@ The following list shows the supported values: +This policy setting specifies whether to allow printing over HTTP from this client. + +Printing over HTTP allows a client to print to printers on the intranet as well as the Internet. + +Note: This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP. + +If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP. + +If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP. + +Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers. > [!TIP] @@ -554,14 +573,14 @@ The following list shows the supported values: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off printing over HTTP* - GP name: *DisableHTTPPrinting_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* - +
      @@ -602,6 +621,15 @@ ADMX Info: +This policy setting specifies whether to allow this client to download print driver packages over HTTP. + +To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP. + +Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. It only prohibits downloading drivers that are not already installed locally. + +If you enable this policy setting, print drivers cannot be downloaded over HTTP. + +If you disable or do not configure this policy setting, users can download print drivers over HTTP. > [!TIP] @@ -611,14 +639,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off downloading of print drivers over HTTP* - GP name: *DisableWebPnPDownload_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* - +
      @@ -659,6 +687,15 @@ ADMX Info: +This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards. + +These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. + +If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. + +If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. + +See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. > [!TIP] @@ -668,14 +705,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off Internet download for Web publishing and online ordering wizards* - GP name: *ShellPreventWPWDownload_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* - +
      @@ -721,6 +758,14 @@ Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) de Value type is integer. + +ADMX Info: +- GP English name: *Turn off Windows Network Connectivity Status Indicator active tests* +- GP name: *NoActiveProbe* +- GP path: *Internet Communication settings* +- GP ADMX file name: *ICM.admx* + +
      @@ -773,14 +818,14 @@ If you enable this policy, Windows only allows access to the specified UNC paths > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Hardened UNC Paths* - GP name: *Pol_HardenedPaths* - GP path: *Network/Network Provider* - GP ADMX file name: *networkprovider.admx* - +
      @@ -821,6 +866,13 @@ ADMX Info: +Determines whether a user can install and configure the Network Bridge. + +Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. + +The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. + +If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. > [!TIP] @@ -830,14 +882,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prohibit installation and configuration of Network Bridge on your DNS domain network* - GP name: *NC_AllowNetBridge_NLA* - GP path: *Network/Network Connections* - GP ADMX file name: *NetworkConnections.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 8994842055..039a57e0fb 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - CredentialProviders @@ -87,14 +87,14 @@ To configure Windows Hello for Business, use the Administrative Template policie > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on convenience PIN sign-in* - GP name: *AllowDomainPINLogon* - GP path: *System/Logon* - GP ADMX file name: *credentialproviders.admx* - +
      @@ -137,7 +137,7 @@ ADMX Info: This policy setting allows you to control whether a domain user can sign in using a picture password. -If you enable this policy setting, a domain user can't set up or sign in with a picture password. +If you enable this policy setting, a domain user can't set up or sign in with a picture password. If you disable or don't configure this policy setting, a domain user can set up and use a picture password. @@ -151,14 +151,14 @@ Note that the user's domain password will be cached in the system vault when usi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off picture password sign-in* - GP name: *BlockDomainPicturePassword* - GP path: *System/Logon* - GP ADMX file name: *credentialproviders.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 869f016e13..ec0f9a0c5e 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - CredentialsUI @@ -85,14 +85,14 @@ The policy applies to all Windows components and applications that use the Windo > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not display the password reveal button* - GP name: *DisablePasswordReveal* - GP path: *Windows Components/Credential User Interface* - GP ADMX file name: *credui.admx* - +
      @@ -147,14 +147,14 @@ If you disable this policy setting, users will always be required to type a user > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enumerate administrator accounts on elevation* - GP name: *EnumerateAdministrators* - GP path: *Windows Components/Credential User Interface* - GP ADMX file name: *credui.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 81023d5fdd..b2360eb40b 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Cryptography @@ -69,6 +69,12 @@ ms.date: 01/30/2018 Allows or disallows the Federal Information Processing Standard (FIPS) policy. + +GP Info: +- GP English name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 9d64360b36..2aa9b34cd0 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - DataUsage @@ -70,9 +70,9 @@ This policy setting configures the cost of 3G connections on the local machine. If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 3G connections on the local machine: -- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. +- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. -- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. +- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. - Variable: This connection is costed on a per byte basis. @@ -86,14 +86,14 @@ If this policy setting is disabled or is not configured, the cost of 3G connecti > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set 3G Cost* - GP name: *SetCost3G* - GP path: *Network/WWAN Service/WWAN Media Cost* - GP ADMX file name: *wwansvc.admx* - +
      @@ -134,13 +134,13 @@ ADMX Info: -This policy setting configures the cost of 4G connections on the local machine. +This policy setting configures the cost of 4G connections on the local machine. If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all 4G connections on the local machine: -- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. +- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. -- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. +- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. - Variable: This connection is costed on a per byte basis. @@ -154,14 +154,14 @@ If this policy setting is disabled or is not configured, the cost of 4G connecti > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set 4G Cost* - GP name: *SetCost4G* - GP path: *Network/WWAN Service/WWAN Media Cost* - GP ADMX file name: *wwansvc.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 6dcfb31902..74091500ca 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Defender @@ -172,6 +172,14 @@ ms.date: 01/30/2018 Allows or disallows scanning of archives. + +ADMX Info: +- GP English name: *Scan archive files* +- GP name: *Scan_DisableArchiveScanning* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -226,6 +234,14 @@ The following list shows the supported values: Allows or disallows Windows Defender Behavior Monitoring functionality. + +ADMX Info: +- GP English name: *Turn on behavior monitoring* +- GP name: *RealtimeProtection_DisableBehaviorMonitoring* +- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -280,6 +296,15 @@ The following list shows the supported values: To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. + +ADMX Info: +- GP English name: *Join Microsoft MAPS* +- GP name: *SpynetReporting* +- GP element: *SpynetReporting* +- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -334,6 +359,14 @@ The following list shows the supported values: Allows or disallows scanning of email. + +ADMX Info: +- GP English name: *Turn on e-mail scanning* +- GP name: *Scan_DisableEmailScanning* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -388,6 +421,14 @@ The following list shows the supported values: Allows or disallows a full scan of mapped network drives. + +ADMX Info: +- GP English name: *Run full scan on mapped network drives* +- GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -442,6 +483,14 @@ The following list shows the supported values: Allows or disallows a full scan of removable drives. + +ADMX Info: +- GP English name: *Scan removable drives* +- GP name: *Scan_DisableRemovableDriveScanning* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -496,6 +545,14 @@ The following list shows the supported values: Allows or disallows Windows Defender IOAVP Protection functionality. + +ADMX Info: +- GP English name: *Scan all downloaded files and attachments* +- GP name: *RealtimeProtection_DisableIOAVProtection* +- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -604,6 +661,14 @@ The following list shows the supported values: Allows or disallows Windows Defender On Access Protection functionality. + +ADMX Info: +- GP English name: *Monitor file and program activity on your computer* +- GP name: *RealtimeProtection_DisableOnAccessProtection* +- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -658,6 +723,14 @@ The following list shows the supported values: Allows or disallows Windows Defender Realtime Monitoring functionality. + +ADMX Info: +- GP English name: *Turn off real-time protection* +- GP name: *DisableRealtimeMonitoring* +- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -712,6 +785,14 @@ The following list shows the supported values: Allows or disallows a scanning of network files. + +ADMX Info: +- GP English name: *Scan network files* +- GP name: *Scan_DisableScanningNetworkFiles* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -820,6 +901,14 @@ The following list shows the supported values: Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed. + +ADMX Info: +- GP English name: *Enable headless UI mode* +- GP name: *UX_Configuration_UILockdown* +- GP path: *Windows Components/Windows Defender Antivirus/Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -876,6 +965,15 @@ Added in Windows 10, version 1709. This policy setting allows you to prevent Att Value type is string. + +ADMX Info: +- GP English name: *Exclude files and paths from Attack Surface Reduction Rules* +- GP name: *ExploitGuard_ASR_ASROnlyExclusions* +- GP element: *ExploitGuard_ASR_ASROnlyExclusions* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -927,6 +1025,15 @@ For more information about ASR rule ID and status ID, see [Enable Attack Surface Value type is string. + +ADMX Info: +- GP English name: *Configure Attack Surface Reduction rules* +- GP name: *ExploitGuard_ASR_Rules* +- GP element: *ExploitGuard_ASR_Rules* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -977,6 +1084,15 @@ Represents the average CPU load factor for the Windows Defender scan (in percent The default value is 50. + +ADMX Info: +- GP English name: *Specify the maximum percentage of CPU utilization during a scan* +- GP name: *Scan_AvgCPULoadFactor* +- GP element: *Scan_AvgCPULoadFactor* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + Valid values: 0–100 @@ -1035,6 +1151,15 @@ For more information about specific values that are supported, see the Windows D > This feature requires the "Join Microsoft MAPS" setting enabled in order to function. + +ADMX Info: +- GP English name: *Select cloud protection level* +- GP name: *MpEngine_MpCloudBlockLevel* +- GP element: *MpCloudBlockLevel* +- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1097,6 +1222,15 @@ For example, if the desired timeout is 60 seconds, specify 50 seconds in this se > This feature depends on three other MAPS settings the must all be enabled- "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required". + +ADMX Info: +- GP English name: *Configure extended cloud check* +- GP name: *MpEngine_MpBafsExtendedTimeout* +- GP element: *MpBafsExtendedTimeout* +- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1143,6 +1277,15 @@ For example, if the desired timeout is 60 seconds, specify 50 seconds in this se Added in Windows 10, version 1709. This policy setting allows user-specified applications to the guard my folders feature. Adding an allowed application means the guard my folders feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. + +ADMX Info: +- GP English name: *Configure allowed applications* +- GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* +- GP element: *ExploitGuard_ControlledFolderAccess_AllowedApplications* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1189,6 +1332,15 @@ Added in Windows 10, version 1709. This policy setting allows user-specified app Added in Windows 10, version 1709. This policy settings allows adding user-specified folder locations to the guard my folders feature. These folders will complement the system defined folders such as My Documents and My Pictures. The list of system folders will be displayed in the user interface and can not be changed. Value type is string. Use the | as the substring separator. + +ADMX Info: +- GP English name: *Configure protected folders* +- GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* +- GP element: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1239,6 +1391,15 @@ Time period (in days) that quarantine items will be stored on the system. The default value is 0, which keeps items in quarantine, and does not automatically remove them. + +ADMX Info: +- GP English name: *Configure removal of items from Quarantine folder* +- GP name: *Quarantine_PurgeItemsAfterDelay* +- GP element: *Quarantine_PurgeItemsAfterDelay* +- GP path: *Windows Components/Windows Defender Antivirus/Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + Valid values: 0–90 @@ -1289,6 +1450,15 @@ Valid values: 0–90 Added in Windows 10, version 1709. This policy enables setting the state (On/Off/Audit) for the guard my folders feature. The guard my folders feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2. + +ADMX Info: +- GP English name: *Configure Controlled folder access* +- GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* +- GP element: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1349,6 +1519,15 @@ If you disable this policy, users/apps will not be blocked from connecting to da If you do not configure this policy, network blocking will be disabled by default. + +ADMX Info: +- GP English name: *Prevent users and apps from accessing dangerous websites* +- GP name: *ExploitGuard_EnableNetworkProtection* +- GP element: *ExploitGuard_EnableNetworkProtection* +- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Network Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1404,6 +1583,15 @@ The following list shows the supported values: Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj". + +ADMX Info: +- GP English name: *Path Exclusions* +- GP name: *Exclusions_Paths* +- GP element: *Exclusions_PathsList* +- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1451,6 +1639,15 @@ Allows an administrator to specify a list of file type extensions to ignore duri Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a **|**. For example, "C:\\Example|C:\\Example1". + +ADMX Info: +- GP English name: *Extension Exclusions* +- GP name: *Exclusions_Extensions* +- GP element: *Exclusions_ExtensionsList* +- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1504,6 +1701,15 @@ Allows an administrator to specify a list of files opened by processes to ignore Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe". + +ADMX Info: +- GP English name: *Process Exclusions* +- GP name: *Exclusions_Processes* +- GP element: *Exclusions_ProcessesList* +- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + +
      @@ -1609,6 +1815,15 @@ Controls which sets of files should be monitored. > If **AllowOnAccessProtection** is not allowed, then this configuration can be used to monitor specific files. + +ADMX Info: +- GP English name: *Configure monitoring for incoming and outgoing file and program activity* +- GP name: *RealtimeProtection_RealtimeScanDirection* +- GP element: *RealtimeProtection_RealtimeScanDirection* +- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1664,6 +1879,15 @@ The following list shows the supported values: Selects whether to perform a quick scan or full scan. + +ADMX Info: +- GP English name: *Specify the scan type to use for a scheduled scan* +- GP name: *Scan_ScanParameters* +- GP element: *Scan_ScanParameters* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1727,6 +1951,15 @@ For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, an The default value is 120 + +ADMX Info: +- GP English name: *Specify the time for a daily quick scan* +- GP name: *Scan_ScheduleQuickScantime* +- GP element: *Scan_ScheduleQuickScantime* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + Valid values: 0–1380 @@ -1781,6 +2014,15 @@ Selects the day that the Windows Defender scan should run. > The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting. + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled scan* +- GP name: *Scan_ScheduleDay* +- GP element: *Scan_ScheduleDay* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -1851,6 +2093,15 @@ For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, an The default value is 120. + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled scan* +- GP name: *Scan_ScheduleTime* +- GP element: *Scan_ScheduleTime* +- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP ADMX file name: *WindowsDefender.admx* + + Valid values: 0–1380. @@ -1907,6 +2158,15 @@ A value of 0 means no check for new signatures, a value of 1 means to check ever The default value is 8. + +ADMX Info: +- GP English name: *Specify the interval to check for definition updates* +- GP name: *SignatureUpdate_SignatureUpdateInterval* +- GP element: *SignatureUpdate_SignatureUpdateInterval* +- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP ADMX file name: *WindowsDefender.admx* + + Valid values: 0–24. @@ -1958,6 +2218,15 @@ Valid values: 0–24. Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when **Defender/AllowCloudProtection** is allowed) before sending data. + +ADMX Info: +- GP English name: *Send file samples when further analysis is required* +- GP name: *SubmitSamplesConsent* +- GP element: *SubmitSamplesConsent* +- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -2032,6 +2301,15 @@ The following list shows the supported values for possible actions: - 10 – Block + +ADMX Info: +- GP English name: *Specify threat alert levels at which default action should not be taken when detected* +- GP name: *Threats_ThreatSeverityDefaultAction* +- GP element: *Threats_ThreatSeverityDefaultActionList* +- GP path: *Windows Components/Windows Defender Antivirus/Threats* +- GP ADMX file name: *WindowsDefender.admx* + +
      diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 94134afb5a..2dda85153c 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - DeliveryOptimization @@ -143,6 +143,15 @@ Added in Windows 10, version 1607. Specifies the maximum size in GB of Delivery The default value is 10. + +ADMX Info: +- GP English name: *Absolute Max Cache Size (in GB)* +- GP name: *AbsoluteMaxCacheSize* +- GP element: *AbsoluteMaxCacheSize* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -190,6 +199,15 @@ The default value is 10. Added in Windows 10, version 1703. Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network. + +ADMX Info: +- GP English name: *Enable Peer Caching while the device connects via VPN* +- GP name: *AllowVPNPeerCaching* +- GP element: *AllowVPNPeerCaching* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + The following list shows the supported values: @@ -242,6 +260,15 @@ Added in Windows 10, version 1803. This policy allows you to delay the use of an After the max delay is reached, the download will resume using HTTP, either downloading the entire payload or complementing the bytes that could not be downloaded from peers. Note that a download that is waiting for peer sources, will appear to be stuck for the end user. The recommended value is 1 hour (3600). + +ADMX Info: +- GP English name: *Delay background download from http (in secs)* +- GP name: *DelayBackgroundDownloadFromHttp* +- GP element: *DelayBackgroundDownloadFromHttp* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -291,6 +318,15 @@ Note that a download that is waiting for peer sources, will appear to be stuck f The recommended value is 1 minute (60). + +ADMX Info: +- GP English name: *Delay Foreground download from http (in secs)* +- GP name: *DelayForegroundDownloadFromHttp* +- GP element: *DelayForegroundDownloadFromHttp* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + The following list shows the supported values as number of seconds: @@ -346,6 +382,15 @@ The following list shows the supported values as number of seconds: Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates. + +ADMX Info: +- GP English name: *Download Mode* +- GP name: *DownloadMode* +- GP element: *DownloadMode* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + The following list shows the supported values: @@ -407,6 +452,15 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this > You must use a GUID as the group ID. + +ADMX Info: +- GP English name: *Group ID* +- GP name: *GroupId* +- GP element: *GroupId* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -458,6 +512,15 @@ The options set in this policy only apply to Group (2) download mode. If Group ( For option 4 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. + +ADMX Info: +- GP English name: *Select the source of Group IDs* +- GP name: *GroupIdSource* +- GP element: *GroupIdSource* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + The following list shows the supported values: @@ -516,6 +579,15 @@ Specifies the maximum time in seconds that each file is held in the Delivery Opt The default value is 259200 seconds (3 days). + +ADMX Info: +- GP English name: *Max Cache Age (in seconds)* +- GP name: *MaxCacheAge* +- GP element: *MaxCacheAge* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -565,6 +637,15 @@ Specifies the maximum cache size that Delivery Optimization can utilize, as a pe The default value is 20. + +ADMX Info: +- GP English name: *Max Cache Size (percentage)* +- GP name: *MaxCacheSize* +- GP element: *MaxCacheSize* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -614,6 +695,15 @@ Added in Windows 10, version 1607. Specifies the maximum download bandwidth in The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + +ADMX Info: +- GP English name: *Maximum Download Bandwidth (in KB/s)* +- GP name: *MaxDownloadBandwidth* +- GP element: *MaxDownloadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -663,6 +753,15 @@ Specifies the maximum upload bandwidth in KiloBytes/second that a device will us The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). + +ADMX Info: +- GP English name: *Max Upload Bandwidth (in KB/s)* +- GP name: *MaxUploadBandwidth* +- GP element: *MaxUploadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -712,6 +811,15 @@ Added in Windows 10, version 1607. Specifies the minimum download QoS (Quality The default value is 500. + +ADMX Info: +- GP English name: *Minimum Background QoS (in KB/s)* +- GP name: *MinBackgroundQos* +- GP element: *MinBackgroundQos* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -760,6 +868,15 @@ Added in Windows 10, version 1703. Specifies any value between 1 and 100 (in pe The default value is 0. The value 0 (zero) means "not limited" and the cloud service default value will be used. + +ADMX Info: +- GP English name: *Allow uploads while the device is on battery while under set Battery level (percentage)* +- GP name: *MinBatteryPercentageAllowedToUpload* +- GP element: *MinBatteryPercentageAllowedToUpload* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -812,6 +929,15 @@ Added in Windows 10, version 1703. Specifies the required minimum disk size (cap The default value is 32 GB. + +ADMX Info: +- GP English name: *Minimum disk size allowed to use Peer Caching (in GB)* +- GP name: *MinDiskSizeAllowedToPeer* +- GP element: *MinDiskSizeAllowedToPeer* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -861,6 +987,15 @@ Added in Windows 10, version 1703. Specifies the minimum content file size in MB The default value is 100 MB. + +ADMX Info: +- GP English name: *Minimum Peer Caching Content File Size (in MB)* +- GP name: *MinFileSizeToCache* +- GP element: *MinFileSizeToCache* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -910,6 +1045,15 @@ Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required The default value is 4 GB. + +ADMX Info: +- GP English name: *Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB)* +- GP name: *MinRAMAllowedToPeer* +- GP element: *MinRAMAllowedToPeer* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -959,6 +1103,15 @@ Added in Windows 10, version 1607. Specifies the drive that Delivery Optimizati By default, %SystemDrive% is used to store the cache. + +ADMX Info: +- GP English name: *Modify Cache Drive* +- GP name: *ModifyCacheDrive* +- GP element: *ModifyCacheDrive* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -1010,6 +1163,15 @@ The value 0 (zero) means "unlimited"; No monthly upload limit is applied if 0 is The default value is 20. + +ADMX Info: +- GP English name: *Monthly Upload Data Cap (in GB)* +- GP name: *MonthlyUploadDataCap* +- GP element: *MonthlyUploadDataCap* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -1157,6 +1319,15 @@ Options available are: 1=Subnet mask (more options will be added in a future rel Option 1 (Subnet mask) applies to both Download Mode LAN (1) and Group (2). + +ADMX Info: +- GP English name: *Select a method to restrict Peer Selection* +- GP name: *RestrictPeerSelectionBy* +- GP element: *RestrictPeerSelectionBy* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + The following list shows the supported values: @@ -1203,19 +1374,32 @@ The following list shows the supported values: -Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - -Note that downloads from LAN peers will not be throttled even when this policy is set. +Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. This policy allows an IT Admin to define the following: - Business hours range (for example 06:00 to 18:00) -- % of throttle for foreground traffic during business hours -- % of throttle for foreground traffic outside of business hours +- % of throttle for background traffic during business hours +- % of throttle for background traffic outside of business hours +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Business Hours to Limit Background Download Bandwidth* +- GP name: *SetHoursToLimitBackgroundDownloadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -1256,9 +1440,7 @@ This policy allows an IT Admin to define the following: -Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - -Note that downloads from LAN peers will not be throttled even when this policy is set. +Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. @@ -1269,6 +1451,21 @@ This policy allows an IT Admin to define the following: - % of throttle for foreground traffic outside of business hours +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Business Hours to Limit Foreground Download Bandwidth* +- GP name: *SetHoursToLimitForegroundDownloadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 56fcae51f5..2957bd78f7 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Desktop @@ -77,14 +77,14 @@ If you enable this setting, users are unable to type a new location in the Targe > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prohibit User from manually redirecting Profile Folders* - GP name: *DisablePersonalDirChange* - GP path: *Desktop* - GP ADMX file name: *desktop.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index bde8f4dc65..a516cc7ab4 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - DeviceGuard @@ -72,6 +72,14 @@ ms.date: 01/30/2018 Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer. + +ADMX Info: +- GP English name: *Turn On Virtualization Based Security* +- GP name: *VirtualizationBasedSecurity* +- GP path: *System/Device Guard* +- GP ADMX file name: *DeviceGuard.admx* + + The following list shows the supported values: @@ -122,6 +130,15 @@ The following list shows the supported values: Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer. + +ADMX Info: +- GP English name: *Turn On Virtualization Based Security* +- GP name: *VirtualizationBasedSecurity* +- GP element: *CredentialIsolationDrop* +- GP path: *System/Device Guard* +- GP ADMX file name: *DeviceGuard.admx* + + The following list shows the supported values: @@ -173,6 +190,15 @@ The following list shows the supported values: Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer. + +ADMX Info: +- GP English name: *Turn On Virtualization Based Security* +- GP name: *VirtualizationBasedSecurity* +- GP element: *RequirePlatformSecurityFeaturesDrop* +- GP path: *System/Device Guard* +- GP ADMX file name: *DeviceGuard.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 5813ea9ecb..c8b4f6b9d9 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - DeviceInstallation @@ -80,14 +80,14 @@ If you disable or do not configure this policy setting, devices can be installed > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent installation of devices that match any of these device IDs* - GP name: *DeviceInstall_IDs_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* - +
      @@ -142,14 +142,14 @@ If you disable or do not configure this policy setting, Windows can install and > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent installation of devices using drivers that match these device setup classes* - GP name: *DeviceInstall_Classes_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 2555067447..e418951b10 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - DeviceLock @@ -1020,6 +1020,12 @@ The minimum password age must be less than the Maximum password age, unless the Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default. + +GP Info: +- GP English name: *Minimum password age* +- GP path: *Windows Settings/Security Settings/Account Policies/Password Policy* + +
      @@ -1074,14 +1080,14 @@ If you enable this setting, users will no longer be able to modify slide show se > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent enabling lock screen slide show* - GP name: *CPL_Personalization_NoLockScreenSlideshow* - GP path: *Control Panel/Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 481bc438d3..827b347c3e 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -6,15 +6,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/05/2018 +ms.date: 03/05/2018 --- # Policy CSP - Display - -> [!WARNING] +> [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +
      @@ -80,15 +80,15 @@ ms.date: 02/05/2018 This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - + +ADMX Info: +- GP English name: *Configure Per-Process System DPI settings* +- GP name: *DisplayPerProcessSystemDpiSettings* +- GP element: *DisplayDisablePerProcessSystemDpiSettings* +- GP path: *System/Display* +- GP ADMX file name: *Display.admx* - - - - - - - +
      @@ -145,20 +145,22 @@ In some cases, you may see some unexpected behavior in some desktop applications Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. + +ADMX Info: +- GP English name: *Configure Per-Process System DPI settings* +- GP name: *DisplayPerProcessSystemDpiSettings* +- GP element: *DisplayGlobalPerProcessSystemDpiSettings* +- GP path: *System/Display* +- GP ADMX file name: *Display.admx* + + The following list shows the supported values: - 0 - Disable. - 1 - Enable. - - - - - - -
      @@ -202,15 +204,15 @@ The following list shows the supported values: This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - + +ADMX Info: +- GP English name: *Configure Per-Process System DPI settings* +- GP name: *DisplayPerProcessSystemDpiSettings* +- GP element: *DisplayEnablePerProcessSystemDpiSettings* +- GP path: *System/Display* +- GP ADMX file name: *Display.admx* - - - - - - - +
      @@ -262,6 +264,15 @@ If you disable or do not configure this policy setting, GDI DPI Scaling might st If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. + +ADMX Info: +- GP English name: *Turn off GdiDPIScaling for applications* +- GP name: *DisplayTurnOffGdiDPIScaling* +- GP element: *DisplayTurnOffGdiDPIScalingPrompt* +- GP path: *System/Display* +- GP ADMX file name: *Display.admx* + + To validate on Desktop, do the following: @@ -320,6 +331,15 @@ If you disable or do not configure this policy setting, GDI DPI Scaling will not If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. + +ADMX Info: +- GP English name: *Turn on GdiDPIScaling for applications* +- GP name: *DisplayTurnOnGdiDPIScaling* +- GP element: *DisplayTurnOnGdiDPIScalingPrompt* +- GP path: *System/Display* +- GP ADMX file name: *Display.admx* + + To validate on Desktop, do the following: diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 3583549ed4..8eab86d6e3 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Education @@ -117,6 +117,14 @@ The policy value is expected to be the name (network host name) of an installed Added in Windows 10, version 1709. Allows IT Admins to prevent user installation of additional printers from the printers settings. + +ADMX Info: +- GP English name: *Prevent addition of printers* +- GP name: *NoAddPrinter* +- GP path: *Control Panel/Printers* +- GP ADMX file name: *Printing.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index e33bbb0431..ed18d1d8d9 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - ErrorReporting @@ -99,14 +99,14 @@ If you disable or do not configure this policy setting, then the default consent > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Customize consent settings* - GP name: *WerConsentCustomize_2* - GP path: *Windows Components/Windows Error Reporting/Consent* - GP ADMX file name: *ErrorReporting.admx* - +
      @@ -161,14 +161,14 @@ If you disable or do not configure this policy setting, the Turn off Windows Err > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disable Windows Error Reporting* - GP name: *WerDisable_2* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* - +
      @@ -227,14 +227,14 @@ See also the Configure Error Reporting policy setting. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Display Error Notification* - GP name: *PCH_ShowUI* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* - +
      @@ -289,14 +289,14 @@ If you disable or do not configure this policy setting, then consent policy sett > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not send additional data* - GP name: *WerNoSecondLevelData_2* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* - +
      @@ -351,14 +351,14 @@ If you disable or do not configure this policy setting, Windows Error Reporting > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent display of the user interface for critical errors* - GP name: *WerDoNotShowUI* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index 10a8c1e6f4..e0d3529cc9 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - EventLogService @@ -78,7 +78,7 @@ If you enable this policy setting and a log file reaches its maximum size, new e If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. -Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. > [!TIP] @@ -88,14 +88,14 @@ Note: Old events may or may not be retained according to the "Backup log automat > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Control Event Log behavior when the log file reaches its maximum size* - GP name: *Channel_Log_Retention_1* - GP path: *Windows Components/Event Log Service/Application* - GP ADMX file name: *eventlog.admx* - +
      @@ -150,14 +150,14 @@ If you disable or do not configure this policy setting, the maximum size of the > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_1* - GP path: *Windows Components/Event Log Service/Application* - GP ADMX file name: *eventlog.admx* - +
      @@ -212,14 +212,14 @@ If you disable or do not configure this policy setting, the maximum size of the > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_2* - GP path: *Windows Components/Event Log Service/Security* - GP ADMX file name: *eventlog.admx* - +
      @@ -274,14 +274,14 @@ If you disable or do not configure this policy setting, the maximum size of the > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_4* - GP path: *Windows Components/Event Log Service/System* - GP ADMX file name: *eventlog.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 8d5e6e3703..b741cd983e 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/26/2018 +ms.date: 03/05/2018 --- # Policy CSP - Experience @@ -188,6 +188,14 @@ Specifies whether Cortana is allowed on the device. If you enable or don’t con Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Cortana* +- GP name: *AllowCortana* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -296,6 +304,14 @@ When Find My Device is on, the device and its location are registered in the clo When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. In Windows 10, version 1709 the user will not be able to view the location of the last use of their active digitizer on their device. + +ADMX Info: +- GP English name: *Turn On/Off Find My Device* +- GP name: *FindMy_AllowFindMyDeviceConfig* +- GP path: *Windows Components/Find My Device* +- GP ADMX file name: *FindMy.admx* + + The following list shows the supported values: @@ -593,6 +609,14 @@ Diagnostic data can include browser, app and feature usage, depending on the "Di Most restricted value is 0. + +ADMX Info: +- GP English name: *Do not use diagnostic data for tailored experiences* +- GP name: *DisableTailoredExperiencesWithDiagnosticData* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -701,6 +725,14 @@ The following list shows the supported values: Specifies whether to allow app and content suggestions from third-party software publishers in Windows spotlight features like lock screen spotlight, suggested apps in the Start menu, and Windows tips. Users may still see suggestions for Microsoft features, apps, and services. + +ADMX Info: +- GP English name: *Do not suggest third-party content in Windows spotlight* +- GP name: *DisableThirdPartySuggestions* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -813,6 +845,14 @@ This policy allows IT admins to turn on experiences that are typically for consu Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off Microsoft consumer experiences* +- GP name: *DisableWindowsConsumerFeatures* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -869,6 +909,14 @@ Specifies whether to turn off all Windows spotlight features at once. If you ena Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off all Windows spotlight features* +- GP name: *DisableWindowsSpotlightFeatures* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -924,6 +972,14 @@ Added in Windows 10, version 1703. This policy allows administrators to prevent Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off Windows Spotlight on Action Center* +- GP name: *DisableWindowsSpotlightOnActionCenter* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -975,23 +1031,24 @@ Added in Windows 10, version 1083. This policy allows IT admins to turn off Sugg - User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. - User Setting is changeable on a per user basis. -- If the Group policy is set to off, no suggestions will be shown to the user in Settings app. +- If the Group policy is set to off, no suggestions will be shown to the user in Settings app. + +ADMX Info: +- GP English name: *Turn off Windows Spotlight on Settings* +- GP name: *DisableWindowsSpotlightOnSettings* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: - 0 - Not allowed. - 1 - Allowed. - - - - - - -
      @@ -1041,6 +1098,14 @@ The Windows welcome experience feature introduces onboard users to Windows; for Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off the Windows Welcome Experience* +- GP name: *DisableWindowsSpotlightWindowsWelcomeExperience* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -1091,6 +1156,14 @@ The following list shows the supported values: Enables or disables Windows Tips / soft landing. + +ADMX Info: +- GP English name: *Do not show Windows tips* +- GP name: *DisableSoftLanding* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -1145,6 +1218,14 @@ The following list shows the supported values: Allows IT admins to specify whether spotlight should be used on the user's lock screen. If your organization does not have an Enterprise spotlight content service, then this policy will behave the same as a setting of 1. + +ADMX Info: +- GP English name: *Configure Windows spotlight on lock screen* +- GP name: *ConfigureWindowsSpotlight* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + The following list shows the supported values: @@ -1200,6 +1281,14 @@ If you enable this policy setting, users will no longer see feedback notificatio If you disable or do not configure this policy setting, users can control how often they receive feedback questions. + +ADMX Info: +- GP English name: *Do not show feedback notifications* +- GP name: *DoNotShowFeedbackNotifications* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *FeedbackNotifications.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index f52eb4c227..ca51c9a7a7 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - ExploitGuard @@ -68,6 +68,15 @@ Enables the IT admin to push out a configuration representing the desired system The system settings require a reboot; the application settings do not require a reboot. + +ADMX Info: +- GP English name: *Use a common set of exploit protection settings* +- GP name: *ExploitProtection_Name* +- GP element: *ExploitProtection_Name* +- GP path: *Windows Components/Windows Defender Exploit Guard/Exploit Protection* +- GP ADMX file name: *ExploitGuard.admx* + + Here is an example: diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index c03012e8f2..438387b1b6 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Handwriting @@ -72,6 +72,14 @@ In floating mode, the content is hidden behind a flying-in panel and results in The docked mode is especially useful in Kiosk mode where you do not expect the end-user to drag the flying-in panel out of the way. + +ADMX Info: +- GP English name: *Handwriting Panel Default Mode Docked* +- GP name: *PanelDefaultModeDocked* +- GP path: *Windows Components/Handwriting* +- GP ADMX file name: *Handwriting.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 4e2042350f..23a0b5a050 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - InternetExplorer @@ -804,14 +804,14 @@ If you disable or do not configure this policy setting, the user can configure t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Add a specific list of search providers to the user's list of search providers* - GP name: *AddSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -867,14 +867,14 @@ If you disable or do not configure this policy setting, ActiveX Filtering is not > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on ActiveX Filtering* - GP name: *TurnOnActiveXFiltering* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -922,7 +922,7 @@ This list can be used with the 'Deny all add-ons unless specifically allowed in If you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information: -Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, {000000000-0000-0000-0000-0000000000000}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced. +Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, ‘{000000000-0000-0000-0000-0000000000000}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced. Value - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field. @@ -936,14 +936,14 @@ If you disable this policy setting, the list is deleted. The 'Deny all add-ons u > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Add-on List* - GP name: *AddonManagement_AddOnList* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* - +
      @@ -984,6 +984,13 @@ ADMX Info: +This AutoComplete feature can remember and suggest User names and passwords on Forms. + +If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords". + +If you disable this setting the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords. + +If you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button. > [!TIP] @@ -993,14 +1000,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on the auto-complete feature for user names and passwords on forms* - GP name: *RestrictFormSuggestPW* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -1042,6 +1049,11 @@ ADMX Info: +This policy setting allows you to turn on the certificate address mismatch security warning. When this policy setting is turned on, the user is warned when visiting Secure HTTP (HTTPS) websites that present certificates issued for a different website address. This warning helps prevent spoofing attacks. + +If you enable this policy setting, the certificate address mismatch warning always appears. + +If you disable or do not configure this policy setting, the user can choose whether the certificate address mismatch warning appears (by using the Advanced page in the Internet Control panel). > [!TIP] @@ -1051,14 +1063,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on certificate address mismatch warning* - GP name: *IZ_PolicyWarnCertMismatch* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1100,6 +1112,15 @@ ADMX Info: +This policy setting allows the automatic deletion of specified items when the last browser window closes. The preferences selected in the Delete Browsing History dialog box (such as deleting temporary Internet files, cookies, history, form data, and passwords) are applied, and those items are deleted. + +If you enable this policy setting, deleting browsing history on exit is turned on. + +If you disable this policy setting, deleting browsing history on exit is turned off. + +If you do not configure this policy setting, it can be configured on the General tab in Internet Options. + +If the "Prevent access to Delete Browsing History" policy setting is enabled, this policy setting has no effect. > [!TIP] @@ -1109,14 +1130,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow deleting browsing history on exit* - GP name: *DBHDisableDeleteOnExit* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* - +
      @@ -1174,14 +1195,14 @@ If you do not configure this policy, users will be able to turn on or turn off E > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Enhanced Protected Mode* - GP name: *Advanced_EnableEnhancedProtectedMode* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1237,14 +1258,14 @@ If you disable or don't configure this policy setting, the menu option won't app > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Let users turn on and use Enterprise Mode from the Tools menu* - GP name: *EnterpriseModeEnable* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -1300,14 +1321,14 @@ If you disable or don't configure this policy setting, Internet Explorer opens a > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Use the Enterprise Mode IE website list* - GP name: *EnterpriseModeSiteList* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -1348,6 +1369,13 @@ ADMX Info: +This policy setting allows you to block an insecure fallback to SSL 3.0. When this policy is enabled, Internet Explorer will attempt to connect to sites using SSL 3.0 or below when TLS 1.0 or greater fails. + +We recommend that you do not allow insecure fallback in order to prevent a man-in-the-middle attack. + +This policy does not affect which security protocols are enabled. + +If you disable this policy, system defaults will be used. > [!TIP] @@ -1357,14 +1385,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow fallback to SSL 3.0 (Internet Explorer)* - GP name: *Advanced_EnableSSL3Fallback* - GP path: *Windows Components/Internet Explorer/Security Features* - GP ADMX file name: *inetres.admx* - +
      @@ -1420,14 +1448,14 @@ If you disable or do not configure this policy setting, the user can add and rem > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Use Policy List of Internet Explorer 7 sites* - GP name: *CompatView_UsePolicyList* - GP path: *Windows Components/Internet Explorer/Compatibility View* - GP ADMX file name: *inetres.admx* - +
      @@ -1485,14 +1513,14 @@ If you do not configure this policy setting, Internet Explorer uses an Internet > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Internet Explorer Standards Mode for local intranet* - GP name: *CompatView_IntranetSites* - GP path: *Windows Components/Internet Explorer/Compatibility View* - GP ADMX file name: *inetres.admx* - +
      @@ -1554,14 +1582,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Internet Zone Template* - GP name: *IZ_PolicyInternetZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1623,14 +1651,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Intranet Zone Template* - GP name: *IZ_PolicyIntranetZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1692,14 +1720,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Local Machine Zone Template* - GP name: *IZ_PolicyLocalMachineZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1761,14 +1789,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Locked-Down Internet Zone Template* - GP name: *IZ_PolicyInternetZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1830,14 +1858,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Locked-Down Intranet Zone Template* - GP name: *IZ_PolicyIntranetZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1899,14 +1927,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Locked-Down Local Machine Zone Template* - GP name: *IZ_PolicyLocalMachineZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -1968,14 +1996,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Locked-Down Restricted Sites Zone Template* - GP name: *IZ_PolicyRestrictedSitesZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2031,14 +2059,14 @@ If you disable or do not configure this policy setting, Internet Explorer does n > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Go to an intranet site for a one-word entry in the Address bar* - GP name: *UseIntranetSiteForOneWordEntry* - GP path: *Windows Components/Internet Explorer/Internet Settings/Advanced settings/Browsing* - GP ADMX file name: *inetres.admx* - +
      @@ -2084,9 +2112,9 @@ This policy setting allows you to manage a list of sites that you want to associ Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.) -If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information: +If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.  For each entry that you add to the list, enter the following information: -Valuename A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also includea specificprotocol. For example, if you enter http://www.contoso.comas the valuename, other protocols are not affected.If you enter just www.contoso.com,then all protocolsare affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict. +Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict. Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4. @@ -2100,14 +2128,14 @@ If you disable or do not configure this policy, users may choose their own site- > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Site to Zone Assignment List* - GP name: *IZ_Zonemaps* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2149,6 +2177,13 @@ ADMX Info: +This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file. + +If you enable this policy setting, users will be prompted to install or run files with an invalid signature. + +If you disable this policy setting, users cannot run or install files with an invalid signature. + +If you do not configure this policy, users can choose to run or install files with an invalid signature. > [!TIP] @@ -2158,14 +2193,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow software to run or install even if the signature is invalid* - GP name: *Advanced_InvalidSignatureBlock* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2207,9 +2242,9 @@ ADMX Info: -This policy setting controls the Suggested Sites feature, which recommends websites based on the users browsing activity. Suggested Sites reports a users browsing history to Microsoft to suggest sites that the user might want to visit. +This policy setting controls the Suggested Sites feature, which recommends websites based on the user’s browsing activity. Suggested Sites reports a user’s browsing history to Microsoft to suggest sites that the user might want to visit. -If you enable this policy setting, the user is not prompted to enable Suggested Sites. The users browsing history is sent to Microsoft to produce suggestions. +If you enable this policy setting, the user is not prompted to enable Suggested Sites. The user’s browsing history is sent to Microsoft to produce suggestions. If you disable this policy setting, the entry points and functionality associated with this feature are turned off. @@ -2223,14 +2258,14 @@ If you do not configure this policy setting, the user can turn on and turn off t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Suggested Sites* - GP name: *EnableSuggestedSites* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -2292,14 +2327,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Trusted Sites Zone Template* - GP name: *IZ_PolicyTrustedSitesZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2361,14 +2396,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Locked-Down Trusted Sites Zone Template* - GP name: *IZ_PolicyTrustedSitesZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2430,14 +2465,14 @@ Note. It is recommended to configure template policy settings in one Group Polic > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Restricted Sites Zone Template* - GP name: *IZ_PolicyRestrictedSitesZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2479,6 +2514,13 @@ ADMX Info: +This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. + +If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. + +If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. + +If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. > [!TIP] @@ -2488,14 +2530,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Check for server certificate revocation* - GP name: *Advanced_CertificateRevocation* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2537,6 +2579,13 @@ ADMX Info: +This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. + +If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers. + +If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. + +If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. > [!TIP] @@ -2546,14 +2595,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Check for signatures on downloaded programs* - GP name: *Advanced_DownloadSignatures* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -2595,6 +2644,15 @@ ADMX Info: +Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. + +This policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension. + +If you enable this policy setting, Internet Explorer requires consistent MIME data for all received files. + +If you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files. + +If you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files. > [!TIP] @@ -2604,14 +2662,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Internet Explorer Processes* -- GP name: *IESF_PolicyExplorerProcesses_2* -- GP path: *Windows Components/Internet Explorer/Security Features/Binary Behavior Security Restriction* +- GP name: *IESF_PolicyExplorerProcesses_5* +- GP path: *Windows Components/Internet Explorer/Security Features/Consistent Mime Handling* - GP ADMX file name: *inetres.admx* - +
      @@ -2669,14 +2727,14 @@ Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects* - GP name: *DisableFlashInIE* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* - +
      @@ -2732,14 +2790,14 @@ If you disable or do not configure this policy setting, the user can bypass Smar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent bypassing SmartScreen Filter warnings* - GP name: *DisableSafetyFilterOverride* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -2795,14 +2853,14 @@ If you disable or do not configure this policy setting, the user can bypass Smar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet* - GP name: *DisableSafetyFilterOverrideForAppRepUnknown* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -2844,6 +2902,11 @@ ADMX Info: +This setting specifies the number of days that Internet Explorer tracks views of pages in the History List. To access the Temporary Internet Files and History Settings dialog box, from the Menu bar, on the Tools menu, click Internet Options, click the General tab, and then click Settings under Browsing history. + +If you enable this policy setting, a user cannot set the number of days that Internet Explorer tracks views of the pages in the History List. You must specify the number of days that Internet Explorer tracks views of pages in the History List. Users can not delete browsing history. + +If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History list. Users can delete browsing history. > [!TIP] @@ -2853,14 +2916,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disable "Configuring History"* - GP name: *RestrictHistory* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* - +
      @@ -2902,6 +2965,11 @@ ADMX Info: +This policy setting allows you to manage the crash detection feature of add-on Management. + +If you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply. + +If you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional. > [!TIP] @@ -2911,14 +2979,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off Crash Detection* - GP name: *AddonManagement_RestrictCrashDetection* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -2976,14 +3044,14 @@ If you do not configure this policy setting, the user can choose to participate > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent participation in the Customer Experience Improvement Program* - GP name: *SQM_DisableCEIP* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3025,6 +3093,15 @@ ADMX Info: +This policy setting prevents the user from deleting the history of websites that he or she has visited. This feature is available in the Delete Browsing History dialog box. + +If you enable this policy setting, websites that the user has visited are preserved when he or she clicks Delete. + +If you disable this policy setting, websites that the user has visited are deleted when he or she clicks Delete. + +If you do not configure this policy setting, the user can choose whether to delete or preserve visited websites when he or she clicks Delete. + +If the "Prevent access to Delete Browsing History" policy setting is enabled, this policy setting is enabled by default. > [!TIP] @@ -3034,14 +3111,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent deleting websites that the user has visited* - GP name: *DBHDisableDeleteHistory* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* - +
      @@ -3097,14 +3174,14 @@ If you disable or do not configure this policy setting, the user can set the Fee > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent downloading of enclosures* - GP name: *Disable_Downloading_of_Enclosures* - GP path: *Windows Components/RSS Feeds* - GP ADMX file name: *inetres.admx* - +
      @@ -3146,7 +3223,7 @@ ADMX Info: -This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each others list of supported protocols and versions, and they select the most preferred match. +This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other’s list of supported protocols and versions, and they select the most preferred match. If you enable this policy setting, the browser negotiates or does not negotiate an encryption tunnel by using the encryption methods that you select from the drop-down list. @@ -3162,14 +3239,14 @@ Note: SSL 2.0 is off by default and is no longer supported starting with Windows > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off encryption support* - GP name: *Advanced_SetWinInetProtocols* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -3214,8 +3291,8 @@ ADMX Info: This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows. If you enable this policy setting, you must make one of the following choices: -Skip the First Run wizard, and go directly to the user's home page. -Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. +- Skip the First Run wizard, and go directly to the user's home page. +- Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen. @@ -3229,14 +3306,14 @@ If you disable or do not configure this policy setting, Internet Explorer may ru > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent running First Run wizard* - GP name: *NoFirstRunCustomise* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3296,14 +3373,14 @@ If you don't configure this setting, users can turn this behavior on or off, usi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off the flip ahead with page prediction feature* - GP name: *Advanced_DisableFlipAhead* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -3358,14 +3435,14 @@ If you disable or do not configure this policy setting, the Home page box is ena > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disable changing home page settings* - GP name: *RestrictHomePage* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3407,6 +3484,11 @@ ADMX Info: +This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as "expired", "revoked", or "name mismatch" errors) in Internet Explorer. + +If you enable this policy setting, the user cannot continue browsing. + +If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing. > [!TIP] @@ -3416,14 +3498,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent ignoring certificate errors* - GP name: *NoCertError* - GP path: *Windows Components/Internet Explorer/Internet Control Panel* - GP ADMX file name: *inetres.admx* - +
      @@ -3465,6 +3547,15 @@ ADMX Info: +This policy setting allows you to turn off the InPrivate Browsing feature. + +InPrivate Browsing prevents Internet Explorer from storing data about a user's browsing session. This includes cookies, temporary Internet files, history, and other data. + +If you enable this policy setting, InPrivate Browsing is turned off. + +If you disable this policy setting, InPrivate Browsing is available for use. + +If you do not configure this policy setting, InPrivate Browsing can be turned on or off through the registry. > [!TIP] @@ -3474,14 +3565,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off InPrivate Browsing* - GP name: *DisableInPrivateBrowsing* - GP path: *Windows Components/Internet Explorer/Privacy* - GP ADMX file name: *inetres.admx* - +
      @@ -3523,6 +3614,15 @@ ADMX Info: +This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows. + +Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used. + +If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. + +If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. + +If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default. > [!TIP] @@ -3532,14 +3632,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows* - GP name: *Advanced_EnableEnhancedProtectedMode64Bit* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -3595,14 +3695,14 @@ If you disable or do not configure this policy setting, the user can configure p > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent changing proxy settings* - GP name: *RestrictProxy* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3658,14 +3758,14 @@ If you disable or do not configure this policy setting, the user can change the > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent changing the default search provider* - GP name: *NoSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3713,7 +3813,7 @@ If you enable this policy setting, you can specify which default home pages shou If you disable or do not configure this policy setting, the user can add secondary home pages. -Note: If the Disable Changing Home Page Settings policy is enabled, the user cannot add secondary home pages. +Note: If the “Disable Changing Home Page Settings” policy is enabled, the user cannot add secondary home pages. > [!TIP] @@ -3723,14 +3823,14 @@ Note: If the Disable Changing Home Page Settings policy is enabled, the user can > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disable changing secondary home page settings* - GP name: *SecondaryHomePages* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3772,6 +3872,11 @@ ADMX Info: +This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. + +If you enable this policy setting, the feature is turned off. + +If you disable or do not configure this policy setting, the feature is turned on. > [!TIP] @@ -3781,14 +3886,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off the Security Settings Check feature* - GP name: *Disable_Security_Settings_Check* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3845,14 +3950,14 @@ This policy is intended to help the administrator maintain version control for I > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disable Periodic Check for Internet Explorer software updates* - GP name: *NoUpdateCheck* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -3894,6 +3999,15 @@ ADMX Info: +This policy setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. + +Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. + +When Enhanced Protected Mode is enabled, and a user encounters a website that attempts to load an ActiveX control that is not compatible with Enhanced Protected Mode, Internet Explorer notifies the user and gives the option to disable Enhanced Protected Mode for that particular website. + +If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. + +If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode. This is the default behavior. > [!TIP] @@ -3903,14 +4017,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled* - GP name: *Advanced_DisableEPMCompat* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* - +
      @@ -3971,14 +4085,14 @@ Also, see the "Security zones: Use only machine settings" policy. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Security Zones: Do not allow users to add/delete sites* - GP name: *Security_zones_map_edit* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -4039,14 +4153,14 @@ Also, see the "Security zones: Use only machine settings" policy. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Security Zones: Do not allow users to change policies* - GP name: *Security_options_edit* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -4104,14 +4218,14 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer* - GP name: *VerMgmtDisable* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* - +
      @@ -4173,14 +4287,14 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains* - GP name: *VerMgmtDomainAllowlist* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* - +
      @@ -4238,14 +4352,14 @@ If you do not configure this policy setting, users choose whether to force local > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Intranet Sites: Include all local (intranet) sites not listed in other zones* - GP name: *IZ_IncludeUnspecifiedLocalSites* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -4303,14 +4417,14 @@ If you do not configure this policy setting, users choose whether network paths > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Intranet Sites: Include all network paths (UNCs)* - GP name: *IZ_UNCAsIntranet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* - +
      @@ -4368,14 +4482,14 @@ If you do not configure this policy setting, users cannot load a page in the zon > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4433,14 +4547,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4496,14 +4610,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4545,6 +4659,15 @@ ADMX Info: +This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. + +If you enable this policy setting, a script can perform a clipboard operation. + +If you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations. + +If you disable this policy setting, a script cannot perform a clipboard operation. + +If you do not configure this policy setting, a script can perform a clipboard operation. > [!TIP] @@ -4554,14 +4677,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow cut, copy or paste operations from the clipboard via script* - GP name: *IZ_PolicyAllowPasteViaScript_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4603,6 +4726,13 @@ ADMX Info: +This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. + +If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone. + +If you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone. + +If you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. > [!TIP] @@ -4612,14 +4742,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow drag and drop or copy and paste files* - GP name: *IZ_PolicyDropOrPasteFiles_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4677,14 +4807,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4742,14 +4872,14 @@ If you do not configure this policy setting, Web sites from less privileged zone > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4791,6 +4921,13 @@ ADMX Info: +This policy setting allows you to manage the loading of Extensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that take advantage of the Windows Presentation Foundation. + +If you enable this policy setting and set the drop-down box to Enable, XAML files are automatically loaded inside Internet Explorer. The user cannot change this behavior. If you set the drop-down box to Prompt, the user is prompted for loading XAML files. + +If you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior. + +If you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer. > [!TIP] @@ -4800,14 +4937,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow loading of XAML files* - GP name: *IZ_Policy_XAML_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4865,14 +5002,14 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4914,6 +5051,11 @@ ADMX Info: +This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. + +If you enable this policy setting, the user is prompted before ActiveX controls can run from websites in this zone. The user can choose to allow the control to run from the current site or from all sites. + +If you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone. > [!TIP] @@ -4923,14 +5065,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow only approved domains to use ActiveX controls without prompt* - GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -4972,6 +5114,11 @@ ADMX Info: +This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites. + +If you enable this policy setting, the TDC ActiveX control will not run from websites in this zone. + +If you disable this policy setting, the TDC Active X control will run from all sites in this zone. > [!TIP] @@ -4981,14 +5128,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow only approved domains to use the TDC ActiveX control* - GP name: *IZ_PolicyAllowTDCControl_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5030,6 +5177,13 @@ ADMX Info: +This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. + +If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. + +If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. + +If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. > [!TIP] @@ -5039,14 +5193,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow script-initiated windows without size or position constraints* - GP name: *IZ_PolicyWindowsRestrictionsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5088,6 +5242,13 @@ ADMX Info: +This policy setting determines whether a page can control embedded WebBrowser controls via script. + +If you enable this policy setting, script access to the WebBrowser control is allowed. + +If you disable this policy setting, script access to the WebBrowser control is not allowed. + +If you do not configure this policy setting, the user can enable or disable script access to the WebBrowser control. By default, script access to the WebBrowser control is allowed only in the Local Machine and Intranet zones. > [!TIP] @@ -5097,14 +5258,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scripting of Internet Explorer WebBrowser controls* - GP name: *IZ_Policy_WebBrowserControl_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5162,14 +5323,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5229,14 +5390,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5278,6 +5439,11 @@ ADMX Info: +This policy setting allows you to manage whether script is allowed to update the status bar within the zone. + +If you enable this policy setting, script is allowed to update the status bar. + +If you disable or do not configure this policy setting, script is not allowed to update the status bar. > [!TIP] @@ -5287,14 +5453,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow updates to status bar via script* - GP name: *IZ_Policy_ScriptStatusBar_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5352,14 +5518,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5401,6 +5567,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. + +If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. > [!TIP] @@ -5410,14 +5583,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5459,6 +5632,13 @@ ADMX Info: +This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. + +If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded. + +If you disable the policy setting, signed controls cannot be downloaded. + +If you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded. > [!TIP] @@ -5468,14 +5648,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Download signed ActiveX controls* - GP name: *IZ_PolicyDownloadSignedActiveX_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5517,6 +5697,13 @@ ADMX Info: +This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. + +If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run. + +If you disable this policy setting, users cannot run unsigned controls. + +If you do not configure this policy setting, users cannot run unsigned controls. > [!TIP] @@ -5526,14 +5713,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Download unsigned ActiveX controls* - GP name: *IZ_PolicyDownloadUnsignedActiveX_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5575,6 +5762,11 @@ ADMX Info: +This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone. + +If you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections. + +If you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections. > [!TIP] @@ -5584,14 +5776,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Cross-Site Scripting Filter* - GP name: *IZ_PolicyTurnOnXSSFilter_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5633,6 +5825,15 @@ ADMX Info: +This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. + +If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. + +If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. + +In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog. + +In Internet Explorer 9 and earlier versions, if you disable this policy or do not configure it, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. > [!TIP] @@ -5642,14 +5843,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable dragging of content from different domains across windows* - GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5691,6 +5892,15 @@ ADMX Info: +This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. + +If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. + +If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. + +In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog. + +In Internet Explorer 9 and earlier versions, if you disable this policy setting or do not configure it, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. > [!TIP] @@ -5700,14 +5910,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable dragging of content from different domains within a window* - GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5749,6 +5959,13 @@ ADMX Info: +This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. + +If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. + +If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. + +If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. > [!TIP] @@ -5758,14 +5975,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable MIME Sniffing* - GP name: *IZ_PolicyMimeSniffingURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5807,6 +6024,13 @@ ADMX Info: +This policy setting allows you to turn on Protected Mode. Protected Mode helps protect Internet Explorer from exploited vulnerabilities by reducing the locations that Internet Explorer can write to in the registry and the file system. + +If you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode. + +If you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode. + +If you do not configure this policy setting, the user can turn on or turn off Protected Mode. > [!TIP] @@ -5816,14 +6040,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Protected Mode* - GP name: *IZ_Policy_TurnOnProtectedMode_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5865,6 +6089,13 @@ ADMX Info: +This policy setting controls whether or not local path information is sent when the user is uploading a file via an HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. For instance, files sent from the user's desktop may contain the user name as a part of the path. + +If you enable this policy setting, path information is sent when the user is uploading a file via an HTML form. + +If you disable this policy setting, path information is removed when the user is uploading a file via an HTML form. + +If you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent. > [!TIP] @@ -5874,14 +6105,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Include local path when user is uploading files to a server* - GP name: *IZ_Policy_LocalPathForUpload_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -5941,14 +6172,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6023,6 +6254,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, the permission is set to High Safety. > [!TIP] @@ -6032,14 +6276,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6081,6 +6325,13 @@ ADMX Info: +This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. + +If you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. + +If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. + +If you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. > [!TIP] @@ -6090,14 +6341,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Launching applications and files in an IFRAME* - GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6139,6 +6390,21 @@ ADMX Info: +This policy setting allows you to manage settings for logon options. + +If you enable this policy setting, you can choose from the following logon options. + +Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol. + +Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. + +Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. + +Automatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. + +If you disable this policy setting, logon is set to Automatic logon only in Intranet zone. + +If you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. > [!TIP] @@ -6148,14 +6414,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Logon options* - GP name: *IZ_PolicyLogon_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6213,14 +6479,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6262,6 +6528,13 @@ ADMX Info: +This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. + +If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. + +If you disable this policy setting, Internet Explorer will not execute signed managed components. + +If you do not configure this policy setting, Internet Explorer will execute signed managed components. > [!TIP] @@ -6271,14 +6544,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components signed with Authenticode* - GP name: *IZ_PolicySignedFrameworkComponentsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6320,6 +6593,13 @@ ADMX Info: +This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file share by using File Explorer, for example). + +If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. + +If you disable this policy setting, these files do not open. + +If you do not configure this policy setting, the user can configure how the computer handles these files. By default, these files are blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones. > [!TIP] @@ -6329,14 +6609,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Show security warning for potentially unsafe files* - GP name: *IZ_Policy_UnsafeFiles_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6378,6 +6658,13 @@ ADMX Info: +This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. + +If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. + +If you disable this policy setting, pop-up windows are not prevented from appearing. + +If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. > [!TIP] @@ -6387,14 +6674,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Use Pop-up Blocker* - GP name: *IZ_PolicyBlockPopupWindows_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6452,14 +6739,14 @@ If you do not configure this policy setting, users are queried to choose whether > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6517,14 +6804,14 @@ If you do not configure this policy setting, users will receive a prompt when a > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6580,14 +6867,14 @@ If you disable or do not configure this setting, users will receive a file downl > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6645,14 +6932,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6710,14 +6997,14 @@ If you do not configure this policy setting, Web sites from less privileged zone > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6775,14 +7062,14 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6840,14 +7127,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6907,14 +7194,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -6972,14 +7259,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7021,6 +7308,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. + +If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. > [!TIP] @@ -7030,14 +7324,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7097,14 +7391,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7146,6 +7440,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, the permission is set to Medium Safety. > [!TIP] @@ -7155,14 +7462,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7220,14 +7527,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7285,14 +7592,14 @@ If you do not configure this policy setting, users can load a page in the zone t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7350,14 +7657,14 @@ If you do not configure this policy setting, users will receive a prompt when a > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7413,14 +7720,14 @@ If you disable or do not configure this setting, users will receive a file downl > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7478,14 +7785,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7543,14 +7850,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7608,14 +7915,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7673,14 +7980,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7740,14 +8047,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7805,14 +8112,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7854,6 +8161,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. + +If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. > [!TIP] @@ -7863,14 +8177,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7930,14 +8244,14 @@ If you do not configure this policy setting, users are queried whether to allow > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -7979,6 +8293,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, the permission is set to Medium Safety. > [!TIP] @@ -7988,14 +8315,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8053,14 +8380,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8118,14 +8445,14 @@ If you do not configure this policy setting, users cannot load a page in the zon > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8183,14 +8510,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8246,14 +8573,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8311,14 +8638,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8376,14 +8703,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8441,14 +8768,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8506,14 +8833,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8573,14 +8900,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8638,14 +8965,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8705,14 +9032,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8754,6 +9081,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. > [!TIP] @@ -8763,14 +9103,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8828,14 +9168,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8893,14 +9233,14 @@ If you do not configure this policy setting, users are queried to choose whether > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -8958,14 +9298,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9021,14 +9361,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9086,14 +9426,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9151,14 +9491,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9216,14 +9556,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9281,14 +9621,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9348,14 +9688,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9413,14 +9753,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9480,14 +9820,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9545,14 +9885,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9610,14 +9950,14 @@ If you do not configure this policy setting, users can load a page in the zone t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9675,14 +10015,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9738,14 +10078,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9803,14 +10143,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9868,14 +10208,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9933,14 +10273,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -9998,14 +10338,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10065,14 +10405,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10130,14 +10470,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10197,14 +10537,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10246,6 +10586,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. > [!TIP] @@ -10255,14 +10608,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10320,14 +10673,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10385,14 +10738,14 @@ If you do not configure this policy setting, users cannot load a page in the zon > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10450,14 +10803,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10513,14 +10866,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10578,14 +10931,14 @@ If you do not configure this policy setting, users are queried whether to allow > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10643,14 +10996,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10708,14 +11061,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10773,14 +11126,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10840,14 +11193,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10905,14 +11258,14 @@ If you do not configure this policy setting, users cannot preserve information i > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -10972,14 +11325,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11021,6 +11374,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. > [!TIP] @@ -11030,14 +11396,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11095,14 +11461,14 @@ If you do not configure this policy setting, users cannot open other windows and > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11160,14 +11526,14 @@ If you do not configure this policy setting, users can load a page in the zone t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11225,14 +11591,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11288,14 +11654,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11353,14 +11719,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11418,14 +11784,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11483,14 +11849,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11548,14 +11914,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11615,14 +11981,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11680,14 +12046,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11747,14 +12113,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11796,6 +12162,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. > [!TIP] @@ -11805,14 +12184,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11870,14 +12249,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -11919,6 +12298,13 @@ ADMX Info: +The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail. + +If you enable this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail. + +If you disable this policy setting, applications can use the MK protocol API. Resources hosted on the MK protocol will work for the File Explorer and Internet Explorer processes. + +If you do not configure this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail. > [!TIP] @@ -11928,14 +12314,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_3* - GP path: *Windows Components/Internet Explorer/Security Features/MK Protocol Security Restriction* - GP ADMX file name: *inetres.admx* - +
      @@ -11977,6 +12363,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. + +If you enable this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type. + +If you disable this policy setting, Internet Explorer processes will allow a MIME sniff promoting a file of one type to a more dangerous file type. + +If you do not configure this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type. > [!TIP] @@ -11986,14 +12379,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_6* - GP path: *Windows Components/Internet Explorer/Security Features/Mime Sniffing Safety Feature* - GP ADMX file name: *inetres.admx* - +
      @@ -12035,6 +12428,13 @@ ADMX Info: +This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. + +If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. + +If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. + +If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes. > [!TIP] @@ -12044,14 +12444,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_10* - GP path: *Windows Components/Internet Explorer/Security Features/Notification bar* - GP ADMX file name: *inetres.admx* - +
      @@ -12093,6 +12493,11 @@ ADMX Info: +This policy setting prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. + +If you enable this policy setting, the user is not prompted to turn on SmartScreen Filter. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user. + +If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience. > [!TIP] @@ -12102,14 +12507,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent managing SmartScreen Filter* - GP name: *Disable_Managing_Safety_Filter_IE9* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -12151,6 +12556,11 @@ ADMX Info: +This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. + +If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. + +If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis. > [!TIP] @@ -12160,14 +12570,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Prevent per-user installation of ActiveX controls* - GP name: *DisablePerUserActiveXInstall* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -12209,6 +12619,11 @@ ADMX Info: +Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). For example, Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. + +If you enable this policy setting, any zone can be protected from zone elevation for all processes. + +If you disable or do not configure this policy setting, processes other than Internet Explorer or those listed in the Process List receive no such protection. > [!TIP] @@ -12218,14 +12633,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *All Processes* - GP name: *IESF_PolicyAllProcesses_9* - GP path: *Windows Components/Internet Explorer/Security Features/Protection From Zone Elevation* - GP ADMX file name: *inetres.admx* - +
      @@ -12267,6 +12682,13 @@ ADMX Info: +This policy setting allows you to stop users from seeing the "Run this time" button and from running specific outdated ActiveX controls in Internet Explorer. + +If you enable this policy setting, users won't see the "Run this time" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control. + +If you disable or don't configure this policy setting, users will see the "Run this time" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once. + +For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library. > [!TIP] @@ -12276,14 +12698,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer * - GP name: *VerMgmtDisableRunThisTime* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* - +
      @@ -12325,6 +12747,11 @@ ADMX Info: +This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation. + +If you enable this policy setting, the Web Browser Control will block automatic prompting of ActiveX control installation for all processes. + +If you disable or do not configure this policy setting, the Web Browser Control will not block automatic prompting of ActiveX control installation for all processes. > [!TIP] @@ -12334,14 +12761,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *All Processes* - GP name: *IESF_PolicyAllProcesses_11* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict ActiveX Install* - GP ADMX file name: *inetres.admx* - +
      @@ -12383,6 +12810,11 @@ ADMX Info: +This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated. + +If you enable this policy setting, the Web Browser Control will block automatic prompting of file downloads that are not user initiated for all processes. + +If you disable this policy setting, the Web Browser Control will not block automatic prompting of file downloads that are not user initiated for all processes. > [!TIP] @@ -12392,14 +12824,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *All Processes* - GP name: *IESF_PolicyAllProcesses_12* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict File Download* - GP ADMX file name: *inetres.admx* - +
      @@ -12457,14 +12889,14 @@ If you do not configure this policy setting, users cannot load a page in the zon > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12506,6 +12938,13 @@ ADMX Info: +This policy setting allows you to manage whether script code on pages in the zone is run. + +If you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run. + +If you disable this policy setting, script code on pages in the zone is prevented from running. + +If you do not configure this policy setting, script code on pages in the zone is prevented from running. > [!TIP] @@ -12515,14 +12954,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow active scripting* - GP name: *IZ_PolicyActiveScripting_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12580,14 +13019,14 @@ If you do not configure this policy setting, ActiveX control installations will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12643,14 +13082,14 @@ If you disable or do not configure this setting, file downloads that are not use > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12692,6 +13131,13 @@ ADMX Info: +This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. + +If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. + +If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. + +If you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. > [!TIP] @@ -12701,14 +13147,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow binary and script behaviors* - GP name: *IZ_PolicyBinaryBehaviors_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12750,6 +13196,15 @@ ADMX Info: +This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. + +If you enable this policy setting, a script can perform a clipboard operation. + +If you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations. + +If you disable this policy setting, a script cannot perform a clipboard operation. + +If you do not configure this policy setting, a script cannot perform a clipboard operation. > [!TIP] @@ -12759,14 +13214,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow cut, copy or paste operations from the clipboard via script* - GP name: *IZ_PolicyAllowPasteViaScript_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12808,6 +13263,13 @@ ADMX Info: +This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. + +If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone. + +If you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone. + +If you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone. > [!TIP] @@ -12817,14 +13279,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow drag and drop or copy and paste files* - GP name: *IZ_PolicyDropOrPasteFiles_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12866,6 +13328,13 @@ ADMX Info: +This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. + +If you enable this policy setting, files can be downloaded from the zone. + +If you disable this policy setting, files are prevented from being downloaded from the zone. + +If you do not configure this policy setting, files are prevented from being downloaded from the zone. > [!TIP] @@ -12875,14 +13344,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow file downloads* - GP name: *IZ_PolicyFileDownload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -12940,14 +13409,14 @@ If you do not configure this policy setting, users are queried whether to allow > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13005,14 +13474,14 @@ If you do not configure this policy setting, the possibly harmful navigations ar > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13054,6 +13523,13 @@ ADMX Info: +This policy setting allows you to manage the loading of Extensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that take advantage of the Windows Presentation Foundation. + +If you enable this policy setting and set the drop-down box to Enable, XAML files are automatically loaded inside Internet Explorer. The user cannot change this behavior. If you set the drop-down box to Prompt, the user is prompted for loading XAML files. + +If you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior. + +If you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer. > [!TIP] @@ -13063,14 +13539,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow loading of XAML files* - GP name: *IZ_Policy_XAML_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13112,6 +13588,13 @@ ADMX Info: +This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. + +If you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. + +If you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. + +If you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. > [!TIP] @@ -13121,14 +13604,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow META REFRESH* - GP name: *IZ_PolicyAllowMETAREFRESH_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13186,14 +13669,14 @@ If you do not configure this policy setting, Internet Explorer will not execute > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13235,6 +13718,11 @@ ADMX Info: +This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. + +If you enable this policy setting, the user is prompted before ActiveX controls can run from websites in this zone. The user can choose to allow the control to run from the current site or from all sites. + +If you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone. > [!TIP] @@ -13244,14 +13732,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow only approved domains to use ActiveX controls without prompt* - GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13293,6 +13781,11 @@ ADMX Info: +This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites. + +If you enable this policy setting, the TDC ActiveX control will not run from websites in this zone. + +If you disable this policy setting, the TDC Active X control will run from all sites in this zone. > [!TIP] @@ -13302,14 +13795,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow only approved domains to use the TDC ActiveX control* - GP name: *IZ_PolicyAllowTDCControl_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13351,6 +13844,13 @@ ADMX Info: +This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. + +If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. + +If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. + +If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. > [!TIP] @@ -13360,14 +13860,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow script-initiated windows without size or position constraints* - GP name: *IZ_PolicyWindowsRestrictionsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13409,6 +13909,13 @@ ADMX Info: +This policy setting determines whether a page can control embedded WebBrowser controls via script. + +If you enable this policy setting, script access to the WebBrowser control is allowed. + +If you disable this policy setting, script access to the WebBrowser control is not allowed. + +If you do not configure this policy setting, the user can enable or disable script access to the WebBrowser control. By default, script access to the WebBrowser control is allowed only in the Local Machine and Intranet zones. > [!TIP] @@ -13418,14 +13925,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scripting of Internet Explorer WebBrowser controls* - GP name: *IZ_Policy_WebBrowserControl_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13483,14 +13990,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13550,14 +14057,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13599,6 +14106,11 @@ ADMX Info: +This policy setting allows you to manage whether script is allowed to update the status bar within the zone. + +If you enable this policy setting, script is allowed to update the status bar. + +If you disable or do not configure this policy setting, script is not allowed to update the status bar. > [!TIP] @@ -13608,14 +14120,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow updates to status bar via script* - GP name: *IZ_Policy_ScriptStatusBar_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13673,14 +14185,14 @@ If you do not configure this policy setting, users cannot preserve information i > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13722,6 +14234,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. + +If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. > [!TIP] @@ -13731,14 +14250,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13780,6 +14299,13 @@ ADMX Info: +This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. + +If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded. + +If you disable the policy setting, signed controls cannot be downloaded. + +If you do not configure this policy setting, signed controls cannot be downloaded. > [!TIP] @@ -13789,14 +14315,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Download signed ActiveX controls* - GP name: *IZ_PolicyDownloadSignedActiveX_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13838,6 +14364,13 @@ ADMX Info: +This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. + +If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run. + +If you disable this policy setting, users cannot run unsigned controls. + +If you do not configure this policy setting, users cannot run unsigned controls. > [!TIP] @@ -13847,14 +14380,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Download unsigned ActiveX controls* - GP name: *IZ_PolicyDownloadUnsignedActiveX_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13896,6 +14429,11 @@ ADMX Info: +This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone. + +If you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections. + +If you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections. > [!TIP] @@ -13905,14 +14443,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Cross-Site Scripting Filter* - GP name: *IZ_PolicyTurnOnXSSFilter_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -13954,6 +14492,15 @@ ADMX Info: +This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. + +If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. + +If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. + +In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog. + +In Internet Explorer 9 and earlier versions, if you disable this policy or do not configure it, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. > [!TIP] @@ -13963,14 +14510,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable dragging of content from different domains across windows* - GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14012,6 +14559,15 @@ ADMX Info: +This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. + +If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. + +If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. + +In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog. + +In Internet Explorer 9 and earlier versions, if you disable this policy setting or do not configure it, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. > [!TIP] @@ -14021,14 +14577,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable dragging of content from different domains within a window* - GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14070,6 +14626,13 @@ ADMX Info: +This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. + +If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. + +If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. + +If you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. > [!TIP] @@ -14079,14 +14642,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable MIME Sniffing* - GP name: *IZ_PolicyMimeSniffingURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14128,6 +14691,13 @@ ADMX Info: +This policy setting controls whether or not local path information is sent when the user is uploading a file via an HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. For instance, files sent from the user's desktop may contain the user name as a part of the path. + +If you enable this policy setting, path information is sent when the user is uploading a file via an HTML form. + +If you disable this policy setting, path information is removed when the user is uploading a file via an HTML form. + +If you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent. > [!TIP] @@ -14137,14 +14707,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Include local path when user is uploading files to a server* - GP name: *IZ_Policy_LocalPathForUpload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14204,14 +14774,14 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14253,6 +14823,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. > [!TIP] @@ -14262,14 +14845,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14311,6 +14894,13 @@ ADMX Info: +This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. + +If you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. + +If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. + +If you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. > [!TIP] @@ -14320,14 +14910,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Launching applications and files in an IFRAME* - GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14369,6 +14959,21 @@ ADMX Info: +This policy setting allows you to manage settings for logon options. + +If you enable this policy setting, you can choose from the following logon options. + +Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol. + +Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. + +Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. + +Automatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. + +If you disable this policy setting, logon is set to Automatic logon only in Intranet zone. + +If you do not configure this policy setting, logon is set to Prompt for username and password. > [!TIP] @@ -14378,14 +14983,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Logon options* - GP name: *IZ_PolicyLogon_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14443,14 +15048,14 @@ If you do not configure this policy setting, users cannot open other windows and > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14492,6 +15097,15 @@ ADMX Info: +This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. + +If you enable this policy setting, controls and plug-ins can run without user intervention. + +If you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run. + +If you disable this policy setting, controls and plug-ins are prevented from running. + +If you do not configure this policy setting, controls and plug-ins are prevented from running. > [!TIP] @@ -14501,14 +15115,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run ActiveX controls and plugins* - GP name: *IZ_PolicyRunActiveXControls_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14550,6 +15164,13 @@ ADMX Info: +This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. + +If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. + +If you disable this policy setting, Internet Explorer will not execute signed managed components. + +If you do not configure this policy setting, Internet Explorer will not execute signed managed components. > [!TIP] @@ -14559,14 +15180,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components signed with Authenticode* - GP name: *IZ_PolicySignedFrameworkComponentsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14608,6 +15229,15 @@ ADMX Info: +This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script. + +If you enable this policy setting, script interaction can occur automatically without user intervention. + +If you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction. + +If you disable this policy setting, script interaction is prevented from occurring. + +If you do not configure this policy setting, script interaction is prevented from occurring. > [!TIP] @@ -14617,14 +15247,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Script ActiveX controls marked safe for scripting* - GP name: *IZ_PolicyScriptActiveXMarkedSafe_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14666,6 +15296,15 @@ ADMX Info: +This policy setting allows you to manage whether applets are exposed to scripts within the zone. + +If you enable this policy setting, scripts can access applets automatically without user intervention. + +If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets. + +If you disable this policy setting, scripts are prevented from accessing applets. + +If you do not configure this policy setting, scripts are prevented from accessing applets. > [!TIP] @@ -14675,14 +15314,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Scripting of Java applets* - GP name: *IZ_PolicyScriptingOfJavaApplets_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14724,6 +15363,13 @@ ADMX Info: +This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file share by using File Explorer, for example). + +If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. + +If you disable this policy setting, these files do not open. + +If you do not configure this policy setting, the user can configure how the computer handles these files. By default, these files are blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones. > [!TIP] @@ -14733,14 +15379,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Show security warning for potentially unsafe files* - GP name: *IZ_Policy_UnsafeFiles_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14782,6 +15428,13 @@ ADMX Info: +This policy setting allows you to turn on Protected Mode. Protected Mode helps protect Internet Explorer from exploited vulnerabilities by reducing the locations that Internet Explorer can write to in the registry and the file system. + +If you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode. + +If you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode. + +If you do not configure this policy setting, the user can turn on or turn off Protected Mode. > [!TIP] @@ -14791,14 +15444,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on Protected Mode* - GP name: *IZ_Policy_TurnOnProtectedMode_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14840,6 +15493,13 @@ ADMX Info: +This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. + +If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. + +If you disable this policy setting, pop-up windows are not prevented from appearing. + +If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. > [!TIP] @@ -14849,14 +15509,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Use Pop-up Blocker* - GP name: *IZ_PolicyBlockPopupWindows_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -14898,6 +15558,11 @@ ADMX Info: +Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars. + +If you enable this policy setting, scripted windows are restricted for all processes. + +If you disable or do not configure this policy setting, scripted windows are not restricted. > [!TIP] @@ -14907,14 +15572,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *All Processes* - GP name: *IESF_PolicyAllProcesses_8* - GP path: *Windows Components/Internet Explorer/Security Features/Scripted Window Security Restrictions* - GP ADMX file name: *inetres.admx* - +
      @@ -14970,14 +15635,14 @@ If you disable or do not configure this policy setting, the user can configure h > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Restrict search providers to a specific list* - GP name: *SpecificSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -15018,6 +15683,15 @@ ADMX Info: +Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level. + +If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer. + +If you disable this policy or do not configure it, users of the same computer can establish their own security zone settings. + +This policy is intended to ensure that security zone settings apply uniformly to the same computer and do not vary from user to user. + +Also, see the "Security zones: Do not allow users to change policies" policy. > [!TIP] @@ -15027,14 +15701,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Security Zones: Use only machine settings * - GP name: *Security_HKLM_only* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -15076,6 +15750,11 @@ ADMX Info: +This policy setting allows you to specify how ActiveX controls are installed. + +If you enable this policy setting, ActiveX controls are installed only if the ActiveX Installer Service is present and has been configured to allow the installation of ActiveX controls. + +If you disable or do not configure this policy setting, ActiveX controls, including per-user controls, are installed through the standard installation process. > [!TIP] @@ -15085,14 +15764,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify use of ActiveX Installer Service for installation of ActiveX controls* - GP name: *OnlyUseAXISForActiveXInstall* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* - +
      @@ -15150,14 +15829,14 @@ If you do not configure this policy setting, users can load a page in the zone t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15215,14 +15894,14 @@ If you do not configure this policy setting, users will receive a prompt when a > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15278,14 +15957,14 @@ If you disable or do not configure this setting, users will receive a file downl > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15343,14 +16022,14 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15408,14 +16087,14 @@ If you do not configure this policy setting, a warning is issued to the user tha > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15473,14 +16152,14 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15538,14 +16217,14 @@ If you do not configure this policy setting, the user can enable or disable scri > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15605,14 +16284,14 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15670,14 +16349,14 @@ If you do not configure this policy setting, users can preserve information in t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15719,6 +16398,13 @@ ADMX Info: +This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. + +If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. + +If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. > [!TIP] @@ -15728,14 +16414,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15795,14 +16481,14 @@ If you do not configure this policy setting, users are queried whether to allow > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15844,6 +16530,19 @@ ADMX Info: +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, the permission is set to Low Safety. > [!TIP] @@ -15853,14 +16552,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      @@ -15918,14 +16617,14 @@ If you do not configure this policy setting, users can open windows and frames f > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 361a19a81c..6831acebc5 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Kerberos @@ -89,14 +89,14 @@ If you disable or do not configure this policy setting, the Kerberos client does > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Use forest search order* - GP name: *ForestSearch* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* - +
      @@ -137,7 +137,7 @@ ADMX Info: -This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. +This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring. If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. @@ -150,14 +150,14 @@ If you disable or do not configure this policy setting, the client devices will > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring* - GP name: *EnableCbacAndArmor* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* - +
      @@ -202,9 +202,9 @@ This policy setting controls whether a computer requires that Kerberos message e Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled. -If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers. +If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers. -Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring. +Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring. If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain. @@ -216,14 +216,14 @@ If you disable or do not configure this policy setting, the client computers in > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Fail authentication requests when Kerberos armoring is not available* - GP name: *ClientRequireFast* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* - +
      @@ -264,7 +264,7 @@ ADMX Info: -This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon. +This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon. If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate. @@ -278,14 +278,14 @@ If you disable or do not configure this policy setting, the Kerberos client requ > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Require strict KDC validation* - GP name: *ValidateKDC* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* - +
      @@ -328,11 +328,11 @@ ADMX Info: This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size. -The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token. +The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token. If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller. -If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value. +If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value. Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes. @@ -344,14 +344,14 @@ Note: This policy setting configures the existing MaxTokenSize registry value in > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set maximum Kerberos SSPI context token buffer size* - GP name: *MaxTokenSize* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 66109605f7..0e063d9b5f 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Licensing @@ -69,6 +69,14 @@ ms.date: 01/30/2018 Added in Windows 10, version 1607. Enables or Disable Windows license reactivation on managed devices. + +ADMX Info: +- GP English name: *Control Device Reactivation for Retail devices* +- GP name: *AllowWindowsEntitlementReactivation* +- GP path: *Windows Components/Software Protection Platform* +- GP ADMX file name: *AVSValidationGP.admx* + + The following list shows the supported values: @@ -119,6 +127,14 @@ The following list shows the supported values: Added in Windows 10, version 1607. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state. + +ADMX Info: +- GP English name: *Turn off KMS Client Online AVS Validation* +- GP name: *NoAcquireGT* +- GP path: *Windows Components/Software Protection Platform* +- GP ADMX file name: *AVSValidationGP.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index f67234078a..1ffde8a086 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -238,6 +238,12 @@ If you disable or do not configure this policy (recommended), users will be able Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Block Microsoft accounts* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + The following list shows the supported values: @@ -297,6 +303,12 @@ Default: Disabled. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Administrator account status* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - local Administrator account is disabled @@ -352,6 +364,12 @@ Note: If the Guest account is disabled and the security option Network Access: S Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Guest account status* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - local Guest account is disabled @@ -415,6 +433,12 @@ It is possible for applications that use remote interactive logons to bypass thi Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Limit local account use of blank passwords to console logon only* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled - local accounts that are not password protected can be used to log on from locations other than the physical computer console @@ -470,6 +494,12 @@ Default: Administrator. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Rename administrator account* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -519,6 +549,12 @@ Default: Guest. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Accounts: Rename guest account* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -569,6 +605,12 @@ Caution: Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. + +GP Info: +- GP English name: *Devices: Allow undock without having to log on* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -619,6 +661,12 @@ This security setting determines who is allowed to format and eject removable NT Default: This policy is not defined and only Administrators have this ability. + +GP Info: +- GP English name: *Devices: Allowed to format and eject removable media* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -671,6 +719,12 @@ Note This setting does not affect the ability to add a local printer. This setting does not affect Administrators. + +GP Info: +- GP English name: *Devices: Prevent users from installing printer drivers* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -720,6 +774,12 @@ If this policy is enabled, it allows only the interactively logged-on user to ac Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. + +GP Info: +- GP English name: *Devices: Restrict CD-ROM access to locally logged-on user only* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -780,6 +840,12 @@ If this policy is enabled, the policy Domain member: Digitally sign secure chann Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. + +GP Info: +- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -837,6 +903,12 @@ There is no known reason for disabling this setting. Besides unnecessarily reduc Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. + +GP Info: +- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -888,6 +960,12 @@ This setting determines whether or not the domain member attempts to negotiate s Default: Enabled. + +GP Info: +- GP English name: *Domain member: Digitally sign secure channel data (when possible)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -940,6 +1018,12 @@ This security setting should not be enabled. Computer account passwords are used This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. + +GP Info: +- GP English name: *Domain member: Disable machine account password changes* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -991,6 +1075,12 @@ Important This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. + +GP Info: +- GP English name: *Domain member: Maximum machine account password age* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1053,6 +1143,12 @@ In order to take advantage of this policy on member workstations and servers, al In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. + +GP Info: +- GP English name: *Domain member: Require strong (Windows 2000 or later) session key* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1099,6 +1195,12 @@ Interactive Logon:Display user information when the session is locked Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Display user information when the session is locked* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 1 - User display name, domain and user names @@ -1158,6 +1260,12 @@ Default: Disabled. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Don't display last signed-in* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled (username will be shown) @@ -1217,6 +1325,12 @@ Default: Disabled. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Don't display username at sign-in* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled (username will be shown) @@ -1277,6 +1391,12 @@ Default on stand-alone computers: Enabled. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Do not require CTRL+ALT+DEL* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled @@ -1332,6 +1452,12 @@ Default: not enforced. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Machine inactivity limit* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled @@ -1389,6 +1515,12 @@ Default: No message. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Message text for users attempting to log on* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1438,6 +1570,12 @@ Default: No message. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Interactive logon: Message title for users attempting to log on* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1502,6 +1640,12 @@ Default: This policy is not defined, which means that the system treats it as No On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. + +GP Info: +- GP English name: *Interactive logon: Smart card removal behavior* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1567,6 +1711,12 @@ SMB packet signing can significantly degrade SMB performance, depending on diale For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + +GP Info: +- GP English name: *Microsoft network client: Digitally sign communications (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1629,6 +1779,12 @@ SMB packet signing can significantly degrade SMB performance, depending on diale For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + +GP Info: +- GP English name: *Microsoft network client: Digitally sign communications (if server agrees)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1678,6 +1834,12 @@ Sending unencrypted passwords is a security risk. Default: Disabled. + +GP Info: +- GP English name: *Microsoft network client: Send unencrypted password to third-party SMB servers* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1729,6 +1891,12 @@ For this policy setting, a value of 0 means to disconnect an idle session as qui Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. + +GP Info: +- GP English name: *Microsoft network server: Amount of idle time required before suspending session* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1803,6 +1971,12 @@ HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecurity For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + +GP Info: +- GP English name: *Microsoft network server: Digitally sign communications (always)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1869,6 +2043,12 @@ SMB packet signing can significantly degrade SMB performance, depending on diale For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. + +GP Info: +- GP English name: *Microsoft network server: Digitally sign communications (if client agrees)* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1928,6 +2108,12 @@ Important This policy has no impact on domain controllers. + +GP Info: +- GP English name: *Network access: Do not allow anonymous enumeration of SAM accounts* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -1977,6 +2163,12 @@ Windows allows anonymous users to perform certain activities, such as enumeratin Default: Disabled. + +GP Info: +- GP English name: *Network access: Do not allow anonymous enumeration of SAM accounts and shares* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2077,6 +2269,12 @@ Network access: Shares that can be accessed anonymously Default: Enabled. + +GP Info: +- GP English name: *Network access: Restrict anonymous access to Named Pipes and Shares* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2126,6 +2324,12 @@ If not selected, the default security descriptor will be used. This policy is supported on at least Windows Server 2016. + +GP Info: +- GP English name: *Network access: Restrict clients allowed to make remote calls to SAM* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2231,6 +2435,12 @@ This policy will be turned off by default on domain joined machines. This would Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Network security: Allow PKU2U authentication requests to this computer to use online identities.* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled @@ -2291,6 +2501,12 @@ Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authenticat This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. + +GP Info: +- GP English name: *Network security: Do not store LAN Manager hash value on next password change* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2360,6 +2576,12 @@ Windows Server 2003: Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only + +GP Info: +- GP English name: *Network security: LAN Manager authentication level* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2414,6 +2636,12 @@ Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + +GP Info: +- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2468,6 +2696,12 @@ Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Windows 7 and Windows Server 2008 R2: Require 128-bit encryption + +GP Info: +- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) servers* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2568,6 +2802,12 @@ Default on servers: Disabled. Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *Shutdown: Allow system to be shut down without having to log on* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled @@ -2625,6 +2865,12 @@ When this policy is enabled, it causes the system pagefile to be cleared upon cl Default: Disabled. + +GP Info: +- GP English name: *Shutdown: Clear virtual memory pagefile* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2727,6 +2973,12 @@ The secure desktop can be disabled only by the user of the interactive desktop o Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + Valid values: - 0 - disabled @@ -2794,6 +3046,12 @@ The options are: Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2840,6 +3098,12 @@ This policy setting controls the behavior of the elevation prompt for standard u Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Behavior of the elevation prompt for standard users* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + The following list shows the supported values: @@ -2899,6 +3163,12 @@ Enabled: (Default) When an application installation package is detected that req Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. + +GP Info: +- GP English name: *User Account Control: Detect application installations and prompt for elevation* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -2950,6 +3220,12 @@ The options are: Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Only elevate executables that are signed and validated* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -3007,6 +3283,12 @@ The options are: Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Only elevate UIAccess applications that are installed in secure locations* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -3059,6 +3341,12 @@ The options are: Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Run all administrators in Admin Approval Mode* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -3110,6 +3398,12 @@ The options are: Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Switch to the secure desktop when prompting for elevation* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -3161,6 +3455,12 @@ The options are: • Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. + +GP Info: +- GP English name: *User Account Control: Admin Approval Mode for the Built-in Administrator account* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + +
      @@ -3208,6 +3508,12 @@ This policy setting controls whether application write failures are redirected t Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +GP Info: +- GP English name: *User Account Control: Virtualize file and registry write failures to per-user locations* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md index ac9c25abfa..18e7a7fd97 100644 --- a/windows/client-management/mdm/policy-csp-location.md +++ b/windows/client-management/mdm/policy-csp-location.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Location @@ -69,6 +69,14 @@ Added in Windows 10, version 1703. Optional policy that allows for IT admin to > This policy is not intended to ever be set, pushed, or refreshed more than one time after the first boot of the device because it is meant as initial configuration. Refreshing this policy might result in the Location Service's Device Switch changing state to something the user did not select, which is not an intended use for this policy. + +ADMX Info: +- GP English name: *Turn off Windows Location Provider* +- GP name: *DisableWindowsLocationProvider_1* +- GP path: *Windows Components/Location and Sensors/Windows Location Provider* +- GP ADMX file name: *LocationProviderAdm.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index a63d073566..be9c02f1d7 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - LockDown @@ -68,6 +68,14 @@ Added in Windows 10, version 1607. Allows the user to invoke any system user in The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. + +ADMX Info: +- GP English name: *Allow edge swipe* +- GP name: *AllowEdgeSwipe* +- GP path: *Windows Components/Edge UI* +- GP ADMX file name: *EdgeUI.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 4d5a5f55ec..d60af40683 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Maps @@ -124,6 +124,14 @@ Added in Windows 10, version 1607. Disables the automatic download and update o After the policy is applied, you can verify the settings in the user interface in **System** > **Offline Maps**. + +ADMX Info: +- GP English name: *Turn off Automatic Download and Update of Map Data* +- GP name: *TurnOffAutoUpdate* +- GP path: *Windows Components/Maps* +- GP ADMX file name: *WinMaps.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index abd33e0f71..2ad6d83fe0 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Messaging @@ -125,6 +125,14 @@ The following list shows the supported values: Added in Windows 10, version 1607. Enables text message back up and restore and Messaging Everywhere. This policy allows an organization to disable these features to avoid information being stored on servers outside of their control. + +ADMX Info: +- GP English name: *Allow Message Service Cloud Sync* +- GP name: *AllowMessageSync* +- GP path: *Windows Components/Messaging* +- GP ADMX file name: *messaging.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 445d9a8d6d..70db29303b 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - NetworkIsolation @@ -87,6 +87,15 @@ ms.date: 01/30/2018 Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the **EnterpriseInternalProxyServers** policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, **<*cloudresource*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|<*cloudresource*>|<*cloudresource*>,<*proxy*>|**. + +ADMX Info: +- GP English name: *Enterprise resource domains hosted in the cloud* +- GP name: *WF_NetIsolation_EnterpriseCloudResources* +- GP element: *WF_NetIsolation_EnterpriseCloudResourcesBox* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      @@ -130,6 +139,15 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. + +ADMX Info: +- GP English name: *Private network ranges for apps* +- GP name: *WF_NetIsolation_PrivateSubnet* +- GP element: *WF_NetIsolation_PrivateSubnetBox* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + + For example: @@ -186,6 +204,14 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. + +ADMX Info: +- GP English name: *Subnet definitions are authoritative* +- GP name: *WF_NetIsolation_Authoritative_Subnet* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      @@ -229,6 +255,15 @@ Boolean value that tells the client to accept the configured list and not to use This is the comma-separated list of internal proxy servers. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the **EnterpriseCloudResources** policy to force traffic to the matched cloud resources through these proxies. + +ADMX Info: +- GP English name: *Intranet proxy servers for apps* +- GP name: *WF_NetIsolation_Intranet_Proxies* +- GP element: *WF_NetIsolation_Intranet_ProxiesBox* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      @@ -325,6 +360,15 @@ Here are the steps to create canonical domain names: This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example "157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59". + +ADMX Info: +- GP English name: *Internet proxy servers for apps* +- GP name: *WF_NetIsolation_Domain_Proxies* +- GP element: *WF_NetIsolation_Domain_ProxiesBox* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      @@ -368,6 +412,14 @@ This is a comma-separated list of proxy servers. Any server on this list is cons Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. + +ADMX Info: +- GP English name: *Proxy definitions are authoritative* +- GP name: *WF_NetIsolation_Authoritative_Proxies* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      @@ -411,6 +463,15 @@ Boolean value that tells the client to accept the configured list of proxies and List of domain names that can used for work or personal resource. + +ADMX Info: +- GP English name: *Domains categorized as both work and personal* +- GP name: *WF_NetIsolation_NeutralResources* +- GP element: *WF_NetIsolation_NeutralResourcesBox* +- GP path: *Network/Network Isolation* +- GP ADMX file name: *NetworkIsolation.admx* + +
      diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 2f8a4559f5..b4363ef967 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Notifications @@ -70,6 +70,14 @@ For each user logged into the device, if you enable this policy (set value to 1) No reboot or service restart is required for this policy to take effect. + +ADMX Info: +- GP English name: *Turn off notification mirroring* +- GP name: *NoNotificationMirroring* +- GP path: *Start Menu and Taskbar/Notifications* +- GP ADMX file name: *WPN.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 5bc495e5d8..c69cf5db4a 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Power @@ -101,14 +101,14 @@ If you disable this policy setting, standby states (S1-S3) are not allowed. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow standby states (S1-S3) when sleeping (plugged in)* - GP name: *AllowStandbyStatesAC_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -149,13 +149,13 @@ ADMX Info: -Added in Windows 10, version 1709. Turn off the display (on battery). This policy setting allows you to specify the period of inactivity before Windows turns off the display. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows turns off the display. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -165,14 +165,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off the display (on battery)* - GP name: *VideoPowerDownTimeOutDC_2* - GP path: *System/Power Management/Video and Display Settings* - GP ADMX file name: *power.admx* - +
      @@ -213,13 +213,13 @@ ADMX Info: -Added in Windows 10, version 1709. Turn off the display (plugged in). This policy setting allows you to specify the period of inactivity before Windows turns off the display. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows turns off the display. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the display from turning off. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -229,14 +229,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off the display (plugged in)* - GP name: *VideoPowerDownTimeOutAC_2* - GP path: *System/Power Management/Video and Display Settings* - GP ADMX file name: *power.admx* - +
      @@ -277,14 +277,13 @@ ADMX Info: -Added in Windows 10, version 1709. Specify the system hibernate timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate. If you disable or do not configure this policy setting, users control this setting. - -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -294,14 +293,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the system hibernate timeout (on battery)* - GP name: *DCHibernateTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -342,13 +341,13 @@ ADMX Info: -Added in Windows 10, version 1709. Specify the system hibernate timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows transitions the system to hibernate. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate. If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -358,14 +357,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the system hibernate timeout (plugged in)* - GP name: *ACHibernateTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -420,14 +419,14 @@ If you disable this policy setting, the user is not prompted for a password when > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Require a password when a computer wakes (on battery)* - GP name: *DCPromptForPasswordOnResume_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -482,14 +481,14 @@ If you disable this policy setting, the user is not prompted for a password when > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Require a password when a computer wakes (plugged in)* - GP name: *ACPromptForPasswordOnResume_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -530,13 +529,13 @@ ADMX Info: -Added in Windows 10, version 1709. Specify the system sleep timeout (on battery). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep. If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -546,14 +545,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the system sleep timeout (on battery)* - GP name: *DCStandbyTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      @@ -594,13 +593,13 @@ ADMX Info: -Added in Windows 10, version 1709. Specify the system sleep timeout (plugged in). This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. +Added in Windows 10, version 1709. This policy setting allows you to specify the period of inactivity before Windows transitions the system to sleep. If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep. If you disable or do not configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" (DeviceLock/PreventLockScreenSlideShow) policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. > [!TIP] @@ -610,14 +609,14 @@ If the user has configured a slide show to run on the lock screen when the machi > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify the system sleep timeout (plugged in)* - GP name: *ACStandbyTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 2e10fa65e7..fd0939f604 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Printers @@ -96,14 +96,14 @@ If you disable this policy setting: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Point and Print Restrictions* - GP name: *PointAndPrint_Restrictions_Win7* - GP path: *Printers* - GP ADMX file name: *Printing.admx* - +
      @@ -171,14 +171,14 @@ If you disable this policy setting: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Point and Print Restrictions* - GP name: *PointAndPrint_Restrictions* - GP path: *Control Panel/Printers* - GP ADMX file name: *Printing.admx* - +
      @@ -235,14 +235,14 @@ Note: This settings takes priority over the setting "Automatically publish new p > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow printers to be published* - GP name: *PublishPrinters* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index c42149d2f1..3595219241 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Privacy @@ -352,6 +352,14 @@ Updated in Windows 10, version 1709. Allows the usage of cloud based speech serv Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow input personalization* +- GP name: *AllowInputPersonalization* +- GP path: *Control Panel/Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + The following list shows the supported values: @@ -404,6 +412,14 @@ Added in Windows 10, version 1607. Enables or disables the Advertising ID. Most restricted value is 0. + +ADMX Info: +- GP English name: *Turn off the advertising ID* +- GP name: *DisableAdvertisingId* +- GP path: *System/User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + The following list shows the supported values: @@ -455,6 +471,14 @@ The following list shows the supported values: Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed. + +ADMX Info: +- GP English name: *Enables Activity Feed* +- GP name: *EnableActivityFeed* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + The following list shows the supported values: @@ -508,6 +532,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access ac Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -559,6 +592,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -602,6 +644,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -645,6 +696,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -691,6 +751,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access th Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -742,6 +811,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -785,6 +863,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -828,6 +915,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -874,6 +970,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access ca Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -925,6 +1030,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -968,6 +1082,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1011,6 +1134,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1057,6 +1189,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access th Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -1108,6 +1249,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1151,6 +1301,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1194,6 +1353,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1240,6 +1408,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access co Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -1291,6 +1468,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1334,6 +1520,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1377,6 +1572,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1423,6 +1627,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access em Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -1474,6 +1687,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1517,6 +1739,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1560,6 +1791,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1606,6 +1846,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access lo Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -1657,6 +1906,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1700,6 +1958,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1743,6 +2010,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1789,6 +2065,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can read or s Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -1840,6 +2125,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1883,6 +2177,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1926,6 +2229,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -1972,6 +2284,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access th Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -2023,6 +2344,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2066,6 +2396,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2109,6 +2448,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2155,6 +2503,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access mo Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -2206,6 +2563,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2249,6 +2615,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2292,6 +2667,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2338,6 +2722,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access no Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -2389,6 +2782,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2432,6 +2834,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2475,6 +2886,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2521,6 +2941,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can make phon Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -2572,6 +3001,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2615,6 +3053,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2658,6 +3105,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2704,6 +3160,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps have access t Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -2755,6 +3220,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2798,6 +3272,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2841,6 +3324,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2884,6 +3376,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks. + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2927,6 +3428,15 @@ Added in Windows 10, version 1703. Specifies whether Windows apps can access tas Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -2970,6 +3480,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family N Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3013,6 +3532,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family N Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3059,6 +3587,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can access tr Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -3110,6 +3647,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3153,6 +3699,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3196,6 +3751,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3242,6 +3806,15 @@ Added in Windows 10, version 1703. Force allow, force deny or give user control Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -3293,6 +3866,15 @@ The following list shows the supported values: Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3336,6 +3918,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3379,6 +3970,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3427,6 +4027,15 @@ Most restricted value is 2. > Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly. + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -3478,6 +4087,15 @@ The following list shows the supported values: Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3521,6 +4139,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3564,6 +4191,15 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3610,6 +4246,15 @@ Added in Windows 10, version 1607. Specifies whether Windows apps can sync with Most restricted value is 2. + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + The following list shows the supported values: @@ -3661,6 +4306,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3704,6 +4358,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3747,6 +4410,15 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + +
      @@ -3790,6 +4462,14 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed. + +ADMX Info: +- GP English name: *Allow publishing of User Activities* +- GP name: *PublishUserActivities* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 79ab76a706..a26dd4c251 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - RemoteAssistance @@ -92,14 +92,14 @@ If you do not configure this policy setting, the user sees the default warning m > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Customize warning messages* - GP name: *RA_Options* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* - +
      @@ -156,14 +156,14 @@ If you do not configure this setting, application-based settings are used. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn on session logging* - GP name: *RA_Logging* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* - +
      @@ -228,14 +228,14 @@ If you enable this policy setting you should also enable appropriate firewall ex > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Configure Solicited Remote Assistance* - GP name: *RA_Solicit* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* - +
      @@ -323,14 +323,14 @@ Allow Remote Desktop Exception > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Configure Offer Remote Assistance* - GP name: *RA_Unsolicit* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 79615e7c27..3af7f7ca34 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - RemoteDesktopServices @@ -84,9 +84,9 @@ If you enable this policy setting, users who are members of the Remote Desktop U If you disable this policy setting, users cannot connect remotely to the target computer by using Remote Desktop Services. The target computer will maintain any current connections, but will not accept any new incoming connections. -If you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether the remote connection is allowed. This setting is found on the Remote tab in the System properties sheet. By default, remote connections are not allowed. +If you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether the remote connection is allowed. This setting is found on the Remote tab in the System properties sheet. By default, remote connections are not allowed. -Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication. +Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication. You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider. @@ -98,14 +98,14 @@ You can limit the number of users who can connect simultaneously by configuring > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow users to connect remotely by using Remote Desktop Services* - GP name: *TS_DISABLE_CONNECTIONS* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections* - GP ADMX file name: *terminalserver.admx* - +
      @@ -170,14 +170,14 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Set client connection encryption level* - GP name: *TS_ENCRYPTION_POLICY* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security* - GP ADMX file name: *terminalserver.admx* - +
      @@ -236,14 +236,14 @@ If you do not configure this policy setting, client drive redirection and Clipbo > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not allow drive redirection* - GP name: *TS_CLIENT_DRIVE_M* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection* - GP ADMX file name: *terminalserver.admx* - +
      @@ -298,14 +298,14 @@ If you disable this setting or leave it not configured, the user will be able to > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not allow passwords to be saved* - GP name: *TS_CLIENT_DISABLE_PASSWORD_SAVING_2* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Connection Client* - GP ADMX file name: *terminalserver.admx* - +
      @@ -366,14 +366,14 @@ If you do not configure this policy setting, automatic logon is not specified at > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Always prompt for password upon connection* - GP name: *TS_PASSWORD* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security* - GP ADMX file name: *terminalserver.admx* - +
      @@ -434,14 +434,14 @@ Note: The RPC interface is used for administering and configuring Remote Desktop > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Require secure RPC communication* - GP name: *TS_RPC_ENCRYPTION* - GP path: *Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security* - GP ADMX file name: *terminalserver.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 609bfc4763..67d82bb4f9 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - RemoteManagement @@ -105,6 +105,11 @@ ms.date: 01/30/2018 +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication. + +If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text. + +If you disable or do not configure this policy setting, the WinRM client does not use Basic authentication. > [!TIP] @@ -114,14 +119,14 @@ ms.date: 01/30/2018 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow Basic authentication* - GP name: *AllowBasic_2* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -162,6 +167,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client. + +If you enable this policy setting, the WinRM service accepts Basic authentication from a remote client. + +If you disable or do not configure this policy setting, the WinRM service does not accept Basic authentication from a remote client. > [!TIP] @@ -171,14 +181,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow Basic authentication* - GP name: *AllowBasic_1* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -219,6 +229,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses CredSSP authentication. + +If you enable this policy setting, the WinRM client uses CredSSP authentication. + +If you disable or do not configure this policy setting, the WinRM client does not use CredSSP authentication. > [!TIP] @@ -228,14 +243,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow CredSSP authentication* - GP name: *AllowCredSSP_2* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -276,6 +291,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts CredSSP authentication from a remote client. + +If you enable this policy setting, the WinRM service accepts CredSSP authentication from a remote client. + +If you disable or do not configure this policy setting, the WinRM service does not accept CredSSP authentication from a remote client. > [!TIP] @@ -285,14 +305,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow CredSSP authentication* - GP name: *AllowCredSSP_1* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -333,6 +353,24 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. + +If you enable this policy setting, the WinRM service automatically listens on the network for requests on the HTTP transport over the default HTTP port. + +To allow WinRM service to receive requests over the network, configure the Windows Firewall policy setting with exceptions for Port 5985 (default port for HTTP). + +If you disable or do not configure this policy setting, the WinRM service will not respond to requests from a remote computer, regardless of whether or not any WinRM listeners are configured. + +The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges. + +You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. + +For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty. + +Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter. + +Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22 +Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 > [!TIP] @@ -342,14 +380,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow remote server management through WinRM* - GP name: *AllowAutoConfig* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -390,6 +428,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network. + +If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network. + +If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network. > [!TIP] @@ -399,14 +442,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow unencrypted traffic* - GP name: *AllowUnencrypted_2* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -447,6 +490,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network. + +If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network. + +If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network. > [!TIP] @@ -456,14 +504,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow unencrypted traffic* - GP name: *AllowUnencrypted_1* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -504,6 +552,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Digest authentication. + +If you enable this policy setting, the WinRM client does not use Digest authentication. + +If you disable or do not configure this policy setting, the WinRM client uses Digest authentication. > [!TIP] @@ -513,14 +566,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disallow Digest authentication* - GP name: *DisallowDigest* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -561,6 +614,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Negotiate authentication. + +If you enable this policy setting, the WinRM client does not use Negotiate authentication. + +If you disable or do not configure this policy setting, the WinRM client uses Negotiate authentication. > [!TIP] @@ -570,14 +628,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disallow Negotiate authentication* - GP name: *DisallowNegotiate_2* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -618,6 +676,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Negotiate authentication from a remote client. + +If you enable this policy setting, the WinRM service does not accept Negotiate authentication from a remote client. + +If you disable or do not configure this policy setting, the WinRM service accepts Negotiate authentication from a remote client. > [!TIP] @@ -627,14 +690,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disallow Negotiate authentication* - GP name: *DisallowNegotiate_1* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -675,6 +738,13 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not allow RunAs credentials to be stored for any plug-ins. + +If you enable this policy setting, the WinRM service will not allow the RunAsUser or RunAsPassword configuration values to be set for any plug-ins. If a plug-in has already set the RunAsUser and RunAsPassword configuration values, the RunAsPassword configuration value will be erased from the credential store on this computer. + +If you disable or do not configure this policy setting, the WinRM service will allow the RunAsUser and RunAsPassword configuration values to be set for plug-ins and the RunAsPassword value will be stored securely. + +If you enable and then disable this policy setting,any values that were previously configured for RunAsPassword will need to be reset. > [!TIP] @@ -684,14 +754,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Disallow WinRM from storing RunAs credentials* - GP name: *DisableRunAs* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -732,6 +802,17 @@ ADMX Info: +This policy setting allows you to set the hardening level of the Windows Remote Management (WinRM) service with regard to channel binding tokens. + +If you enable this policy setting, the WinRM service uses the level specified in HardeningLevel to determine whether or not to accept a received request, based on a supplied channel binding token. + +If you disable or do not configure this policy setting, you can configure the hardening level locally on each computer. + +If HardeningLevel is set to Strict, any request not containing a valid channel binding token is rejected. + +If HardeningLevel is set to Relaxed (default value), any request containing an invalid channel binding token is rejected. However, a request that does not contain a channel binding token is accepted (though it is not protected from credential-forwarding attacks). + +If HardeningLevel is set to None, all requests are accepted (though they are not protected from credential-forwarding attacks). > [!TIP] @@ -741,14 +822,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify channel binding token hardening level* - GP name: *CBTHardeningLevel_1* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -789,6 +870,11 @@ ADMX Info: +This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses the list specified in TrustedHostsList to determine if the destination host is a trusted entity. + +If you enable this policy setting, the WinRM client uses the list specified in TrustedHostsList to determine if the destination host is a trusted entity. The WinRM client uses this list when neither HTTPS nor Kerberos are used to authenticate the identity of the host. + +If you disable or do not configure this policy setting and the WinRM client needs to use the list of trusted hosts, you must configure the list of trusted hosts locally on each computer. > [!TIP] @@ -798,14 +884,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Trusted Hosts* - GP name: *TrustedHosts* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -846,6 +932,15 @@ ADMX Info: +This policy setting turns on or turns off an HTTP listener created for backward compatibility purposes in the Windows Remote Management (WinRM) service. + +If you enable this policy setting, the HTTP listener always appears. + +If you disable or do not configure this policy setting, the HTTP listener never appears. + +When certain port 80 listeners are migrated to WinRM 2.0, the listener port number changes to 5985. + +A listener might be automatically created on port 80 to ensure backward compatibility. > [!TIP] @@ -855,14 +950,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn On Compatibility HTTP Listener* - GP name: *HttpCompatibilityListener* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      @@ -903,6 +998,15 @@ ADMX Info: +This policy setting turns on or turns off an HTTPS listener created for backward compatibility purposes in the Windows Remote Management (WinRM) service. + +If you enable this policy setting, the HTTPS listener always appears. + +If you disable or do not configure this policy setting, the HTTPS listener never appears. + +When certain port 443 listeners are migrated to WinRM 2.0, the listener port number changes to 5986. + +A listener might be automatically created on port 443 to ensure backward compatibility. > [!TIP] @@ -912,14 +1016,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn On Compatibility HTTPS Listener* - GP name: *HttpsCompatibilityListener* - GP path: *Windows Components/Windows Remote Management (WinRM)/WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 16adbb0e97..41fb1d8539 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - RemoteProcedureCall @@ -66,7 +66,7 @@ ms.date: 01/30/2018 -This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner. +This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner. If you disable this policy setting, RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server. @@ -84,14 +84,14 @@ Note: This policy will not be applied until the system is rebooted. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Enable RPC Endpoint Mapper Client Authentication* - GP name: *RpcEnableAuthEpResolution* - GP path: *System/Remote Procedure Call* - GP ADMX file name: *rpc.admx* - +
      @@ -136,9 +136,9 @@ This policy setting controls how the RPC server runtime handles unauthenticated This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a domain controller. -If you disable this policy setting, the RPC server runtime uses the value of "Authenticated" on Windows Client, and the value of "None" on Windows Server versions that support this policy setting. +If you disable this policy setting, the RPC server runtime uses the value of "Authenticated" on Windows Client, and the value of "None" on Windows Server versions that support this policy setting. -If you do not configure this policy setting, it remains disabled. The RPC server runtime will behave as though it was enabled with the value of "Authenticated" used for Windows Client and the value of "None" used for Server SKUs that support this policy setting. +If you do not configure this policy setting, it remains disabled. The RPC server runtime will behave as though it was enabled with the value of "Authenticated" used for Windows Client and the value of "None" used for Server SKUs that support this policy setting. If you enable this policy setting, it directs the RPC server runtime to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting. @@ -158,14 +158,14 @@ Note: This policy setting will not be applied until the system is rebooted. > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Restrict Unauthenticated RPC clients* - GP name: *RpcRestrictRemoteClients* - GP path: *System/Remote Procedure Call* - GP ADMX file name: *rpc.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 5f9c72ad15..20a0ac4151 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - RemoteShell @@ -81,6 +81,11 @@ ms.date: 01/30/2018 +This policy setting configures access to remote shells. + +If you enable or do not configure this policy setting, new remote shell connections are accepted by the server. + +If you set this policy to ‘disabled’, new remote shell connections are rejected by the server. > [!TIP] @@ -90,14 +95,14 @@ ms.date: 01/30/2018 > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Allow Remote Shell Access* - GP name: *AllowRemoteShellAccess* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -138,6 +143,13 @@ ADMX Info: +This policy setting configures the maximum number of users able to concurrently perform remote shell operations on the system. + +The value can be any number from 1 to 100. + +If you enable this policy setting, the new shell connections are rejected if they exceed the specified limit. + +If you disable or do not configure this policy setting, the default number is five users. > [!TIP] @@ -147,14 +159,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *MaxConcurrentUsers* - GP name: *MaxConcurrentUsers* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -195,6 +207,13 @@ ADMX Info: +This policy setting configures the maximum time in milliseconds remote shell will stay open without any user activity until it is automatically deleted. + +Any value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 minute) is used for smaller values. + +If you enable this policy setting, the server will wait for the specified amount of time since the last received message from the client before terminating the open shell. + +If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used. > [!TIP] @@ -204,14 +223,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify idle Timeout* - GP name: *IdleTimeout* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -252,6 +271,13 @@ ADMX Info: +This policy setting configures the maximum total amount of memory in megabytes that can be allocated by any active remote shell and all its child processes. + +Any value from 0 to 0x7FFFFFFF can be set, where 0 equals unlimited memory, which means the ability of remote operations to allocate memory is only limited by the available virtual memory. + +If you enable this policy setting, the remote operation is terminated when a new allocation exceeds the specified quota. + +If you disable or do not configure this policy setting, the value 150 is used by default. > [!TIP] @@ -261,14 +287,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify maximum amount of memory in MB per Shell* - GP name: *MaxMemoryPerShellMB* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -309,6 +335,11 @@ ADMX Info: +This policy setting configures the maximum number of processes a remote shell is allowed to launch. + +If you enable this policy setting, you can specify any number from 0 to 0x7FFFFFFF to set the maximum number of process per shell. Zero (0) means unlimited number of processes. + +If you disable or do not configure this policy setting, the limit is five processes per shell. > [!TIP] @@ -318,14 +349,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify maximum number of processes per Shell* - GP name: *MaxProcessesPerShell* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -366,6 +397,13 @@ ADMX Info: +This policy setting configures the maximum number of concurrent shells any user can remotely open on the same system. + +Any number from 0 to 0x7FFFFFFF cand be set, where 0 means unlimited number of shells. + +If you enable this policy setting, the user cannot open new remote shells if the count exceeds the specified limit. + +If you disable or do not configure this policy setting, by default the limit is set to two remote shells per user. > [!TIP] @@ -375,14 +413,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify maximum number of remote shells per user* - GP name: *MaxShellsPerUser* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      @@ -423,6 +461,7 @@ ADMX Info: +This policy setting is deprecated and has no effect when set to any state: Enabled, Disabled, or Not Configured. > [!TIP] @@ -432,14 +471,14 @@ ADMX Info: > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Specify Shell Timeout* - GP name: *ShellTimeOut* - GP path: *Windows Components/Windows Remote Shell* - GP ADMX file name: *WindowsRemoteShell.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 3081faa8a5..85b59673d8 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Search @@ -107,6 +107,15 @@ ms.date: 01/30/2018 Added in Windows 10, version 1709. Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources. + +ADMX Info: +- GP English name: *Allow Cloud Search* +- GP name: *AllowCloudSearch* +- GP element: *AllowCloudSearch_Dropdown* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -157,6 +166,14 @@ The following list shows the supported values: Added in Windows 10, version 1803. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow.. + +ADMX Info: +- GP English name: *Allow Cortana Page in OOBE on an AAD account* +- GP name: *AllowCortanaInAAD* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -213,6 +230,14 @@ When the policy is disabled, the WIP protected items are not indexed and do not Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow indexing of encrypted files* +- GP name: *AllowIndexingEncryptedStoresOrItems* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -265,6 +290,14 @@ Specifies whether search can leverage location information. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow search and Cortana to use location* +- GP name: *AllowSearchToUseLocation* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -338,6 +371,14 @@ Allows the use of diacritics. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow use of diacritics* +- GP name: *AllowUsingDiacritics* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -434,6 +475,14 @@ Specifies whether to always use automatic language detection when indexing conte Most restricted value is 0. + +ADMX Info: +- GP English name: *Always use automatic language detection when indexing content and properties* +- GP name: *AlwaysUseAutoLangDetection* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -484,6 +533,14 @@ The following list shows the supported values: If enabled, the search indexer backoff feature will be disabled. Indexing will continue at full speed even when system activity is high. If disabled, backoff logic will be used to throttle back indexing activity when system activity is high. Default is disabled. + +ADMX Info: +- GP English name: *Disable indexer backoff* +- GP name: *DisableBackoff* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -538,6 +595,14 @@ If you enable this policy setting, locations on removable drives cannot be added If you disable or do not configure this policy setting, locations on removable drives can be added to libraries. In addition, locations on removable drives can be indexed. + +ADMX Info: +- GP English name: *Do not allow locations on removable drives to be added to libraries* +- GP name: *DisableRemovableDriveIndexing* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -593,6 +658,14 @@ If you enable this policy setting, queries won't be performed on the web and web If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search. + +ADMX Info: +- GP English name: *Don't search the web or display web results in Search* +- GP name: *DoNotUseWebResults* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -647,6 +720,14 @@ Enable this policy if computers in your environment have extremely limited hard When this policy is disabled or not configured, Windows Desktop Search automatically manages your index size. + +ADMX Info: +- GP English name: *Stop indexing in the event of limited hard drive space* +- GP name: *StopIndexingOnLimitedHardDriveSpace* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: @@ -697,6 +778,14 @@ The following list shows the supported values: If enabled, clients will be unable to query this computer's index remotely. Thus, when they are browsing network shares that are stored on this computer, they will not search them using the index. If disabled, client search requests will use this computer's index.. + +ADMX Info: +- GP English name: *Prevent clients from querying the index remotely* +- GP name: *PreventRemoteQueries* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index dd8bc02aab..9d95aab726 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Security @@ -361,6 +361,14 @@ The following list shows the supported values: Added in Windows 10, version 1709. Admin access is required. The prompt will appear on first admin logon after a reboot when the TPM is in a non-ready state that can be remediated with a TPM Clear. The prompt will have a description of what clearing the TPM does and that it requires a reboot. The user can dismiss it, but it will appear on next admin logon after restart. + +ADMX Info: +- GP English name: *Configure the system to clear the TPM if it is not in a ready state.* +- GP name: *ClearTPMIfNotReady_Name* +- GP path: *System/Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index bd6a64ba12..5031440194 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Settings @@ -370,6 +370,15 @@ Enables or disables the retrieval of online tips and help for the Settings app. If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. + +ADMX Info: +- GP English name: *Allow Online Tips* +- GP name: *AllowOnlineTips* +- GP element: *CheckBox_AllowOnlineTips* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + +
      @@ -729,6 +738,14 @@ The following list shows the supported values: Added in Windows 10, version 1703. Allows IT Admins to configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. In this version of Windows 10, supported additional calendars are: Simplified or Traditional Chinese lunar calendar. Turning on one of these calendars will display Chinese lunar dates below the default calendar for the locale. Select "Don't show additional calendars" to prevent showing other calendars besides the default calendar for the locale. + +ADMX Info: +- GP English name: *Show additional calendar* +- GP name: *ConfigureTaskbarCalendar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + The following list shows the supported values: @@ -805,6 +822,15 @@ Example 2, specifies that the wifi page should not be shown: hide:wifi + +ADMX Info: +- GP English name: *Settings Page Visibility* +- GP name: *SettingsPageVisibility* +- GP element: *SettingsPageVisibilityBox* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + To validate on Desktop, do the following: diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index f52bfb67a6..be4301165b 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - SmartScreen @@ -72,6 +72,14 @@ ms.date: 01/30/2018 Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. + +ADMX Info: +- GP English name: *Configure App Install Control* +- GP name: *ConfigureAppInstallControl* +- GP path: *Windows Components/Windows Defender SmartScreen/Explorer* +- GP ADMX file name: *SmartScreen.admx* + + The following list shows the supported values: @@ -122,6 +130,14 @@ The following list shows the supported values: Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen for Windows. + +ADMX Info: +- GP English name: *Configure Windows Defender SmartScreen* +- GP name: *ShellConfigureSmartScreen* +- GP path: *Windows Components/Windows Defender SmartScreen/Explorer* +- GP ADMX file name: *SmartScreen.admx* + + The following list shows the supported values: @@ -172,6 +188,15 @@ The following list shows the supported values: Added in Windows 10, version 1703. Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files. + +ADMX Info: +- GP English name: *Configure Windows Defender SmartScreen* +- GP name: *ShellConfigureSmartScreen* +- GP element: *ShellConfigureSmartScreen_Dropdown* +- GP path: *Windows Components/Windows Defender SmartScreen/Explorer* +- GP ADMX file name: *SmartScreen.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index e5c27c3200..9a691d7670 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Speech @@ -66,6 +66,14 @@ ms.date: 01/30/2018 Added in Windows 10, version 1607. Specifies whether the device will receive updates to the speech recognition and speech synthesis models. A speech model contains data used by the speech engine to convert audio to text (or vice-versa). The models are periodically updated to improve accuracy and performance. Models are non-executable data files. If enabled, the device will periodically check for updated speech models and then download them from a Microsoft service using the Background Internet Transfer Service (BITS). + +ADMX Info: +- GP English name: *Allow Automatic Update of Speech Data* +- GP name: *AllowSpeechModelUpdate* +- GP path: *Windows Components/Speech* +- GP ADMX file name: *Speech.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index e8122802b3..50809d5486 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Start @@ -1025,6 +1025,14 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. + +ADMX Info: +- GP English name: *Remove the People Bar from the taskbar* +- GP name: *HidePeopleBar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + +
      @@ -1198,6 +1206,14 @@ To validate on Desktop, do the following: Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently added apps. + +ADMX Info: +- GP English name: *Remove "Recently added" list from Start Menu* +- GP name: *HideRecentlyAddedApps* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + The following list shows the supported values: @@ -1731,6 +1747,14 @@ Allows you to override the default Start layout and prevents the user from chang For further details on how to customize the Start layout, please see [Customize and export Start layout](https://docs.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout) and [Configure Windows 10 taskbar](https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar). + +ADMX Info: +- GP English name: *Start Layout* +- GP name: *LockedStartLayout* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + +
      diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index dbcdfe8bd5..536aac2ce2 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Storage @@ -73,6 +73,14 @@ Added in Windows 10, version 1709. Allows disk health model updates. Value type is integer. + +ADMX Info: +- GP English name: *Allow downloading updates to the Disk Failure Prediction Model* +- GP name: *SH_AllowDiskHealthModelUpdates* +- GP path: *System/Storage Health* +- GP ADMX file name: *StorageHealth.admx* + + The following list shows the supported values: @@ -134,14 +142,14 @@ If you disable or do not configure this policy setting, Windows will activate un > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not allow Windows to activate Enhanced Storage devices* - GP name: *TCGSecurityActivationDisabled* - GP path: *System/Enhanced Storage Access* - GP ADMX file name: *enhancedstorage.admx* - +
      diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index c0cc5dd7cf..d943b9d855 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - System @@ -116,6 +116,14 @@ This policy setting determines whether users can access the Insider build contro If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable. + +ADMX Info: +- GP English name: *Toggle user control over Insider builds* +- GP name: *AllowBuildPreview* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *AllowBuildPreview.admx* + + The following list shows the supported values: @@ -283,6 +291,14 @@ This setting is used by lower-level components for text display and fond handlin > Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service. + +ADMX Info: +- GP English name: *Enable Font Providers* +- GP name: *EnableFontProviders* +- GP path: *Network/Fonts* +- GP ADMX file name: *GroupPolicy.admx* + + The following list shows the supported values: @@ -348,6 +364,14 @@ When switching the policy back from 0 (Force Location Off) or 2 (Force Location For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off. + +ADMX Info: +- GP English name: *Turn off location* +- GP name: *DisableLocation_2* +- GP path: *Windows Components/Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + The following list shows the supported values: @@ -527,6 +551,15 @@ Windows 10 Values: Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Telemetry* +- GP name: *AllowTelemetry* +- GP element: *AllowTelemetry* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + +
      @@ -620,7 +653,17 @@ orted values: -N/A +This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver: +- Good: The driver has been signed and has not been tampered with. +- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. +- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. +- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver. + +If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started. + +If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped. + +If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized. > [!TIP] @@ -630,12 +673,14 @@ N/A > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: +- GP English name: *Boot-Start Driver Initialization Policy* - GP name: *POL_DriverLoadPolicy_Name* +- GP path: *System/Early Launch Antimalware* - GP ADMX file name: *earlylauncham.admx* - +
      @@ -679,6 +724,15 @@ ADMX Info: This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. + +ADMX Info: +- GP English name: *Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service* +- GP name: *DisableEnterpriseAuthProxy* +- GP element: *DisableEnterpriseAuthProxy* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + +
      @@ -730,6 +784,14 @@ Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + +ADMX Info: +- GP English name: *Prevent the usage of OneDrive for file storage* +- GP name: *PreventOnedriveFileSync* +- GP path: *Windows Components/OneDrive* +- GP ADMX file name: *SkyDrive.admx* + + The following list shows the supported values: @@ -805,14 +867,14 @@ Also, see the "Turn off System Restore configuration" policy setting. If the "Tu > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off System Restore* - GP name: *SR_DisableSR* - GP path: *System/System Restore* - GP ADMX file name: *systemrestore.admx* - +
      @@ -919,6 +981,15 @@ Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combina If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. + +ADMX Info: +- GP English name: *Limit Enhanced diagnostic data to the minimum required by Windows Analytics* +- GP name: *LimitEnhancedDiagnosticDataWindowsAnalytics* +- GP element: *LimitEnhancedDiagnosticDataWindowsAnalytics* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + +
      @@ -964,6 +1035,15 @@ Allows you to specify the fully qualified domain name (FQDN) or IP address of a If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration. + +ADMX Info: +- GP English name: *Configure Connected User Experiences and Telemetry* +- GP name: *TelemetryProxy* +- GP element: *TelemetryProxyName* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + +
      diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 97ddbf6bd4..ffdb12f42a 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - SystemServices @@ -83,6 +83,12 @@ ms.date: 01/30/2018 Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *HomeGroup Listener* +- GP path: *Windows Settings/Security Settings/System Services* + +
      @@ -126,6 +132,12 @@ Added in Windows 10, version 1803. This setting determines whether the service's Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *HomeGroup Provider* +- GP path: *Windows Settings/Security Settings/System Services* + +
      @@ -169,6 +181,12 @@ Added in Windows 10, version 1803. This setting determines whether the service's Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *Xbox Accessory Management Service* +- GP path: *Windows Settings/Security Settings/System Services* + +
      @@ -212,6 +230,12 @@ Added in Windows 10, version 1803. This setting determines whether the service's Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *Xbox Live Auth Manager* +- GP path: *Windows Settings/Security Settings/System Services* + +
      @@ -255,6 +279,12 @@ Added in Windows 10, version 1803. This setting determines whether the service's Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *Xbox Live Game Save* +- GP path: *Windows Settings/Security Settings/System Services* + +
      @@ -298,6 +328,12 @@ Added in Windows 10, version 1803. This setting determines whether the service's Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual. + +GP Info: +- GP English name: *Xbox Live Networking Service* +- GP path: *Windows Settings/Security Settings/System Services* + +
      diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index c301cc1884..b5cb108686 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/26/2018 +ms.date: 03/05/2018 --- # Policy CSP - TextInput @@ -657,6 +657,14 @@ Allows the uninstall of language features, such as spell checkers, on a device. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Uninstallation of Language Features* +- GP name: *AllowLanguageFeaturesUninstall* +- GP path: *Windows Components/Text Input* +- GP ADMX file name: *TextInput.admx* + + The following list shows the supported values: @@ -1291,8 +1299,8 @@ The following list shows the supported values: -
      + Footnote: - 1 - Added in Windows 10, version 1607. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index d8a6cbbf3c..7a92fffc6a 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Update @@ -216,6 +216,15 @@ Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default is 17 (5 PM). + +ADMX Info: +- GP English name: *Turn off auto-restart for updates during active hours* +- GP name: *ActiveHours* +- GP element: *ActiveHoursEndTime* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -263,6 +272,15 @@ Supported values are 8-18. The default value is 18 (hours). + +ADMX Info: +- GP English name: *Specify active hours range for auto-restarts* +- GP name: *ActiveHoursMaxRange* +- GP element: *ActiveHoursMaxRange* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -313,6 +331,15 @@ Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default value is 8 (8 AM). + +ADMX Info: +- GP English name: *Turn off auto-restart for updates during active hours* +- GP name: *ActiveHours* +- GP element: *ActiveHoursStartTime* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -365,6 +392,15 @@ Supported operations are Get and Replace. If the policy is not configured, end-users get the default behavior (Auto install and restart). + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateMode* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -423,6 +459,14 @@ A significant number of devices primarily use cellular data and do not have Wi-F This policy is accessible through the Update setting in the user interface or Group Policy. + +ADMX Info: +- GP English name: *Allow updates to be downloaded automatically over metered connections* +- GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -473,6 +517,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AllowMUUpdateServiceId* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -584,6 +637,14 @@ Enabling this policy will disable that functionality, and may cause connection t > This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. + +ADMX Info: +- GP English name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -638,6 +699,15 @@ Supported values are 2-30 days. The default value is 7 days. + +ADMX Info: +- GP English name: *Specify deadline before auto-restart for update installation* +- GP name: *AutoRestartDeadline* +- GP element: *AutoRestartDeadline* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -683,6 +753,15 @@ Added in Windows 10, version 1703. Allows the IT Admin to specify the period fo The default value is 15 (minutes). + +ADMX Info: +- GP English name: *Configure auto-restart reminder notifications for updates* +- GP name: *AutoRestartNotificationConfig* +- GP element: *AutoRestartNotificationSchd* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + Supported values are 15, 30, 60, 120, and 240 (minutes). @@ -730,6 +809,15 @@ Supported values are 15, 30, 60, 120, and 240 (minutes). Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed. + +ADMX Info: +- GP English name: *Configure auto-restart required notification for updates* +- GP name: *AutoRestartRequiredNotificationDismissal* +- GP element: *AutoRestartRequiredNotificationDismissal* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -780,6 +868,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. + +ADMX Info: +- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *BranchReadinessLevelId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -874,6 +971,15 @@ Supported values are 0-365 days. > The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. + +ADMX Info: +- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *DeferFeatureUpdatesPeriodId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -919,6 +1025,15 @@ Added in Windows 10, version 1607. Defers Quality Updates for the specified num Supported values are 0-30. + +ADMX Info: +- GP English name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *DeferQualityUpdatesPeriodId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + +
      @@ -1055,6 +1170,13 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
    --> + +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpdatePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1110,6 +1232,13 @@ If the "Specify intranet Microsoft update service location" policy is enabled, t If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. + +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpgradePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1153,6 +1282,15 @@ If the "Allow Telemetry" policy is enabled and the Options value is set to 0, th Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. + +ADMX Info: +- GP English name: *Automatic Updates detection frequency* +- GP name: *DetectionFrequency_Title* +- GP element: *DetectionFrequency_Hour2* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1202,6 +1340,14 @@ This is the same as the Group Policy in Windows Components > Window Update "Do n Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +ADMX Info: +- GP English name: *Do not allow update deferral policies to cause scans against Windows Update* +- GP name: *DisableDualScan* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1256,6 +1402,15 @@ Supported values are 2-30 days. The default value is 0 days (not specified). + +ADMX Info: +- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartDeadline* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1303,6 +1458,15 @@ Supported values are 1-3 days. The default value is 3 days. + +ADMX Info: +- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartSnoozeSchedule* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1350,6 +1514,15 @@ Supported values are 2-30 days. The default value is 7 days. + +ADMX Info: +- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartTransitionSchedule* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1396,6 +1569,14 @@ The default value is 7 days. Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. + +ADMX Info: +- GP English name: *Do not include drivers with Windows Updates* +- GP name: *ExcludeWUDriversInQualityUpdate* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1449,6 +1630,15 @@ Added in the April service release of Windows 10, version 1607. Allows Windows U > This setting should only be used in combination with an alternate download URL and configured to use ISV file cache. This setting is used when the intranet update service does not provide download URLs in the update metadata for files which are available on the alternate download server. + +ADMX Info: +- GP English name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP element: *CorpWUFillEmptyContentUrls* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1629,6 +1819,15 @@ To validate this policy: Added in Windows 10, version 1709. Used to manage Windows 10 Insider Preview builds. Value type is integer. + +ADMX Info: +- GP English name: *Manage preview builds* +- GP name: *ManagePreviewBuilds* +- GP element: *ManagePreviewBuildsId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1689,6 +1888,13 @@ If the "Specify intranet Microsoft update service location" policy is enabled, t If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. + +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *PauseDeferralsId* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1742,6 +1948,15 @@ Since this policy is not blocked, you will not get a failure message when you us Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. + +ADMX Info: +- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *PauseFeatureUpdatesId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1794,6 +2009,15 @@ Added in Windows 10, version 1703. Specifies the date and time when the IT admi Value type is string. Supported operations are Add, Get, Delete, and Replace. + +ADMX Info: +- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *PauseFeatureUpdatesStartId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1837,6 +2061,15 @@ Value type is string. Supported operations are Add, Get, Delete, and Replace. Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. + +ADMX Info: +- GP English name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *PauseQualityUpdatesId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -1889,6 +2122,15 @@ Added in Windows 10, version 1703. Specifies the date and time when the IT admi Value type is string. Supported operations are Add, Get, Delete, and Replace. + +ADMX Info: +- GP English name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *PauseQualityUpdatesStartId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + +
    @@ -1947,6 +2189,13 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd Allows the IT admin to set a device to Semi-Annual Channel train. + +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpgradePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -2055,6 +2304,15 @@ Added in Windows 10, version 1703. Allows the IT Admin to specify the period fo The default value is 15 (minutes). + +ADMX Info: +- GP English name: *Configure auto-restart warning notifications schedule for updates* +- GP name: *RestartWarnRemind* +- GP element: *RestartWarn* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + Supported values are 15, 30, or 60 (minutes). @@ -2108,6 +2366,15 @@ Added in Windows 10, version 1703. Allows the IT Admin to specify the period fo The default value is 4 (hours). + +ADMX Info: +- GP English name: *Configure auto-restart warning notifications schedule for updates* +- GP name: *RestartWarnRemind* +- GP element: *RestartWarnRemind* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + Supported values are 2, 4, 8, 12, or 24 (hours). @@ -2159,6 +2426,15 @@ The data type is a integer. Supported operations are Add, Delete, Get, and Replace. + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateSchDay* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -2219,6 +2495,15 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i
+ +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateSchEveryWeek* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2266,6 +2551,15 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateSchFirstWeek* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2313,6 +2607,15 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *ScheduledInstallFourthWeek* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2360,6 +2663,15 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *ScheduledInstallSecondWeek* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2407,6 +2719,15 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *ScheduledInstallThirdWeek* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2462,6 +2783,15 @@ Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. + +ADMX Info: +- GP English name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateSchTime* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
@@ -2505,6 +2835,15 @@ The default value is 3. Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart notifications for update installations. + +ADMX Info: +- GP English name: *Turn off auto-restart notifications for update installations* +- GP name: *AutoRestartNotificationDisable* +- GP element: *AutoRestartNotificationSchd* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -2555,6 +2894,14 @@ The following list shows the supported values: Added in Windows 10, version 1703. For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime. + +ADMX Info: +- GP English name: *Update Power Policy for Cart Restarts* +- GP name: *SetEDURestart* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -2610,6 +2957,15 @@ Allows the device to check for updates from a WSUS server instead of Microsoft U Supported operations are Get and Replace. + +ADMX Info: +- GP English name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP element: *CorpWUURL_Name* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + The following list shows the supported values: @@ -2691,6 +3047,15 @@ Value type is string and the default value is an empty string, "". If the settin > This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. + +ADMX Info: +- GP English name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP element: *CorpWUContentHost_Name* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + +
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index b091456af0..6e52bc893b 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - UserRights @@ -152,6 +152,12 @@ ms.date: 01/30/2018 This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. + +GP Info: +- GP English name: *Access Credential Manager ase a trusted caller* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -195,6 +201,12 @@ This user right is used by Credential Manager during Backup/Restore. No accounts This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + +GP Info: +- GP English name: *Access this computer from the network* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -238,6 +250,12 @@ This user right determines which users and groups are allowed to connect to the This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + +GP Info: +- GP English name: *Act as part of the operating system* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -281,6 +299,12 @@ This user right allows a process to impersonate any user without authentication. This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. + +GP Info: +- GP English name: *Allow log on locally* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -324,6 +348,12 @@ This user right determines which users can log on to the computer. Note: Modifyi This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users + +GP Info: +- GP English name: *Back up files and directories* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -367,6 +397,12 @@ This user right determines which users can bypass file, directory, registry, and This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. + +GP Info: +- GP English name: *Change the system time* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -410,6 +446,12 @@ This user right determines which users and groups can change the time and date o This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. + +GP Info: +- GP English name: *Create global objects* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -453,6 +495,12 @@ This security setting determines whether users can create global objects that ar This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users + +GP Info: +- GP English name: *Create a pagefile* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -496,6 +544,12 @@ This user right determines which users and groups can call an internal applicati This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. + +GP Info: +- GP English name: *Create permanent shared objects* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -539,6 +593,12 @@ This user right determines which accounts can be used by processes to create a d This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. + +GP Info: +- GP English name: *Create symbolic links* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -582,6 +642,12 @@ This user right determines if the user can create a symbolic link from the compu This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + +GP Info: +- GP English name: *Create a token object* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -625,6 +691,12 @@ This user right determines which accounts can be used by processes to create a t This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. + +GP Info: +- GP English name: *Debug programs* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -668,6 +740,12 @@ This user right determines which users can attach a debugger to any process or t This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. + +GP Info: +- GP English name: *Deny access to this computer from the network* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -711,6 +789,12 @@ This user right determines which users are prevented from accessing a computer o This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. + +GP Info: +- GP English name: *Deny log on as a service* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -754,6 +838,12 @@ This security setting determines which service accounts are prevented from regis This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. + +GP Info: +- GP English name: *Deny log on through Remote Desktop Services* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -797,6 +887,12 @@ This user right determines which users and groups are prohibited from logging on This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. + +GP Info: +- GP English name: *Enable computer and user accounts to be trusted for delegation* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -840,6 +936,12 @@ This user right determines which users can set the Trusted for Delegation settin This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. + +GP Info: +- GP English name: *Generate security audits* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -887,6 +989,12 @@ Assigning this user right to a user allows programs running on behalf of that us Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. + +GP Info: +- GP English name: *Impersonate a client after authentication* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -930,6 +1038,12 @@ Because of these factors, users do not usually need this user right. Warning: If This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. + +GP Info: +- GP English name: *Increase scheduling priority* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -973,6 +1087,12 @@ This user right determines which accounts can use a process with Write Property This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + +GP Info: +- GP English name: *Load and unload device drivers* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1016,6 +1136,12 @@ This user right determines which users can dynamically load and unload device dr This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). + +GP Info: +- GP English name: *Lock pages in memory* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1059,6 +1185,12 @@ This user right determines which accounts can use a process to keep data in phys This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. + +GP Info: +- GP English name: *Manage auditing and security log* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1102,6 +1234,12 @@ This user right determines which users can specify object access auditing option This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + +GP Info: +- GP English name: *Perform volume maintenance tasks* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1145,6 +1283,12 @@ This user right determines which users and groups can run maintenance tasks on a This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. + +GP Info: +- GP English name: *Modify firmware environment values* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1188,6 +1332,12 @@ This user right determines who can modify firmware environment values. Firmware This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. + +GP Info: +- GP English name: *Modify an object label* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1231,6 +1381,12 @@ This user right determines which user accounts can modify the integrity label of This user right determines which users can use performance monitoring tools to monitor the performance of system processes. + +GP Info: +- GP English name: *Profile single process* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1274,6 +1430,12 @@ This user right determines which users can use performance monitoring tools to m This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. + +GP Info: +- GP English name: *Force shutdown from a remote system* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1317,6 +1479,12 @@ This user right determines which users are allowed to shut down a computer from This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. + +GP Info: +- GP English name: *Restore files and directories* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
@@ -1360,6 +1528,12 @@ This user right determines which users can bypass file, directory, registry, and This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. + +GP Info: +- GP English name: *Take ownership of files or other objects* +- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 8fa7a54082..f4e3dbae88 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - Wifi @@ -97,6 +97,14 @@ Allow or disallow the device to automatically connect to Wi-Fi hotspots. Most restricted value is 0. + +ADMX Info: +- GP English name: *Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services* +- GP name: *WiFiSense* +- GP path: *Network/WLAN Service/WLAN Settings* +- GP ADMX file name: *wlansvc.admx* + + The following list shows the supported values: @@ -149,6 +157,14 @@ Allow or disallow internet sharing. Most restricted value is 0. + +ADMX Info: +- GP English name: *Prohibit use of Internet Connection Sharing on your DNS domain network* +- GP name: *NC_ShowSharedAccessUI* +- GP path: *Network/Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 56be2210b2..8329d11f77 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - WindowsDefenderSecurityCenter @@ -124,6 +124,15 @@ Added in Windows 10, version 1709. The company name that is displayed to the use Value type is string. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Specify contact company name* +- GP name: *EnterpriseCustomization_CompanyName* +- GP element: *Presentation_EnterpriseCustomization_CompanyName* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + +
@@ -167,6 +176,14 @@ Value type is string. Supported operations are Add, Get, Replace and Delete. Added in Windows 10, next major release. Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. + +ADMX Info: +- GP English name: *Hide the Account protection area* +- GP name: *AccountProtection_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Account protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + Valid values: @@ -219,6 +236,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide the App and browser protection area* +- GP name: *AppBrowserProtection_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/App and browser protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -269,6 +294,14 @@ The following list shows the supported values: Added in Windows 10, next major release. Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area. + +ADMX Info: +- GP English name: *Hide the Device security area* +- GP name: *DeviceSecurity_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Device security* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + Valid values: @@ -324,6 +357,14 @@ Added in Windows 10, version 1709. Use this policy if you want Windows Defender Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide non-critical notifications* +- GP name: *Notifications_DisableEnhancedNotifications* +- GP path: *Windows Components/Windows Defender Security Center/Notifications* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -376,6 +417,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide the Family options area* +- GP name: *FamilyOptions_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Family options* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -428,6 +477,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide the Device performance and health area* +- GP name: *DevicePerformanceHealth_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Device performance and health* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -480,6 +537,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide the Firewall and network protection area* +- GP name: *FirewallNetworkProtection_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Firewall and network protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -532,6 +597,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide all notifications* +- GP name: *Notifications_DisableNotifications* +- GP path: *Windows Components/Windows Defender Security Center/Notifications* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -584,6 +657,14 @@ Added in Windows 10, version 1709. Use this policy setting if you want to disabl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Hide the Virus and threat protection area* +- GP name: *VirusThreatProtection_UILockdown* +- GP path: *Windows Components/Windows Defender Security Center/Virus and threat protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -636,6 +717,14 @@ Added in Windows 10, version 1709. Prevent users from making changes to the expl Value type is integer. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Prevent users from modifying settings* +- GP name: *AppBrowserProtection_DisallowExploitProtectionOverride* +- GP path: *Windows Components/Windows Defender Security Center/App and browser protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -688,6 +777,15 @@ Added in Windows 10, version 1709. The email address that is displayed to users. Value type is string. Supported operations are Add, Get, Replace and Delete. + +ADMX Info: +- GP English name: *Specify contact email address or Email ID* +- GP name: *EnterpriseCustomization_Email* +- GP element: *Presentation_EnterpriseCustomization_Email* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + +
@@ -733,6 +831,14 @@ Added in Windows 10, version 1709. Enable this policy to display your company na Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +ADMX Info: +- GP English name: *Configure customized notifications* +- GP name: *EnterpriseCustomization_EnableCustomizedToasts* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -785,6 +891,14 @@ Added in Windows 10, version 1709. Enable this policy to have your company name Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +ADMX Info: +- GP English name: *Configure customized contact information* +- GP name: *EnterpriseCustomization_EnableInAppCustomization* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + The following list shows the supported values: @@ -835,6 +949,14 @@ The following list shows the supported values: Added in Windows 10, version 1803. Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. + +ADMX Info: +- GP English name: *Hide the Ransomware data recovery area* +- GP name: *VirusThreatProtection_HideRansomwareRecovery* +- GP path: *Windows Components/Windows Defender Security Center/Virus and threat protection* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + Valid values: @@ -885,6 +1007,14 @@ Valid values: Added in Windows 10, version 1803. Use this policy to hide the Secure boot area in the Windows Defender Security Center. + +ADMX Info: +- GP English name: *Hide the Secure boot area* +- GP name: *DeviceSecurity_HideSecureBoot* +- GP path: *Windows Components/Windows Defender Security Center/Device security* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + Valid values: @@ -935,6 +1065,14 @@ Valid values: Added in Windows 10, version 1803. Use this policy to hide the Security processor (TPM) troubleshooting area in the Windows Defender Security Center. + +ADMX Info: +- GP English name: *Hide the Security processor (TPM) troubleshooter page* +- GP name: *DeviceSecurity_HideTPMTroubleshooting* +- GP path: *Windows Components/Windows Defender Security Center/Device security* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + + Valid values: @@ -987,6 +1125,15 @@ Added in Windows 10, version 1709. The phone number or Skype ID that is displaye Value type is string. Supported operations are Add, Get, Replace, and Delete. + +ADMX Info: +- GP English name: *Specify contact phone number or Skype ID* +- GP name: *EnterpriseCustomization_Phone* +- GP element: *Presentation_EnterpriseCustomization_Phone* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + +
@@ -1032,6 +1179,15 @@ Added in Windows 10, version 1709. The help portal URL this is displayed to user Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete. + +ADMX Info: +- GP English name: *Specify contact website* +- GP name: *EnterpriseCustomization_URL* +- GP element: *Presentation_EnterpriseCustomization_URL* +- GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* +- GP ADMX file name: *WindowsDefenderSecurityCenter.admx* + +
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index 0b0a6104d4..3549c95e06 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - WindowsInkWorkspace @@ -69,6 +69,14 @@ ms.date: 01/30/2018 Added in Windows 10, version 1607. Show recommended app suggestions in the ink workspace. + +ADMX Info: +- GP English name: *Allow suggested apps in Windows Ink Workspace* +- GP name: *AllowSuggestedAppsInWindowsInkWorkspace* +- GP path: *Windows Components/Windows Ink Workspace* +- GP ADMX file name: *WindowsInkWorkspace.admx* + + The following list shows the supported values: @@ -119,6 +127,15 @@ The following list shows the supported values: Added in Windows 10, version 1607. Specifies whether to allow the user to access the ink workspace. + +ADMX Info: +- GP English name: *Allow Windows Ink Workspace* +- GP name: *AllowWindowsInkWorkspace* +- GP element: *AllowWindowsInkWorkspaceDropdown* +- GP path: *Windows Components/Windows Ink Workspace* +- GP ADMX file name: *WindowsInkWorkspace.admx* + + Value type is int. The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 513b783cee..cc10b25f2c 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - WindowsLogon @@ -83,14 +83,14 @@ If you disable or do not configure this policy setting, users can choose which a > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Turn off app notifications on the lock screen* - GP name: *DisableLockScreenAppNotifications* - GP path: *System/Logon* - GP ADMX file name: *logon.admx* - +
@@ -145,14 +145,14 @@ If you disable or don't configure this policy setting, any user can disconnect t > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - + ADMX Info: - GP English name: *Do not display network selection UI* - GP name: *DontDisplayNetworkSelectionUI* - GP path: *System/Logon* - GP ADMX file name: *logon.admx* - +
@@ -196,6 +196,14 @@ ADMX Info: Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations. + +ADMX Info: +- GP English name: *Hide entry points for Fast User Switching* +- GP name: *HideFastUserSwitching* +- GP path: *System/Logon* +- GP ADMX file name: *Logon.admx* + + The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 5830a05aa4..9e122a3f3f 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/05/2018 --- # Policy CSP - WirelessDisplay @@ -291,6 +291,14 @@ If you set it to 0 (zero), your PC is not discoverable and you cannot project to Value type is integer. + +ADMX Info: +- GP English name: *Don't allow this PC to be projected to* +- GP name: *AllowProjectionToPC* +- GP path: *Windows Components/Connect* +- GP ADMX file name: *WirelessDisplay.admx* + + The following list shows the supported values: @@ -422,6 +430,14 @@ If you turn this on, the pairing ceremony for new devices will always require a Value type is integer. + +ADMX Info: +- GP English name: *Require pin for pairing* +- GP name: *RequirePinForPairing* +- GP path: *Windows Components/Connect* +- GP ADMX file name: *WirelessDisplay.admx* + + The following list shows the supported values: From 0edc458564c17528315eb3bed5f3cff1746d93a5 Mon Sep 17 00:00:00 2001 From: v-savila Date: Tue, 6 Mar 2018 13:04:07 -0800 Subject: [PATCH 084/119] add ms.topic metadata value for task 1199273 per Sarah Barrett --- education/index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/education/index.md b/education/index.md index 386a59f34f..3e75f1c5ee 100644 --- a/education/index.md +++ b/education/index.md @@ -4,6 +4,7 @@ hide_bc: true title: Microsoft 365 Education documentation and resources | Microsoft Docs description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. author: CelesteDG +ms.topic: hub-page ms.author: celested ms.date: 10/30/2017 --- @@ -696,4 +697,4 @@ ms.date: 10/30/2017 - \ No newline at end of file + From 064a7262819afda3cba01bab06ee07103931589e Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 6 Mar 2018 22:07:54 +0000 Subject: [PATCH 085/119] Merged PR 6195: EnterpriseModernAppManagement CSP - added new setting --- .../mdm/enterprisemodernappmanagement-csp.md | 20 +- .../mdm/enterprisemodernappmanagement-ddf.md | 1629 +++++++++-------- ...ning-csp-enterprisemodernappmanagement.png | Bin 95333 -> 112574 bytes ...ew-in-windows-mdm-enrollment-management.md | 11 + 4 files changed, 859 insertions(+), 801 deletions(-) diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 5062ee119e..2ad3ca1434 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -7,11 +7,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 09/22/2017 +ms.date: 03/01/2018 --- # EnterpriseModernAppManagement CSP + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. For details about how to use this CSP to for reporting apps inventory, installation and removal of apps for users, provisioning apps to devices, and managing app licenses, see [Enterprise app management](enterprise-app-management.md). > [!Note] @@ -359,6 +363,20 @@ The following image shows the EnterpriseModernAppManagement configuration servic ``` +**.../*PackageFamilyName*/MaintainProcessorArchitectureOnUpdate** +Added in Windows 10, version 1803. Specify whether on a AMD64 device, across an app update, the architecture of the installed app must not change. For example if you have the x86 flavor of a Windows app installed, with this setting enabled, across an update, the x86 flavor will be installed even when x64 flavor is available. + +Supported operations are Add, Get, Delete, and Replace. Value type is integer. + +Expected Behavior on an AMD64 machine that has x86 flavor of an app installed (Most restrictive wins). + +|Applicability Setting |CSP state |Result | +|---------|---------|---------| +|True |Not configured |X86 flavor is picked | +|True |Enabled |X86 flavor is picked | +|True |Disabled |X86 flavor is picked | +|False (not set) |Not configured |X64 flavor is picked | + **AppInstallation**

Required node. Used to perform app installation. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 335ebd258e..7c3c1c855b 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -7,899 +7,928 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/01/2018 --- # EnterpriseModernAppManagement DDF + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the current version for this CSP. +The XML below is for Windows 10, version 1803. ``` syntax ]> + "http://www.openmobilealliance.org/tech/DTD/DM_DDF-V1_2.dtd" + []> - 1.2 - + 1.2 + EnterpriseModernAppManagement ./Vendor/MSFT - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - AppManagement + AppManagement + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + EnterpriseID + + + + + + + + + + + + + + + + + + + + PackageFamilyName + + + + + - - - - - - - - - - - - - - - EnterpriseID - - - + + + + + + + + + + + + + + + PackageFullName + + + - - - - - - - - - - - - - - - - - PackageFamilyName - - - - - - - - - - - - - - - - - - - - - - PackageFullName - - - - - - Name - - - - - - - - - - - - - - - text/plain - - - - - Version - - - - - - - - - - - - - - - text/plain - - - - - Publisher - - - - - - - - - - - - - - - text/plain - - - - - Architecture - - - - - - - - - - - - - - - text/plain - - - - - InstallLocation - - - - - - - - - - - - - - - text/plain - - - - - IsFramework - - - - - - - - - - - - - - - text/plain - - - - - IsBundle - - - - - - - - - - - - - - - text/plain - - - - - InstallDate - - - - - - - - - - - - - - - text/plain - - - - - ResourceID - - - - - - - - - - - - - - - text/plain - - - - - PackageStatus - - - - - - - - - - - - - - - text/plain - - - - - RequiresReinstall - - - - - - - - - - - - - - - text/plain - - - - - Users - - - - - - - - - - - - - - - text/plain - - - - - IsProvisioned - - - - - - - - - - - - - - - text/plain - - - - - - DoNotUpdate - - - - - - - - - - - - - - - - - DoNotUpdate - - text/plain - - - - - AppSettingPolicy - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SettingValue - - text/plain - - - - + Name + + + + + + + + + + + + + + + text/plain + + - - - UpdateScan - + + Version + - + - + - + - + - text/plain + text/plain - - - - LastScanError - + + + + Publisher + - + - + - + - + - text/plain + text/plain - - - - AppInventoryResults - + + + + Architecture + - + - + - + - + - text/plain + text/plain - - - - AppInventoryQuery - + + + + InstallLocation + - - + - + - + - + - text/plain + text/plain - - - - RemovePackage - + + + + IsFramework + - + - + - + - + - text/plain + text/plain + + + + IsBundle + + + + + + + + + + + + + + + text/plain + + + + + InstallDate + + + + + + + + + + + + + + + text/plain + + + + + ResourceID + + + + + + + + + + + + + + + text/plain + + + + + PackageStatus + + + + + + + + + + + + + + + text/plain + + + + + RequiresReinstall + + + + + + + + + + + + + + + text/plain + + + + + Users + + + + + + + + + + + + + + + text/plain + + + + + IsProvisioned + + + + + + + + + + + + + + + text/plain + + + + + + DoNotUpdate + + + + + + + + + + + + + + + + + DoNotUpdate + + text/plain + + + + AppSettingPolicy + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SettingValue + + text/plain + + + + + + MaintainProcessorArchitectureOnUpdate + + + + + + + + + + + + + + + + + MaintainProcessorArchitectureOnUpdate + + text/plain + + + + + + UpdateScan + + + + + + + + + + + + + + + text/plain + + + + + LastScanError + + + + + + + + + + + + + + + text/plain + + + + + AppInventoryResults + + + + + + + + + + + + + + + text/plain + + + + + AppInventoryQuery + + + + + + + + + + + + + + + + text/plain + + + + + RemovePackage + + + + + + + + + + + + + + + + text/plain + + + - AppInstallation + AppInstallation + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + PackageFamilyName + + + - - - - - - - - - - - - - - - - - - PackageFamilyName - - - - - - StoreInstall - - - - - - - - - - - - - - - - - - text/plain - - - - - HostedInstall - - - - - - - - - - - - - - - - - - text/plain - - - - - LastError - - - - - - - - - - - - - - - text/plain - - - - - LastErrorDesc - - - - - - - - - - - - - - - text/plain - - - - - Status - - - - - - - - - - - - - - - text/plain - - - - - ProgressStatus - - - - - - - - - - - - - - - text/plain - - - + StoreInstall + + + + + + + + + + + + + + + + + + text/plain + + + + HostedInstall + + + + + + + + + + + + + + + + + + text/plain + + + + + LastError + + + + + + + + + + + + + + + text/plain + + + + + LastErrorDesc + + + + + + + + + + + + + + + text/plain + + + + + Status + + + + + + + + + + + + + + + text/plain + + + + + ProgressStatus + + + + + + + + + + + + + + + text/plain + + + + - AppLicenses + AppLicenses + + + + + + + + + + + + + + + + + + + StoreLicenses - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - StoreLicenses + + + + + + + + + + + + + + + + + LicenseID + + + + + + LicenseCategory - - - - - - - - - - - - - - - + + + + + + + + + + + + + + text/plain + - - - - - - - - - - - - - - - - - - LicenseID - - - - - - LicenseCategory - - - - - - - - - - - - - - - text/plain - - - - - LicenseUsage - - - - - - - - - - - - - - - text/plain - - - - - RequesterID - - - - - - - - - - - - - - - text/plain - - - - - AddLicense - - - - - - - - - - - - - - - text/plain - - - - - GetLicenseFromStore - - - - - - - - - - - - - - - text/plain - - - - + + + LicenseUsage + + + + + + + + + + + + + + + text/plain + + + + + RequesterID + + + + + + + + + + + + + + + text/plain + + + + + AddLicense + + + + + + + + + + + + + + + text/plain + + + + + GetLicenseFromStore + + + + + + + + + + + + + + + text/plain + + + + - + ``` diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png index b834990924fbe674dd5a0bad29e364dce9c3f04e..a28f41fe6a5d6feffc824118eeb4a776f7ac494b 100644 GIT binary patch literal 112574 zcmcG$c|6p8xIaAYqLOSCrIaOvvXwnGS_q{`_FdK(+Zam=l`Uo8g-{9Ejlq;P%UH5A z$TnjeyBQ2K&u65&?sJ~!cYf!b*YiiOyYBfepY3{I@9TYC*VkV|?fOCb+k zrVA;Mh*8CjBj-M$KFwy9uE$29N>QJt$vWNjv)S3jG1i~wKAwD3@#P={^28#QZU+Ps z`hjOoiVdRcD`p z+gN&GO!oHngQYIh4V@~4-Y)-`(RQ)xK8sy25mmV*!l=5e*NkyGx2f<;BtPy)G=rIN z81exwG={-aI0^LzEQ`M!%kcX8I+;r^X0m{{rDAboq3)!D)6lo8B+d#4xhE}!w6X6w+^eOaWVEby<4y=NJBaZ#6*UD zc+Nq%r76*CAq$0zYo z)Z}N6Mnv-OhP=zA4|oiNEn)p)GG2RM?mpN=7lOp%QkL9qgXK+s#$Dz_D4$c`yq|rv zV6vd7NOu(J=M}qyQ*i$9^9}oOX&-81ov=a0&q1&o?`|$aSNm&14CPmz>j_SXRg{z$ zUcxC%cz^ut?`B1vBlzd0L~Zbpk6MZVUZkW{am z#eeOvLy9J5JJeL*@qE+;sU**dL2!`YUAV?HSdJi>A*@5F4NW~*Vr55x7k0ob?S5?B z*aOKv?3MDUymNx_K@squeX{V|eUc3_A&DB)%?U3nJf$8_Ns`Zg9 zL;C~!czVyeF=((opgeGT>AE>~X4HTjBvWr^qAp}}(TADZYNGAR%=ADeKAGINxukj$ zfANByIn~~TB-NfYm_wAtr!dc6z}XoM9@r>11?Q`Zb$D@cakyOs*I-mv?{d>E-Cf1@ z?P`tb^?M1&^3^svvg66gU$YbXmmOu674QV4I?B69-8^iW$LE9$MTg+|qP~4b){ahD za4b;tII1;J5(N+UUzk}QxRH*(%pU*cA`W9Tcw_;w3jzs})%Il{l%aOlRfIM^OW@@? zHW0%d)w7aXadWXT{Q;ZY!t(d1XYX#J8aR1uFp1{$q&@3|}Dg2UdW$X7!gz#hkXxv^Mm{A2-fRXYeZdZvMeNqW#u)@SC$ z9TwaiKCL}MM87U?R8mS1Av1|=ksmrUBYjn*FC~IKpVfmcnRJ4~o+(!9Ib3D_+XY~j z#(|H!eKM+vw_-2y-dZfg4~$%7_B!y8#Zu=fR7QwD&a;Arvr(->eZ%S zfwR?S5jc-U5y~m&NA=p5UG~C1Z{A*MdCXO%ph^c(g!ORSwiE%xGZd!lcuVSEmw7JR zMM+<`EJ?cHuz#uc)esL@{!HUT&_W$k4t6=^X9#gC`yLkL{upBJAOsDx$ly~ZXnJd;zO9rDbsJn%DoC*z%O z4i7Kl&KnONT|fa74wBUU=iD(oD_2|B6)zk5%G6R3$hY2krrgJ&?)4e9kJE;4w0sD4 z*?dBi8?eVi#o3wxJ|ZfvltBl-1uE0EVz_i5GZBRs@we=zh8F!b2n^eBWu=3U$H9qpj};&F%2`Y;>#%8x`&Py?LIMu+C_I~P4!Davxk9whb6$2%=;m9N=BWYWH>LY#Ob9)Z?5nSww2Kay^3f?&H?` z;d(Q*E++}RZ!jPoKS)pCq*`j3-#@cgweX((n zn_KJ6g?6sEUG#{*o5QUN_M}~24ZVBrK#lhKz%O;j0z|aB5`98i$;5yJ{@#qT@Hjq0 z#5-7p`QYB!gJ7z$S6GsBi;7%v*c=*uWwX*})Mdm}#nUI=wHH9V2&q_46U*nraC|KX zyiL(`EU>i%hHus-)a!33CYJ?j`G5R*Zah83(n^@L+|(8k!Ajx$f}!BegqZr;s4xy{XZ_w9gKS@4qWaf%iGtUB) zeaS5@DJdzxKDOT5+fH5&=2acXy{#g}syq_@fc(61RSW|8+JmGsot~cN(nGtZ!=~yS zUN2mBx?QJt3AWbktQMu8>=6p_w*EnEBAwLXn zQrZnSw8fBqD<@!&n)Y0bs@D^O)i?QxMTLa;?|>*a4+e;ue;Ubekw?uBt}Vgx3C*gg z0r`G!ga^)Q08iaiXUB}ObvZVTi?Y|~9fv(_GQY?kco?8=IXL;Ktel*jj-g!&Wwy0) zAI0QZfbpWVA2PjuQ9?JsOk-&8==RWfzW8A%zlJa1flv9Bp3><5!D~$PEC67vP6cSZ z15ttEt~ zQ&RZ`V@SnD7Pd0>HIjd!^TMBnY0%(;z~+#F6>XGYD` z3sFt9O=yCONBz*h2d>p;8}94tt7&9cE6hleCqB*=i|z|XzQWzDkW#4I1d}=3kEF}- zS^gH&{Lzw+5m))_ZHHJxXH6)F&Ego^-N&N z13dcx3U}nwb$4}1&lOQ9Q6b~UpB>A+5Y?k+C4Xfv~mNqQn@FmG;;$0QV zGGd|)BIXNslO+~}1H>PMa<5=l0Ucip5SckmcbzA_02Ycl6+k02Kd6#7R{|ar+ zeymSh+tusD>{`rMOInra`)Ca~-4i%R$!|8VK%Qwo<3JVf-Z$KyN=FDTMZPZo#x~%t z8y)M)kebnEravJPBG_PCBH9`AAW!9o9p*Xq5JPu(+oMLI!LyrV#pK7mT1b&PA@QgD z>}(G9meTSE#TYb~yqVbS@2*O?`m{GB0mwx;nzogn2WYdaWQ&!?$dOmylARn6%NIrJ zed~#tu5KLNyLjaMIf1t}ld<)o@5@I777;2lqS96y)}+|M)3zz&rJv>>6Lb3;hR(ug zvUnwnb^{HIO%kKr5px5 zHwjTrw>7$EGU#g7T`}2D1hdl&6t44k&)o6NZlY(jtQ%^OA8bzaFie$;e{i1sa7Ja8 z*%~2~|8n&J;)G)~)T;L11i5?-iRVQ}GCa%U4G<$4TZ!xJWvvU&02VTW=5u* z$`2cKnKo#*kwIXcizlrIUWVx+59V_q@;usM6YFtYlTjALM_d_l+V0h-*^~dp6^#`r z$10zOeCFYGUwyeB%;J!)FQGSv=0Sw%rX*R6>rDrb;DVXZDgfcF$dx#p1xhR|^Xc(J z&V*V58Tw|tGeyT#96z!4>GAiO@RZ}>o8UvA*? zTa_IzE|?A;#Sw-F&jB~%>}3ofGrheb4N?_-!QlYqtu=6_r`A!m2{H1Ul}FMm{vJ&} zv1>!id{`Fdn-iI$(zRz!!*Q_4#ew1qAze4eKx;dULhT z;n1S;Jx;|oQ;rA74^HZ-T)S1S6Iu#v`*#>k)$uNZc|4}>4YoV?)}wx3 z1$SjAhwZ{>q6iNroKUw{=iZ$>x|*{h^#gtAnb5@Oqs89ZdrIwUoWyX;BN>#aQ%h=` znfONsD(Eo%U(1d)>2iBJ09W)DAJDowFV(%*HLkVm{<^W1Y<9ng#gK4-=)sS+7*D1? z`^FOmmH{gdhE5j$JZWr?u}T@}%AxZS-RuAa7+DO$I;$t2>7=BjEG=5(y~ir_xR#Bt zo$amvaqGp~B)xLO#n^Lw`6N;llu5ZQa@H7+@U5Bdzxo}gqOGRhnH0;K4Bu7IT#m^R z0737aJZ^EI>cwALE7#)=S4i<4$(3UnaL;EXuEBgKP1~*O+XtaX{RU13i0TY|elx3~ z>g=&+QcIbMjVo7Vi|YOyq=|&bt}z{-Gms_Ci~;|lG0QTze2ZS>Q0lULyia!)UPV79 zqWo+?>j|D-PkDRPAoM|51-ezO$d1#mS7pIlDNyu~CaUTgRtQdW{cC{<7|d;wJT`B>;%wR4 zM5bW_Yn5X9A!syu@)A9C6^MfBZi5%22Ft<8R}5oeNnRkwH99nJOpB&`nSvfoQtrN9 zwQ>@coMHKTaHDt#)yN1ASb7Ova707|V691>gr_vOEr~l4$6zO1jG6~ih6B9<5MD_b zrD`4i-mr917 zG=+is?B^JwZKm82%0!ZIjHCLL zeG#kS30TbPlcNv_KhewFG!qyec43UG%p--y4k84LB$=Mf3)gPypl6}Vd=FksOD4gO-f zmKKb>*UYepk#n6DA;|+bqrqA}Kv^>8z|RBDb+9*StF7I_zDG zW1m^+#E|Y^x^}ryp5IK!u>ACKe%rn^AGOJ zNp9nQ(l6Yvj&Z}5-~sO2ZQ;ItoFG0jF$7WC2w(0LDYQJN1W`-{v(ob&UfQsks}NmL z&6agN+JBdOC6v(<>dPb5Gg2pKc&m@UKji$U50Pd}0SlRe{aKrh!jt~~j?-@U-}P$= zNtvpNcu)E4zc{*K%IW}gTS`EyDhgu=bUN|lQ2uH;62_EkU$Y9IFrkpnPCt#yqjt13 z%aTY)p=-Bj=xSn5KA3~OQaB~>@Gl22TS14C$^cOqKNolebRu#00|Ntj&-EHT*AHj7 z>(wH)@}6#tO>KsDE4L+uS@R?%_t8PrANuJ80S^!oE}Jy zo>-@+RAekCur$Ir^yTiv;NxqQROUimQhfvbOelm9Wg4jarF|5 zfUk8h0;VG7)(hE`+m!1azGB z^-`4W_E;YH@?KQ6j{f^_d`*O9w> z$@j|XM%&*c5pY@`CVJ4Ci_N{jAGv)4uNT-d+u+7I!;P0xiQoO`H2vUX^W_;b4q4gR zr7C+MiqFCMncPZB&DOv~%8+$FS+SE#H18Eg_!vheBHR+db0ooY%IQo&^ra5Knnveb z_KStDeOuPFY)L3Zkg`#-VDKlQ{L3Hdf`ONC8H|AglAWkP=}FD;KG)6f5~BcLLwl{X z`qZEQ+~_&FvX7Q!0|KyoiFYts?*QaU2sg{Rwr_5nlmk$;Kg!9p+ZU_5sj0SbX0>gM zjEP{R@b%gju*OUU!t2c!Nr+-Epi>nVO1J^pUGW*XSKqgyv$HeeAsk<2zJys@f6F+q zwEok9c^BkeDxKdIHe-U`+OkiKL$g$f*GwYNV(wf4dO`9tARQRpqbUU+XrjT<`!tO} zfF>6x18~ytr3YHWlRMD==A|js++{A)T|1|Mwon6(?blZ{$wA|e2~$x^VeQa*7lUSt zXlGJV((2$EQpar^0yzV=m0t;pgsxVOFn|PD}!aFjpIwqRi>Sa%o@Lj z8h06J9pXFwi=P5suo-6*77iS5IdA&|s3ontx29*U?K>LSuN!E(9-5F*%^jckpl@(6 zzyiRi_5GLJyPxpVG!~63OvKm$f~&1P0`UlB%vM2k-iLL2Pq*XUewyTRPs6v|LK{^m zMF-Fm6{+nF7R_oWO?zQ=WTMmzPvfrq7M)u*Il+>~J^|?bz)}5_zFwJW#bux6FcKO*Gx`<2jAy6LMC6P&q%OZrj@0G; zBq*#v5+^O#ho}c{b};X2@R7D93fbeJD>3(Q!t%F>ht9SjtI>-ohk(#@Tak83MjCEx zavINZH$_BJ#mVBAV-ukhSF$a^0FR|0?|N}zRqlOO-t+Pb+3VKlfKgRz z;WYoGfVM_E4v)b9vJZb6DJp%o{s0gq?L!dJl&zBpI0PWLcehU^NZ$b51ILi22BvP= z)gCa;uOGH-@CulP=%@e1r95oI4)SaB8(1ODC>_0rkN-6c0xSzC0YnN44RJ}GZ@l5%fHXso-oEQ_$AK`CYBtAt?VPgLWJ*>Yyf43@t3`no z@kY=&OJ{2Ph#syBK2tn-G!5d*o*0LVxk}xq!8$71ZJ~6@-MXYRK@ZPor9ES{wSaTYu(26;xE9ed z%rOyVcY}TTaB%CKu81h-#P=m#6Z{Od8}jCI17v z9jSDqEq0^+BlWr^q7p-StmdOay60^^ejvr>WE_=ppcl=rG3$M6mKxqvrUT7dc zWcK6tAdE=QoZ>~5rF~9Hk>)=>f8D@W@`)`E@x$d_j1V`ofbmVzIntdy6jTRhWNEsGwQN2>K1*0q22-llebMCu7OmIPOlH#x zxg|%p*V@)Bx&*>(Q@bN7qVANsoTEfz44M*ke`zv;tMen!$;#|?48_nt%7 z^vAE?9ab@zU2Zrtci8*DcolzXu4NLjFGN)^#&FSgv(6$w{nXS$=GP1Es42LKYjHhE zATcq+I^B|qZKm$vHnKW?F5!D4EIfE&C|+T`o;)N=bo?p1z7*&~Z0O#YdBejJ>;`LQ zIET*ks3-{JZnDpJ8H#L7xLE*i*#s3Af$Coowjm{f%wnb_&hx#e4KT~XN@B>(l0O!& zH#yqEgtMtf@$izBu>#X;KkR|LW!Q^WkR#>KajQnYl5@jYeoi+ZuL6{ItHQLJNYbOi7^|c`A3IwlVK#h6WilMliVT0ej9PXe*S1xI5kz#eRh4pe0^FaL)F)UGC7zrF1dAAevXx1BV zeJCH>-02uI>g45uTEe8cp%XEoKEZXt8wgIn`Re-G$J~n-YpVH0I?cugO055Ii)Y+I zUW;zK1^>l{XL9j|tBe)*tpDKIRRJZ7@Bah-4DbQ#*Q_fR2I>NVN6+bV&@1!&_7@76 zFlB>;WFddJ4b&gHIt=3Wq&V}bi)j5ZD$s+KIk)KL zk-#rr*(<*?l%fEFXE_X|?o4EJLX56$@eUyAfY6#st5)pfV)g^i43hmd=Km4=?>b+p zW@Ce(F$}b4h*-sgO0^eK`_k(BImFf3_cjZ?lyC*$dL^OxEh5B@z8y{;Js!9KiC5&pGk0&;qes0XK z%J@*Gs4;>e&Omq?nWaIRht)4g^PL(xKfM;(ec#a#*PSbfO*{%C`zz2uO?eNli~T=g zTHE=r1V5hq*KRwBDn;r93d*LZV#<{@NqI5!k{!vqJJ}7UN9y4ELv5z36sm`k?&3nI zYkbJX8?`nk5c#4QREZN-Gbgwp$_W~s9p?AW?wsQ*S{`EkW{AhP4pW7Z2ldwVn&eP^ zvAIXX`(KG*<34Z9#L5MH>5iEjDOpf)+CIv!Ol#zxvJ9LlyVoFBiB?#jrEb({!^Vee zz05cjR#c#pZ%P7zVxh;x#uM&Fhpt+@%{E|^uZ|#GXG^{zE=K8H55ce`DBb`BWJ#a1 zyZr1Ql)MlP$ja=zUEqR!GyKXZ>2^z$>mA=-eepThhnzPT#j)~;SxYqZf&0!implo# z`@Vjb6>+0%e{Iw$XwQA6UV>n+;z*GexLeb=e!YRRIf+d2VmHpK9?JKMCt!lnU+|BX z<(CFHi;e!+=X3rofGR)YRdQ@aV29jw=#K5Ec+z9(YP(kr^ zhMs7V=(baG=7)MyyG!+DK61$Gi1Lo1_8$m6@Q$v$p`Q0#*`=D1^$Vjzd%+nf zu1e&Ik|oGHhilm2HIVeo7tzMpp#5a7d+wYF}BBS$)n3U+cZf%1-*++H? zXz?V~vHk&)qfISL#FH^5CgD-m7v&VDFzOw3<6gO_OTz!q?q}RHLlZv5sXqB}qkw&F zhv58`6~S^o)a!fqNuZ?vTx`+<{eHmm&$|5I@-RTQ3`*Q9g4au&Rzm+pv4EN!q4eLB zFa9gq^e<85+L!v574xm{5%B_gJ$6xmFY7j39(*1#>>5ycslpch$||p%89tHx z86Ln^`;G0qYLN(5l8H;?;bgJ{Pd`q3@rS@esxD>tM{}RCHb}t zL@r@gdnioh_nY#U@9lWU#jkXla;8=8={+^tENt!X_(~kt^v!1<)Frpv=J1=nNPLs7 zE^oJSD!`EcVRVFM>GMiEv3fQO35PoU%rr!d=l2b?tNPj~;Y+6TzQIR5*XwbUqs}#q z6)Uam1A~OXN&As~a;rI(y3nTfF(XJTJ4^CmD$_)wBE3i@5Z^IbS=7}Q3>)-8(gl!# zC5=$mLxNWhwlB@zWn28jqry)$?vjNv*zJPPO#AhFgq~R!Vf`E_1fz!ZH=GpF)$EU0 z^FgUs8D7w>IWK|8=h}%US)DvSXc3B5fxAvl?odQ)_$qB&e}~xl(U%)LIM{=Im`Z0O zkxti-7s=ir`%vm?yVA9M9cRt-zD3vgUG6Lt?N-zpE;@OB)Yr;*{Z?6w-ko3XxN4s$ zAIPODZ`gB?YIlj zOEAg^mlhRf=cOrFsh9s=-L9{MeWvOX%tJUl;a*8>oluYgQM17(KEO5HGl(Mz%Rc_C zK%X`7MX`o#5r-Vh&j?=TrSw9a(b7uap7~?~&)<*f<8c1#JJ;*r2*u@xKXL9-b~Zw zF{~>(Ii~*H%S6*|bq6whdMtz^E9^5i;<-NJi{WeCZ`neyFB8ke3)|kk+Glqu-KFjWKmdg=CBwP==DvH;(5sv)(mgvbY}3qwOw)^zm_ut0vcTNhMB9=VjIh3HCgf zYk7w7EmwEo+IA4Xw~0h&zNfTnA?${#6%#K)%f8ZFQ_q(I$2I056lN7&C62+t#PK?< zp8xsYMW6h$rG;9LeeBtxM>Fo{VY5e1a2q&{rbck+ND!sFKqMd?*^llC>6LuQr=pH3 zUVZ0>5XFnMh{Ysk6o(u$W9st>y*zLDz@Kv8vY2sgPTmqljLe`~6_Q%6TT2)0sx9N;wj6h~>5xLWVV27h~6xpyP_sGi5!Qd7Y^?gV3diAUrd48gv|Z zp~F;~dQFgh_M5I1-{wU`!k~P*GKp^VojA4loj`sX?#>TS$z7v$VGDB!u*RL4ED&o@ ziT7)jSTc%fGef$FC$r z8A~=}nU7g27y0Q6_Fh8RO3oKy?BXZ-Yzn>)#gLpluAyYL%CsRz9eOrh(D8^Xd-AXr#vq?zW3xJBv#0T;p#Vv#Vve2^-|rYA zx9ck%NNsGv;}Ix$=~X6Wzj2cGvTUTVL?hO8?tZsXug#0|Vto4x^h(B2nEuLFM6-~# z2)8{5VoREh7sLwk_nXUsxxLH&$8!Ps1~qTMvEoQ6&-8h)sSd0}`RGVw;aGf+XKnW?K+YdyMUkR04{FPaDVJy_#To>|? zlszS9MVPcp{b@cpO`ewp&N%gvJ;}rwDq=mZgJH+8+csT z)Osz!huWg+)=kAUQB4G7-MSSFH`O)gsTCE-+(*J(fO4gRyerTbfwQo4V2}#!6tEmFHw4ZoF*;py^KTHS1jSk4%s{P>3-F?CZ~YX03;H= zu;^ExpR-kkscO7e0VfbG4EnR=VES0roe*)z)|kCnhHGnUkqlzA)+{Ie$^&i{3M<<9 zp*SA;9q%r0so=}0w7fnAWJJfDd_Pvo%B*#|i6p|h_d`UdeyQsQz98|32Gy6y!^WS) za8uDXW7%vFqxZjKNLpe2C%FWb!|B$h*>90|XJf&dv2U;0{Kz;%i`vPimAZEs?R_B6 z1oSSEp=pr3kJ-E?1|qt`=Kpxpk-*2G{8$x#Pgs7h0!UQB0(t3mNA*Pr=37+(IL2!s zjH&~!2r(IvWQmuw6l!tj<^0^-;lCnVkaYcBEynfyB*L_%Bkobj7Y>B00)uAz+Bis? zTNwC|(?GhBRvhq;^jImVEh6XR`JFn_)U%C)OuVM{P ztS#xm54hSoA$6aR@EXRO%zg~65&G_dW}(WO5PNeIvJt**xcVdHPyMoLstV-lSfU~* zOwH5YC)aY@n@|piy#^V{Eqa}@GR!qHr+#iJLu6A(`{b?@G-<1YEt>TF3FYN?$?njM z1{K#7<)%JiL*Js~n=>j>Epr*urdIjSsLriRAV~o>zEo<*mK>nODF}$qkvS%BYB18F zf}#K$zwrI$6o$i%%bp6gs;i9;Z2ZCk%x1)Kfjtd0>4Fo92R%Y4SXr}ecm6ddX zb5->-%*E5;Q9p90L8)g|*}3SrId!k4QFVEzKT87gHI0ppFV)e}f+62-%QrW@=dt9P znZ(l(o)>J)Bo5FQ(bcq2dlyx@mkkI4m8**0w-32&7xDg;P65fF+}sQ8kH#BJjl$3f zcA!5M)#9Y@l=m*ob*^~U&wfE{E>{iBJeVx<76MQjQzGA9zcT%Et1Moy5Q&`p*MSMX zwb2~<%s*eGSoGw0+S>#!RfUyrD>nZ+&7$jtJbYZ2JspIvyZ{9TlDMgOLcD>Yp

zh-m3AbJ6v!bzoQU24w(FtQTjJ>GCgV*Xf<1mC>9D-a@BIsFj{Kbwr_JA&O>Eq6*%y z8CszY$h4=v-nv3zs|^!aj>6@IVkD>W3mK85^=}b2bI8EmTc{1PTbulqJ%!Ut8GY>$ z8-cvR957Z;!@ppB0U~~IYey)o$&R2n3DhIS+o3lXKXS$L!`FMNnoiYuwqV=_J*k-c zTUoR{kk+HW1mK6hxhpFxE%M~1YxSTOz7OM1Y#L^Eh@-~o8U+4l&;kZYq$rEPJ3IXzji$+u8VkzvhL3FX#{xq#Lb>08OsjPaSv?2pVO) z;P5q2qDyN<_&(X}4=R^bzgG{{6OoZ?+1?xV*WKm@U54x-M_qp3^)=wJx%oH{{(6c1 z;FPXz*Z9+PGM;AU>$6frowP%J4^b-DzdjK*4eH@%QH0=>0C!KjF$rT=$IK8@py`4q zN=W84A(=ohV@pq85}dK9WiKvft8-##JPv=+pO$8s!Rk{!%;!)#&z|Aq>}?+z=l4&> zM5DW#yUfFjGT$#EPb--IIAgJKGN3P0LRh<}h7%+LKnn1k4g7L@23FPnV5IA!Iv2tn zw-M9XdEf0m#K?EM)WBs^u##ae!Dkp_>Ex0({Z`J*A&!trR|hJz@X|;>^V>eKd~BG{ zV&OhDx4|)oc*s$??S<4&3Yec-S$o1Me#YZF)xUHmzptNJGZ1MVr1152pQDFKy<8DO zOr%C;2DxwTM+rQBV5c+Um0>{hd&^wbxuN)=UQxOFF=3+(@%|7w{KT2XxHVJRS|JasaRrT7J9h>Vl~P4!d}%OizGE0f9exoySu9 z%P?zQeCCHl#2b+suStVNwNogGiKJvHIT9BLRKnU0wMSKFv{)3nCoDfLJ9cdG&Wh%B zwC8MP6AqUSisUqWe$Q-jtMU)j$ZT%T7)d*-q=j`v+sVK+MQ6)K7$2v)TlaE?7q15p zTUSE8j=xO6!tcIBim4uIgHhYo>vOM}xNcUPE%z8s$f>nhCoMgnq!q$o^aUUv6n@WU znY+w=trAoS!cOOPpQ~WD*d;i9nnS(!eDSPWz^z$V*Sco4969H57J?Xk$(Xl+^d2eV zk4dCYOoYL?hNvHPCY#O*Bfcbw^bSx%U~4jtE^}(Ad(rYJN8F<&RwBvC!{qy6bD7si!}~IqS4M!bJMwbo0AU1{gTC zXvh}&!$dys%NRVjr)9EvzdiHLqX&PFaSPnrrsDT+>{pU8(60BNEk%ad z-wrdME_snZI`yfJuTqZm6I~##U~w|zo2A>ht37X@S%@XS0)bUx5*;olNp9(qGL<@4 zdLP-cwh(8Uv=K?=h6MepP+>{V1|>T1CETJ{M9NC1V#`_p%i}i4)nwnp~=L&S&?`eV!)M`bD(x2hf#=zFKY9HXZr_KHSjT{HUE1N&m5_ zgslL5+`et|dn)x3MfEZT>Z%!7|FW^2S%vo)A**`X4Qq~Gw9gKk#RhGjs2;SYsN9d) z?%2^6g?zZYJ@F@A8~q{P#7qagz=r-H9d*qdC@kj=1=7kV0q=Q8yT63q7^Y8gIbtvOKGh?Zu$)p{*GbVyF_oiOa3m8rZeB!(D_NMPWPp^Pgv5a-J;Ul?)7;w=x($in(d(m-2C>k z=FwX3K0gILe$5s^=)zs6Ine}q+|L$u$|xviY1KaqIl6y)v6Ej>d13=L6^%)DWnK3k zdh36TDlm1Dy5LbCX|jGHmm1nr7O=$VAnUlWxW^3+is!b6`*Pf^F{!*W(R1Uw7gGG# zVDyv5*`1{`DhlU_vrK*cFDDoIIomtLM8;!(l$&vpWpcV`4PEF8=R_{9-J%}bqrM8- z(i6n+-Yc|L(4FR&+Fdx*H&))BJ)Fv;Bjdrv6*pOG7+pR_j8wfpHQ%Obs3PeyjDy$Xl-NKljBrSvRaD4Pl{{ZCZ8N^kr{HBH)zV}Uk%y(t!GQ0&2RY5^Ycl@%) z6pdrK4HCv8we3`Q#?ECtvR68+n7X~HOd~(5C6*{U6&TALhz9i6xRrcCt>U|e?IoiF zB~6ME+X%n}wEHIlslV#?xM@Wu_qSo}8Xe$UpMri7saJ;q6T5eeMihaVPpet^aPimb zomK*QR}J(3*B4!=ruC)iUAc)Rv3&i$RTXrFiM#qqAZ%_ZUq?Y0P~AWG!QM$IFr%ibE6@K<(`zQ1*DvD-kp=%vCI` zNIlFcvb3c2v(kL;FZiNyz*mQN@mF$4vFYYJP**Xzpw>N3F#2?J&qiez_@+qq_|;=n zvs;&QL3`AXK!;62(@ZZd$ZLeWOZ>fFZQZmga(B?B2uxV)X{bu%n_Nsmc|ucVhqJfe zK-207v1{aky|K=jmdA*?$|d#mYGwpD)j8%gb3&u_zjf(y!m@vO%wDNrA*CVeWuDG-8RdKu9Ue z92MwtD-lf{Hw6u;kGuCP-u~;+8$Z_zL97*F^Y#dzeW7#c@q9Zz2m0Cs?TsDw%P{Zr zanBdE4BJkY8sw>u{tS~*pAvO@F?o87k-g8WmTyjEXq55PEZiH^LMM5bP6)F;k={ml z?rTV>m4XO}%%{;8HL}raqQ$kS$(Ad>(!>BI;B?p;YxTUB-DP?Gh zoAsQr?;7zw?@0TOPt%N!yv$x}-`_?v&Ss2uI83zVbyR7|9*tEMQm-3G%Ae%T%duiy ziz>?sa2w2=`XLkOT6Wb^ieY@z8&h3BH&F7;PU)TG@9hGqI`Dm-0%^TSGS&PYAoEQwqvsHdVLXtXEnXJySx4%gHm%BKJ|#($+34T{fpZb7Nr0+c-U;E+>O%Zyfl3 z!-O!$6YIYQ&@59-7x%EU(hb*0X)KDABPY*}UVJoVt~ zr}kl@A4{#xW^?}aJkY1HO;E?b-E*~&&I%4b=(Yg4x1~SQ0E@DkF&9T_F{~iIg){gy zb%%Jat{BGGoA1-?z1*2t0V>h~E&2euR<_DOl|0vK)>hFu^J|MC_zI5+^camm&36Ys zEv2cpEgYoXM*yxYWYlIcQjG?0oL*{v*+}&u8p3+P>p@rz912ou#}oRk2^&*H)9G>@ z%r`lc>lv7jA!m#PWC*VPpeW?ey5-RV`22ww+K4d2-H{N9?Hug2S9t-gm)w%KK6NmX zYRycId^;o65p(SO-0RE^(866v!r`&zyEN>6BQWS6U}y6N{X8vraJ{LI7uIeqN40-Q z2Jih%|0=C_s1&}G4(QUSEp>qgkf20$YHA9Ex`15S&Y&d{$b~hj3pO`g6@F=DRSL>< z9eaL*KdqYpbVSoWIv{-IlX&)?x~&j%#E&w%DmK3A7N&ZhmrGb32zF)##Yfr=bwfAV z!jNjEFfj|NJ=|Pyski<)&8*oED31R|_!KO68GO9de;$9edaO&&6|~^{><=bE!FKvJxMnpoKxdkiEDBoO*@VhCguSv4;(H zbR60Lgepvc1RNF9cORchBhEB|Kmc@QO@d%0`bgbw68I1s_#9gy;}Dfb9i&buVtyYi zlQ+=lhdMe)5V|Ri>z7mNmvYLgu`5Qqdu{CCr5(ZW1SC z@0PSiGmovV4^ije3$g_fPm+Iw+3u}QkOL=vn+J_^&>2nqp6QjX?vSh7aW5cMpig4w zQINvTB!o;Xb3aNkCrwA6^Y?bpYiyAQE@=1h&)#^f(#y{Pn6^LNrDCg!I}7 ztz)Dx+7(5}<`f0Zd|OQ_fCjRTvke0^R>pneWIEebrj+08ACN);{>s`z&{tEx-Qm{6 zIAmB(fBNSv(N@A16xw|_^!NC`odm`h^$ZL7I?_&8s!O6ls!WL@Dd(yYWu&@ywR_y9%=Df21<)V0$lzCcX` zS!#Y7H)jnlyKZ$7rR$M0Z`+yn|4{ecaZP1;->Borj0GdjLK#ttAjJww8&PDDCa9p& zq=Pi+B|t1-0f7;umk0=`NbiKAC?LH_4GBXHB?LnWB_w&zr6|PReP(@jpU=L3Dk(Sj zp7T4u@-5utq&b?izBe|n`K9(X0J5gL_JL2i7mPo&d}@Tt&-3ehfI{iJB?{Iz%4JgIg$!T=gYLk?uSXb|iG2i>3}vmz z_&?s2EC>HtKmd@-PqvvU>|TDH>-Q4G`m&#Gi3=75RLmV${4Da(gqlqs){-f(DbxXI z9I=!MP4;dBbi?{L|KLXaE04q%CQ?qUm`DW#T+DX%swG}Ha?6$c4=%@-;uzIA*KNTB zkH8EtqtgqIB(Vq7TiZ4|0f9yUj}TZ_C{_rt8+=9pIC>Uu9!z^+wAGYpV~p85%2S89 zb5!r?HSDhyC*8Aq>kg}zc ze~sox*eygU#MYWrWmJVmkpJwYeUj*PYfe2!{+wPp!@JPzaMOFC@x^pS#6)rsQuE4& zAn2O%MZD ziojte5Jt!s!JBzFx&W(-+4GKvBt`MPmBHenyVzIq;f^nb%IC2LS>VS@g0ddJO8tXs zclj-V{PkzSxY;IM7C!EM{1xrjyiX5jwe^Pu@i>m7v{1gmJU=-vPsUe{zxZF|Ke5oo zguk+oK>y=^J{rFNAdn17IZjmoxuow_J+x&&p165z0CW)OH;W-`^E(ixR%+1y`6T`4 zd-mUYh(njXU|R+{IDj{jriXOV+O-#OWYq_h7Y_U@@`f-*3x9c2(b^04@Gw-_8VQ(&va*MT@(R#w~4l)vrm$nG-19CYi8#HsSR^USkn#huO(b zy45jr=@{k#CR>{;-^hLQ2f*!IpMt>H`yR-~iqkx|Hs}|7ETrps%7k$~h<>%X71ouE zJ*2ERC1WlkP(IQIkl58V#F2`^r&$h?{Gk*?!d+HjM6E+bM%^1lIU|>^c=E=V z*_wLu#;yDSTn4^tnScvLo5;)F*yNH_y8{khuq4E^xYGF(Tjk9yMfK`cHJnO(n@R?) z_lPF1eZ@+Cl5o|#E|xBT_(tCW%4=P`UfWYNw% z1=ww~an8g*x`20E)0=Q;VE%RLE3oyOjnLO`z$0KK;i~Bu#&v<9)P?-Hy4HTmWE^8# zwn{)yTGJ!C=xYa)nICYQ?$!EpsiHOv={lrPh!=3d*PoaxynURYcT>yAEf-f$^}Wn> zOy)9?dfqo<6C)p! z$>g^EbqINoQE0qE*DO@^JnB_yIY>fD4dRH!(2D*XY{MI zE&w_{gwCOSdva#5ro|i;m9Nra;g1e;XN`-{QyA@_TQd7u4_<+G^uJm|exE4(U=9pA zWa*ys)ar;)X!0POgaJ>BbzNEuN^Agv`*qC7$*JwT`dW^mllxmJ0=>n5rFj3>0tT3} z{0n^p0FnX?ZJhG`o%HIFm4C7=T<4S9AX`9Mw(F-*Ypd3KGiwE!Wij}Qz zWejty(3E=^=tcCI3DBkXB|JSt4<8&YPrDM&xars%nns#Pc?H2Kf<65|xVUgMCtot{+NR4TxMHr;g6s3$e#)P*bMc16}$< z*%58LJ2!s&DHh=4IJ zXr#wPJ<%JZzNw}AsW8^Qka+}RGmf^@JS2-40+Kd(c(L!E2v!XH)9h-jtahaApP~G% zG5VwP@59oD)AcWVclGsWZp-CwO;DgH&b519vQbQrL06TOj@3Z7T&A>N4 z?;p%_e=tu08>~ZivFXCkV}_u|^!@hwZw(A|4Mk9kECCD}L3}uV7q(Dr{O_hAkP^>I zt-##W0zj zr3&Fs{mL>6U2RQ+D>4r=C$N&Pdz(JN6gPsp4{9&d6*)zoxA7_(7I0BHatly?F1@F9 z=efWDn>Ay1@~}X@w!^4GrE|Oy?}2U#JEu5k{@R>se#ZNE?)fDL?(Rw?+E=S$Fj%N) zj?ESlx9B#4MJmd+`BwpH%ST!b1<|LauNWij>HhEU zt<`^1js5-Zf%w?K;6=swg@|eIC;)uz0K$4}FbnWUMh5cQObHyE|GVMAe>neG(i?E^ zo7Uz6s|sZDk)_v4`w2ZFg09|9hGav-JHFAR-(((DDmxWP_!7vOhlad6f+%z69$ zHa_${gS|waoI<`WX=EH@HreMUEa{-Ri-@>lji_oRfoGEpSM_aU-_H}$ZI=9kxYQ=idIw77Rz`4NQR1YxT) zt3i(2`-L5Jr+dX?_PEsiC9~W-#uA@?F9Q|5lz2#$J$3g z%wc_J-0-m9A6@lde=7@wQ2N16vKo-ux_vCBD-UJ=E@R!?5~N3~sMl>wm=B)~yRCh9Ut2fe`#$phaQZg3 z<_@(tf^L61iI#gkx@iD>aM0A8$|22Mx)Qp%6RIbq{hHA2G8izoa8}!H7WU}CApL5& zjC4GOpb)Glfo|C2KYMtM8Dw`KO zTwRX8@~0!stA%wCGxJfy`D0JouS^{!H;eDwq3bPNe9PFnJEwLa$~nF*>lq+j#*DKR zKbH~F8SxixHfO3pjddSBi#DzXvqvw#Oh6UgFthFFS*mHoiqk^2HW0f6dq9&iYi{en z0o%N`&|#*6p=y?EF$c;Te+^DEN9QnByhPR522Ebgb~~3xa{8KaO+Ny8gJ%My!xwrA zG1XY*(A7Liyp*B^i##$fP$XEN2Y}%PWQqa0u>iaJeK7$*8M0?iNJ~3Be_i2d`rUvN=uoVf zQgK4Y7GMN=MDFTWq!9$A_@PP0Uy3!e!sS2`5-1Nlf~_*B`RY#q7q=A-FbOP~?gdDM z+7Pnz#)BmuEAI+7JnD58bORm<)Ug{(bxN-Uk!|!dhzq_MLK$z)T!IzxVzoYl#^8pz z>7kq6AU$CB+>f>}LADfGZ|{IG2UN{bC6IY+zrqPuI$oHFn=nXbZt@c=YCTf`fgd&; zaTmY@@3VwO!K=!k&Kgaj5#h`vm6KYw?y$vYVZG;bt_3o8W-=zkm{mmmBa5uzz$&#t@CgGLxF4aqn(U)@v|I6bEuU7-;Y&GRcFh&ci^32Lw7H z+{A|F1At;sU9n4ZtP%*~)KHoG?1GN-jIF!Z?c%7kEZ%&vQ`|b9$o84jEyrWv5 zX>@ne4%SY^G0NY1!aX3w#ctg!d|tLWh|?YJ*FJj9d+NGr%1MFkYVXjguJ~BO-mFBr z8Rp&y9>;u&j=H=`sHgdX*=XH^+TmAqIXs#llO0B<+6(Hd^yEiE3#5&Gv>Z2MkRiLS&H0}!2IzVY0A&8p@KYdP>geduy37q2d34=|??yp6-=|X$h~g`zsnrHd z=GP62{%x6`uexYCfI%#C*q+i&PSuBaIDj-?x2l=J?XzX&B1uSj3F*w|(R!Q-!5dLG zKzo_Js=o@LUdg`YRMtKSu+*}2ZzS`~B}=KB1Z4Jclul|o{VAp4ZFg^?WMWa%oAk56 zxi}5)cQWhB7U0cejpIe~p`siXhHTEKGbS*(m7v_^;a_AJ1Ndx8%R?p>KE0XNn%1we z)+>nA4G*zQ4&nSHqpDd7fK8%DjlO0A%MC?&U0*OjeRdcKM)C^^+fvM9jEB-Vj&?to zJ9o!<`(=E)murmajh5ThHWTwW4i#eNOj{NY-i|-(`FERB<|LI06gcipmq&%gQaaLc zS%-|RPABG9Wkop{W?c{pNPd+wY`x30gg3d0E9gS)Wc$?wiAytE0=h<>5@W+>uA_wI zWHoBJHqJqaqc|Fj76^FERRjF?U9jWQ<29O*?0$BQ3&R#|7v{ZBJf!Nq?K^mEj7Bw3wY5WIBBENqettxKc()L0-4Gre|V8uVDimw zJ2X`?`0kAv_ma*Tt@@ zD8>Y|72!&EyK9!J2ckhZCvYGPU*iyC9HT0P`H03XPlNff9w4yl6;`R^xq^n8_mO1U z`lSao!^guDs>WYFBFOlbrCfWcXOw8xH~1}pJn}!(l>`uo15C#v@rC? z0*Dg|w4uaD)P+JCd59*=&Rx^#ZSPWMoHAs2q^QI!b~w~*C?CyJ*M6*ZT%b9!kem6a zOj|7cOCWl@=hpzki${vf`(HAuyR18p?OOGoR6$}#MdP32NB@CKou~Z@(BYVugA|oqmW1o`U)!zDNqm) zY6=PV#P`CL`0|UPcl*jZYdOdCUzsR*gkg;a%7J2SkSr$*23f1xaB!T zTq&M>XKUPmXUqOJjr1w>H6R4&E3P;_D*=AYCr@EXmN>0Y=MUwV0?I^ucOP1}CF5_) zkMs&UWU?Zzjnn-l6M z>@a76(V4LC?r*qkAYMBnzxQlBV}vvv@b51rOx^4UvwMFaSbhGl6 zrPJ{MIQClCAuU+MMd@Q++t+*~{Oj%ot_amiTFcE{P^pOrO3fvg&8HVmz3P4?Z_Zb` z5az*V-z(dbD`}$#S#~ zRnDW#ht2C=9n*ZphwZ=aO|&jMxoINsXSVhza`E*gjyUn#u=YMPAX>d1Whl?=*YtG$ zXeSwckgCttaKDj;ssyr_DBlcM^cY>GWo{0G+BWOvx&PrBsi~SBI3+!NU9oYIKuAmA zsk!}C;0ksA|DPVqm*FxBb=gFq(A^XJ-SioveNeu(mVg-weVNq5;{gN-R$8+g6Rp3r z8UNZy>^f%6zjKIg6!}VinE)ajFvON*q>ouGl)P~7K3fkJET))%$X>Y~J^GACS&uVH zUqBQrx?8`mJD5Pbl!wn?&Qzw#$^=WCTESQeZ+|;$5I*V2OuE12Fb$S z(Wudy0CfJiCaNahk7rml>TY9AXPY>!E7Osg%u+JgTa3@FcJ#<=u9*hoWMB`oLL3ID z15-_v0PV-C;T^ zzAAWr%+^{5etkO91Zci+FA<9uCWY=$`-f@~vt!c$2WApPIv!}v4}`T##t11xdur06 zJ?}@;cAxfaOZj~tqS|gd^!X0?ruf+Hs=pz_O@l`)Y}~vW>8GOCdpj3<6KKRECREp@ z3t;5C5162K4%#DAlEAQ6i$WYwK2nYsiE%+S1mxqE&Sh)Of$G%tSsoUDY~!ew zKuK(K;7$#v)ojMi;}daw$T|~+BUgGnPKR3|eb^1`9aMkT>9Y%dV45z7!c0h)8y6@% zPFfagFrcn9i282rSe)F?Psu?8Vecf%?$p7FcZn74K}R$0OT(K(i{Ib@-tJn+#dG2Ox6F{^DKK327hF)ZG{`Tk2Fil{r|0aOREy0Dx$|-H;9I+^N}SOtj2NX+ znd~8vpAvXU$K)Sh{I-T9_ELo8lIZ&7yMC6xp1$!2+xCFxEgeMd!8usF<%UgC{{98y z_^AzDp1xa`y=OO)nC^&S%T6QgP2C{}13wFhcl527S^oaIzP>(iF91$T8=Jd-iA(>V zB<%~NFluRO^~S()P=N6(1UfR6l@C#_41!sQKL%A~&WwsA!&4}D@XFo5t7m2Ro)VBte;5B5nC>=c3PhWqdKQQ}T6q7% z&XQ+`dd5cMYNSL86c@ztLi8Ki^MLLG3kC`1mjmw*|(d!OYW@{kJ7o-fZ zrD{%H_WoUWZFK{zcl#rRnC;6yEOc)yEu?#e)&_hzB2a!l@7?g(;d9Sbs#BcnJ!mFE zjv>*d2E{k279BwaXdOmi-}3mALrO(SxNu-YPe579eGH%4gpErPe^KDq-?K_LR)^_5 zp)qfdrjg3w`jm<=`yrSFMkSQhfZE!b!%~upKbzP2(aSm8;3P&NOzA?O2^r>c4DNLs zpB&q1ZR3E_rdgZ;$Z;o#sfH9^L5nHFsAXPv7DV;QpNf6thDG%$e~KdPc)~dQS~12q z#3lssJ(Sa#NH2B+8ydA0-#TaxJS6i~Ph!<;_WAC9wS5h|^LgGj6n`9#zr9@vi_3ru z$q}EVs{B65o%>8aJn1%pPv5;jV76t}#WOHNboCmRfrF0$qSQ08El9X<=2{tcP_x-u z&bFTO^bE7u?Shk=5|Au2+QQgu?S8^O%By5KqpK#I|;v?p{42pzA*|Jx?j^0!n4=rdqk1W{* z`#J?n+WfNN!hG2ca`{Edd&=E`zWFz*v_Sb?pmRI(jT`#izaihF^{@Ze{tcY%fLKMW z1@d&v`_G1e_YRSA{kFX*|GHi^Vf%$%G1;%X`Cv}V0BHiR(PaK}@*n>=WPM~MboTV`FbnI~c~kl8-!vplr#XZ2O?{F zi)}8dE~?S+e98h2iQ2$MPUg|k*Ovvv`9-v-G;ooH!qP(t$np}fi>Zq(3y?&B8^h-{ zea?f6>fSDdo-=U543O}OR$?}NJnd4plpQf`*52OUBft4F^IEMAtnHw187uuh_5H66 zfa!b(h-u8u%24YBzTH?rVuGwE-Eeh40Io5Y@yau|v5~Mw-SDoS9!EOr`P2NorkSwI5(LXtHyO2D&HkJcr1}fOTOH=s*CO(K5ie)T1m0&5u< z^0me=7fy8!b!wZd??_~dKX%W2sv+-c$F}qmJ>O6k$7_xq^{E`a5;I{RqZ~!6d-J2l zSz?~foynzXO!DAm_DNC~3kQlqTCWsI9}BfIDKo;hV$@I{dPO&leFYEO!SZC59=ILy zsgvXuDRUnSE5vtVK4!8?vxzVC?*$IaOnR+eV-$_0>Bn7WRn;|$RtvxICZyg{)QSKo zeP_cfjhsr@xEU7{ZZhx9jABbqvP4-HMWjpgvWH)Bx+9ZAl7lZIYWFK}wgAS;Fq07= z>ajr}VA;%f3$~)gb8Y8oyujQuko-x)Ym7g@6Ytp)SytaZz$>YKh%YmQCeZa3@1xtI zO&kn$RU3j?hdNE_yfw=ApPWcE>$e@@lXRdp5$vdS1H@AK3L!kOmk9tytpzKB6YJzD zq|1>F9w1`be_F!hZOc6ITHu$~AD$idM^W-|M+B2c&JlKFU~FnOPv&w!HueZh zFW4RtO*HCI z^v#&Rc+(|k2wZnAPo0mc6h<=tO1ZS$38LoIbCSe~7`C$Ey{k6{;BtVCCh(i(JI)0J zGJz9m_H=TK3o&Dd2JExwPXF zKd^QvZ;84?#bg1$>(^H^ys~(uV*jgr2nNA7hiC0BL;Q{6av9gS4&d>}j;WJK=jK0in^6A0>f(5uo z7eCioiqj_M2y}uMm5^JV>v$7n#Hn?-Za0p2Xb#A9=>Y4x@8l_fk8ng+Fr1Q7rHmW~ zj-@fuE{hE@l7uOSS4?Y%J!J6-tmGkGQ9|@Q^)t|-0B+L>pG~NPLo^biY^iLBt=$9? zFh&;7_N=LBiPH9L*$d>RS2$lY>5N8THpq>bQU^L&&O2kyqN%ca1vC5ulZ7}Z2Z9`~ z(*MAc^qv>(YX@KRB+uJZ)7Hm&Ii`i}8#mqhbL|iRZas#7=M)v{P9&(M0rmK&XI*jS zZ@-`5Za`Qmv(Ob1|HevQB4b~aekX{c?YSP;>6&9>n%)pXQk!@*z^SCD3M%=REj=es z`dH^1eeo9!wQKmU{=Ww6=Fovo6dB;a{3yJZ_ohqc1T85>rMkVK%-G$~0`N`;gsTJ3 z^vw(k(Q)15RpmP|24jPS>JT@-1`={a9W~9_-!l9*^63M**`Rtp&(WuXlL>ywO5!+L_olX*S5=z>r(jJGR z1uud=!F@yZw;~zQ$bGhqL!uX1B;`EwTF3dhBuO(`k(Z{4Oiel2u%u?Ha&sY{2#$}^ zr@=xt=fd=FjL92>Sp@~E6JZ&Mx#nI$)${q++zWb)5L(h@p`~=a>;f|P0U~Yw`Ei7l z7s#lG)Ib$bRdqaSDL!i_&huk5d<+xeS0wCtL|BgeZhMx;Wm8u3x#-fv`BS^bv=V5Y zl7^G%iLxtCYCYtdfQ#w%qa+?$m z;D_tiqk_Zyi%%}{sHv}o~2bDu=?l&W5bCgBCu%{{Op7VafX zp|8Fd;ekz+p=61+GF|pIgRCB*H^zn98edL!D=z-lUGvaL!?l^S)I48l+6X&kZ1v8G z=JcmkN@0MDXj61?e$w{$uh{DcPF{n13VYIj^3U_HiFXw|8YGWz+zY!Z1;7k{>3)Gz zSQ)#-uk?R3#~iAYp>bAooTUHDh}UhYNV@<0;oihN;B)XDzs#OJ=?F~4)`?>LfM(x6 zPTK#uIH2WJoTx`%oZ{RC4L!k}j@fPLi)JI=)HoPV-nafO_dakHsn!2N%#p#tBdDpW7qDgET!P|4~U*+mt08i3nY^vA*^!;3^wifFf<2u@loMp<|WXM zBwc9HBU_}8vj;2gl_nc@1aTU^3A1mwvn`EeUsV%B5-I%(9RVo=5FM9AOv^1H1wV*w ziB-@qnr}$&b)cPc&TNC7Qe1qO*=PiQLVnSQ#4m|>A51Ee*dibUL%p-sczz-6ReTlk zXClp??SfK}R_GO0>)gED1lXhH>d|{mb0D8#hOo;U#95rYkw{V;1M>U<% z<2xur#O>9=gW>Ii=k+~4J7Oao2m$3fZ0Sba0K4?9nHQ?d&$z}95Ll;ahnokv zYE**EN?e3G8o{`<7FSKEqgm3prz7E^sfHbaGXX_C2R|QTiwBBpKsRFrWojG_3&+ZL zvT~d@kM~gI{nFL|yVtMTokZ9huJ&a@Ns3=d0=K$jgZo8v(si7#9(e(k1CJ!({G zqcszA%>L1*7)62wAh)f%C#LMv?=6wGNVrh`AEVN?saDqM9{l+k$kuGe=?bHlJNvIa z)ir%-Npe5p-hw&bopu~s*cp;_>Q~j{eWc-%o|41pds*Nc%>hl>O{gNCQ)bXp#|jbM zBzd7GO(3uCajRJT2eQJ^&KMwfK$OHTQ*=M>_WL5qZ4H!>Y&~=S(53=MAN*8f7)?hc z%;-QO9PL@3<~-EUUcYSWb2%_GF)MH~O2eC1?{R6Jj7T)*f|oo-$vM1+#lYZ>vEm+S zUq=jiY(ax0clbscUa&9bsm}S@c-Jy7s|ux$i`Bb6V=B=%3Qy#WpV3w4XW~P;q4!~* zaV!))Bj`#Ru3v=@^}QElCD3 zZ=*B+o3;&Afa0+rIjlzD^u42XrJuXVUhDL!vAH8-qM^2(%IZ^T9r)Y9e@r?Ty0HXe z%sNo7?ikni@CRCTAWB5!BnN$kB1ZenxypL6T-~eql;S~{jCy+Pa3|jAy%P?FMECO`}jn; zAcHu`y8gQ&WkyQu2~rcS<+gqiBa%k7GG}(u4zvxVFq47PmyBVS7u$8onACYbSNPwm z2sKs(16t3$ektTNJ)dpg{P1)^un#+M?~^=F8?`Cbm1L5a09~1bUR9`N(Wm)fr0%In z=G|y~!t=R7(~GG@`sF|=N!L?;)K%%@L((0B@lvaRtJ15AJ%CV4}@XmQ@jLMRjU~oB0=*o2lpaBJNnxSe{ZZT%}4V>(@{Y>Rx5SAVz$< zrql4;)5LjsL)yG(&tckamzJTh@Q{IIXCb0N5j=OCnbdFOwoRpqOGx(&IhOrxk7sO2 znXqZgq#hN88HcWQE@aH7df?}XJ?sbomww-o;!eYma66y7EF0ELY=RpzO83Bm`R4S86T9t-k;X< z>0)*A-MQN?yo0KIk;YoiAIufg_7wX_2lA>N*-sXBLh}uje$W+iL7Gj1l`tb2Ok{=~ zaBI*z&n~KD8qx<}Rj?ra{0l`X!68^pxv?lTxG9H9qrEfMBxa5Et&oy!8{U$6BHK zZzJ^dbs+(Odgt-dM8adq=+y8Ld$MSkXOV3ZiM8TD5_c2Y#mM=W_z%2l31L~x4pASg zR9yB-s|2um3Xh^}w0hHYcW&4zSI^x7H|Ve#=8$g_rSJf6!VTPg3eKX3`<2Z!7Ey$f zjmq9K0oUrcs&Ev)q$Ae+Saxbi2@AvQk!n}a zxpelrb-1ABQ?grUJq0>X>zWNolGWq7NCWNwrV*@#9iLM_U^Sh$j z(H~_EBz-1}N<2``T)uaJ?~mM4fD5GI^yh#!z(b*p;)PmcCssn0h==)cOxAChk3QFXD5vlF&k@2&BTxR8>}XM(XD&FI`@F-@P`0^}7;Iix z*19Akg(d7E4r><0NCXYV+{knHQh)?LR?oTkUj^hI?(5&NbY(#2j673`35?l<*h)An z^r_G)acOMS0e%tczJnqs}kxA;X~;0=MQS2T9aw)}+VEFbS0Fk?Ud{(nZh7Y9d$ro0}LO zm>nPWW0D?}kDPcNe@6o@_(aT>mn?>PCu8@F?XvgO=Xf)sYQ^@hi>7v(5A6r;t?D;z zW_b9Upm@Y3bt#knj-qa1teAREQ2xWCCklN#EtLuAzvZ!u8cR;t9W8W!Z};;mhKiBl z-K$mU`^^kuZ&uqEz;0Y{wJ8D|Kzvt5U4Qwd6)W~8TPgX#{HSz*;qK4NR|t9~K&BgV zH-Jw&Omsy!qdfB{BuILv_e85jSMSxcl13|@Quk3@40rjKvw9%+siUVC8zD`G8tg!a z781~gDB}+}rlrMu-KHtFWe)9*aVSBCyDO9Z=47ZNK0li{4SA#hsZaZe@*Q5W682@I z<)AxsCwn);{$*OFJg~E|wzdY&B4y+u z@=M_Wwm3jKYksL>mkV&J0wQMs&jMbel~yuGd0kfH!+0fz-c|=dPl4afm5EWE`(oD) zIQZ9v*l%#<0sa(78Pc6J*|D=g*B|sdn(Lg3^irp#B;6pBs&zg;>kO!FORkbfB*;<>4FS*<95v~qHmIcqWl}ks} z192=Ou3=OL9`j-MFv`}0vZ%nl&bbQE#uAXlw((+jyxg3JA>SA+t_Lv^g*x}TqTGOc zRLhVewrl9dAG6(qu|Q-~$F|z6%4SfyTn`?=d;%Fe8VP_;UH2Xy`v(qF^Tni;)(=!O zMr$V%#P*MTx}S|lw}=CSsWx}3prnoGGl!nQ%YcK%GcC3h)pVnA)M#weo|$@8@RNCM*{;JYH;i(DM8LV65t z@N}}p7B7JH3>=~|T7@R9kWY}LTCa!cuFPbE%ul69hX;pCNIloQo9|_L?t-uO-GKqe zH$O0ce}7F}-JwU5^%YeN3Wa^_iP}>A>5el!ABSVm7qDn0S(=lZRsoK{bCOx!peU=L zP@>6grcJcov0)1BzvBhQ@yaY*USxS0nY0F|r5q3&@!PgdFVvS8CDhgRIe-Li zR@5qS>hUnXx<9LQe6q8X5&26IsM8F0O_xjf<}#j>?HwJxv_CJQPC%nLPsCUh*r)~0 z)3b+Y(`x#QUHTUMD+h<^;rb}h{cT>h znVR!*d+&j$qty$iSAU*rb?`5qGwueaUIi^Wy{KC6=2;mKOi7 z**A+-7k|e--Ldd$@!5yDSVD0wq=m=K@R@rB4R=|~9fmD(vYf&T6|!}We-sW;)iBDN z7*u&*FzqY*&cFY)iNj^=m{9lm4keNWhqFCSk#o2~?97Emio!U5)t)C^v&_NGMu@mM z3F#Ei25~*ammZY0%WH-g)YVj^$R1io4yGilcY#brKW;cBnbff`m$K>Uj+MM7E)7V* z+ZoyQ56;>D@`G+uY8-`Sl!hCv1aLJ zQqS;J%Df01{!UJ_j<^dVGNcp#YvU>4<(cOBNmh;V7Ry?E0GUF0xh=xIe?iCNvx9x6 z1il(`dI~-0d)f0_ZvC|Glff1zQ)8T1!`FFF zeec=?eRgN8wGRz-qVCr4mr?exFr|VK1~Hx0c`(M$EUa!0_vgoL!`dvz)ws#8+H8ih z9=ygc4W{A%$fFPY(^m&5IgD)d^{2hEeE_7o?3VzcI6^~1zgbQNu2@cqc-U8Ygq7p0 za8~y?3>oy;V2ekwo7O%|`SoS*2Xvz$p4zu5kC>TDkDjDCo1x~TXyxxWi zg|+flrSX>7Iqu}Y9J#+t?dj@i*EUb+=2iw#~h@z z4zli>++qkn(b%p{>bQgtdfQjbE%J0sY~kGbXP#cLnxCGhTr*o6POpmz4_rV}vE5cC z*z%d6@;@?>0(cl%IN|eI+Q^Q(uvME24qxCQ3wNGMDdgEla_p_NR7o7_2ys`GJL_$H3=FRIl`l zU#skK^`Kf7Q!xmj1Y8H}^+kUETE3m18%_2*k!^+mmS3_UrLr$6pRtAR;~QxTz(1Wu zg#7ewWVPzkd_O!qTvbMSB`pbAy#bSiO5qRG`qnBg$SSnaQB}9t<)l{(`y`!>e@~T>r@U=|_i1f5l;HuLsP= z#s&ahj$TO9DS<33e~AV;zHMm)fRl;!UY`TmjNt08Vmy|?bMjz8aj^$5KaNnf1XdKl z7a`mYAmJgQ5^&{%=mgstUgWKPF{r75P<5IjbL)MOi-~rKe29U> z1^^31xAxI-YV~s`LvTtV!10U|afAS76%3cpuc2#3ESHJg!4pS<`3kT9!hu#sqpOc9 ztKhUc>sLeyhJeM>)Q)_Yqf#{E8tKgB0I!8QyrNg>?ln);gK_{fk*%x`T@V~*Ant$ zs(q$vH3S%Hg#1CVVaR=3oA}or1Hkz~TN*$3UdQjbgk1`qXD4#na=mHiHsq>lC(}Vh zK@;JGj2mKs3&CL5xX!K9X-(+*F`!fdpbW530?vOuM{M{G-08ADgEl6{G?xVD@c+ZQOdwE}QBQQQV6&D$2aZ9_h(B&|wj5|!@+IjiV*UQak1m-JLkZ%tQ zzWhAetlS?Ot6Oy{;(BZVO4h7Z#Tb}kO^Lc`vrZOkwI#Z+O}IX4uwkpIqC^5vrCzbe zd*DnMvgT6)oSeiKe<^1!qzb^@PX_y+=+Hi$*TUo$tY(iHkeJFMJ2>0g)a$_o+^Z|% zF@Y|VO)7yWW;6+f!Tp?}Qr|4LH<&pArL$^VSt>EA+A~+i|3`hNmTf1C@pPZ;x|#)4 zRDDtrVY585+?iN7vjJ-brotfScQ)hG;z~FMDxNjtDG<(c%^*4X4S+FAOG~q}$@W9X z1cN0S8bUY_YLpZpQ8R1N?6gmWb?-9WEiKiN!6ev?dP4Bw=X}JI_^p!(LGTs z+E4}Qii_(l%$7yZTZl-8*E9gvnx%`95J>(Y^-$HyIPf0AtG5_Il~s^AZX5T<0^xvG zV5z4B^szWc+(&?p-QZL8eAZ#PifW5(fUK+_V^RKJ?%iCQo?rOto&~<|b_3{2Si6`4 zguptpC}Qs+tH$N>-k$jWDsT*4e1O9aP43?^`*o=TP!i~^fELS9cJ6CY^Z8GW%i0HGhq6D@4t~%- zxy~OAq_*IYQ%;@*7Dx^h^~6kCyCb24EwD2EU>8NoZjeek<7M#6cc6hp^((NZyucA zRywF-JUuCR{OA~!vgfbnP^_}4*Znia8GFy5fG@bn-gWM3z(ua7AXCC_3SPMT^(R;E z-RLN{JZx5(reT=zP8{Wq!PQ6AO#6ND(|(uvUg)HrT{Ci3+WKPGy5P2dQcr3QG6@vc z@HsM{At5YFe(~kec9Su;L;<}^1kR)@?>T^8fxd1bDHioNhTC5m5+L}3YzW|%A!kIL zXFK3Uwgb6IEmPx{N?vjX12sCOJeJnLCzP;{!`GrAGbgIyqej1b-CyIrtZx%=`j!Nx zIVk(YI(W}>GT-Ua{XNWcl)nNiEe9uy>2moPMY<0s>Rc%b!y6%RZTo{COt>^oS&rWY zJl$1N1=6=kOuf@Be|E0yZC%+7%s+JI1PPUoIP#3FxYDl8r&i5wFFXc*kp(J6L?W{9f&qc67GBXOsv>XSnSw@X~X_Ml3*< zP$mqQ)z%gfXc6rPtz&K)DS>1)4t#bYZ*IV9!TtL17bJj5Tb5=*4(nIp-5x0mX0Prw zf87c1Sq#QN)Lv~wIS(r1J_94FG1c*r@nk(o_r=_$Dc^eF0Zu}7MI7txRP!PeA+M$l zR+jJN!?Qv1rD1?PNUu1GGMOuW)86sOVS(YBec3~8Z&tHX;o&HwQhDH&zJuc% z$?f0jOz}S`vjE@Ff97npUb6}$W1yG1!E1__E$+xuL?kr|tg|DR=U^mf0lAN>o>z?A5c32NqyQeTF$H9x zTB#Eq#|T@)xOyxL4CbGQ@o=p!vUz}8EfFj)^lxr3&na~N+tIGQENXB-AnRW(H@v}n zn?LaM>=Ujp1eRAX*6jP1-zZe>zu+@5b^M?_iBg=G3!t(vwFIMcPDG^S2xNW101exG{Z&M{j<v(zD#_@#d-slYhg>RRFby_l67XpBI1 zL-+^iXYSMkdMo8awo-Ew(AB6mb}0b^Eaf)Vd{4h|1Q3WdLp%DW_5;~H;_87`zD@qs zC*KTxAg>~=BFb#TmhayBQfPkzdB4FnfGm_+jhy{+|EVr+Q&6V$GxVf72{iol&ldTV3=2=Uv z)Ny>D!rs{R-S2Q6>P|eA%yrfSFO$R^d?C&gcQc@7k?>>>`y-HfT<;w-5Hr|bBay0TDwsmra5^|%P+e}?YT?Jk>$XcRi-upL9amE^BruRn)GVwJXK!i zMa{hAoFh{)TXuM$CgX&BIHpmUe`f(uwcXz86m99na5l+|16VLcY7r*;Wrcu!1Y_>;}#QuBds%_x1+FLw6g1y_L&L;c|Sp zK`C=~h7X@t{tI`e$}4@e7!qj{}mhfpNEd-Td*m( zKgy@q^6B~j2d-Z$P4}$*Slovyg3;MyiY#;i>@OXrf8}}1pct8itpYV4h4`2bpS~!0 z;6Y7!QAEL`dHN0bno*_F-}i?8^|xtar{PEBvKt1^f;I8;y0Bb#6E-}0`nq=Sc@_=t z-$8qHSsw#BSxj>onYa(U4RE&3En$h10jqkArUI>MkN`Z*>uYH+w`fQUE-`L@+hgwR za!uwmde|i~AGd9cD=Tbj*6$FXWt!*?oOp^*K2VO_upd2cQZY;-y|ON|oj$^i3*dlU z*;vXBZ}yoI<1zXW5mzRj--B(ZO=yL-m+5`MA@ z*Xv^a#Oe$1quxAqRrtexa*2!>OK+ga@%zqoae#}ZZ(bhQR>6U76-x1}$rqKHddJ37 zkZl!UaDTn+i>zCtSIdA{Uru|E+cICtqda}c@;_n`K|D^{v2uQAgW_n;G0G)4({_dEbuhi~P z6BQK^;Wj&a?1O_4DP~Lex&siz0lh-!(NC`*?czoSj(&Xm7NkyVItYI?dHzfL9Y}$! z?ssXr9BRZEwkyo}VnU4nIj04}iPwzvQ(Go7KF|eu-J{T{KX!4CkCKCt=mbQ2G^TA! zJCC$ZmfE;2n@f0fqI*vYyJnEf;N8AFKP9ayBP{3T4)PM$wHt#{T>oge<&;w@rfg`J z6D)PTjx9-xS{D@GlEtH}*$~QZ$;OMb;>oXJFJk8tB6IhimeeUNE$oW1E=6~74Nl=8 zA>#GPViwO*53^-8QnYblOidIqP-v@_l`v|zzgFkyQF}qZ;!K@vMYH>&7{L?~RLJXh z6AR}`@1yLA1zFs|an8ZrlnyJ&IL6#;r+__oHYO1LC4tm%%24Yk4+BEQCFhe;q)s0wR zWO3xuk?H6wI1y>mbUL`wu4C+tc+WNu{QqO`z2l<1y0u{}5fTfIG?f-nK#Cx}gHZ|6 z6_8$}gY-6lG>s@qRff(0q5?|qZD5EfATWS}^cKp{>kMsZ^X(amK%Vn{IXOA!Jn!%K z{z)P?ciDUGYpr#y>nh04sdl{I6#bYgQQQdnYIS3c(y;fAKh%kPAR~N+B{Gm>6_+)Eg1}ysJf;F^(~aP(4et|Xuu5NG7Q!@Z zEbIEBL*}1v2&*FSb%isw4d;|NE1%2!2;^D!#@MfkOwMmIq820_L$!v2!WF0u$2(3g ztND&oAtuzJQfB__^!@mi!YWaDr;#LC=_u6OH@;vXXy0FN7Py}Lb$^xx1gH+CfPZBb z|CNCB)f%#CKd%!K@Ah!~)7I-JIz(*2|CK%uS{n5x9=+(de@u&!=5L$g5|`!&AU6Ma zyRt*TIv}CX-){G9rM5@E?08WVv)I$uCietgz--CbCNcigzx?_G(aH0qa}DU7O#SJu z%Qi<^Tj~P>>T9BvP<8fINT+Mvdv5GJ@VRd1q8C~GGGM&S6BiXu<$pS7PnP)S9P01I zbpJl;fu3p$bK^fG$GQ)^_4>$GfKq4pw{58@6`9VXgWGO6_F)q)$kOEP*`Nq~_|3(LyLX$*J#5xWG&l2~- zN#Per!>5Gj0tH}-OnKq~g;ltQQYFXZ+_R}Mk^VI^m8DDyAv3n7h>TKk3Av4do*SPd zS*FFK7n0^fN=x>yc2HA@jUn}RE)At8Wk`8_(=4g|hdgWE_9nshQ=MpB;HUhW5Rj?BLeDb3ls=I2ex0s@hm0IzbHJm+fDY7=;y zL|kT?`{UQ;n8i+sD@n82s5z+?#2B#j=DIXnrjoHTYxfSMrl@fO;S)*%`1c=<1xNi6 zAY-oufewt4VI%K%f97-b9PuD88mWw!0X3AbE80BMoGeXrNc{s)y(t>(@oAjf#&ZOZ2ncS z3A8@74OV_RP^%JE^L3&nKowI%o{`p(`JU2NDNq?|aC`wE$Ll8KCqhMX zD}wwA{9jkM-LHt@K22I!m)-8PT@yJAH3%XAivZLDat%%vc?CywH&;V=8Z*7wrX8|O z^GbJW)WirV6-*uV->}Z4&*g}Pah~ECFBV8K53v8r$-UgRa3JDo`)cG?_=t~6t$##U ztk!-7&_UP~8?Bb=3+%6KABh0_D+i4{y{HVcHnzvy8Kvu&3xDW^o#V2xy=1Imzr-!b zUtg8u-;!q)bAz<;gUQyi&#h3|Eha2Wt{N{zDqqB!D{q#C(w|gf{)4?B%uHRxeJNTX z;AncFle=>I2;D9H(X{JK!y+EXpZgF080y!->6bUy8rA4-X|EiiMmZ?+WL zF1U8~rz{cN@(9PJ#_ai&E8*1%iu}0yJjS)*`W_tJ4*k+&*0D;t;cW7G-e;W58cdw> zIPx5k1Cjw(dz}`UEQSsM$G9t%o(k5{Ze6OtAW%bm5&3IWNKnOx`-Md&u%KV!pO62v z##w3dyi?pBWRH8xhSH+}SF`drXcFBmeWauGeoqsTi*cZ3Ioi-Ne7Rdbt?G&~-*^t@ zWW(lUaBT3E>xh`K&rc7aLQyT>dt>g)R(jQUU*%6uB zJL2)V?foa+^G`ZE9(O&N83#S7W!21{xdR{6&;NzxKU3`fi_xb>iP6h*AXb6(z!m`K zIjxXw`WrDoqxruI!nk9TH#RKBej}G!|MIUfikR2J{1ZD~fKkG!)*27l?7>qOg=8V{ z2V-+NYf(xEfWTith5stb{EJS-@ClF!$vce?5xNo8*UHWVti5+lRw+;?>KlVV5cl;R z{1^hH@~5_SI*B1AMY>o*DqEQ}?akMbt_!YD9+OLx(UEJ*i#%;=h!SxY~d{LC3cz(8?I26mJW1Gp6yaviIsCHSF-p6`KL6Dy@U|O;{ z@}ew(9`>1abEn#CPwS}UyYJ0sf45q4#( zw0?bQ`MnnyHzkBf0Gt`TC(OgAEKK3&({MZ=Vi47X+OPB^p+WYZI86spZpF;z;jq+~ zUBDcR@KW|>HCm8HjGnQ_cxKsWjdD4SKH)weNGZ`2tMkV&)tQX)1Bi%$(omA6U4c?i z%a^p|*R%EeU$bi*2?Pz5#(=vo_91;n>mR^@!iAHhbTu)gnN0fq53L*UDh) zSztY|aNwonGFjh0CAF9*2lb5yMZ^mh5#}`0H`Br|rZrk4MAO~hyXhjnoKt;0&M@IB zP$>JL5EuHPtJM2B&vyR1ccV5?4@4$x)__Yfq~zc9CuAbW?UGx!GLdh0y>H9h&a7RiB)WFxdePhjw4i>V z`5bxOs{^lWB-ErR`#2G)ni{8Q6;RilhC--&itC>dY7+W*L(vp%W^L7w2b-K#Qrt8L^ zeT&WJa4&XlzMOBx!q=Ad=s*-G1-@1X|Jy&e3=bYM(s|NuQwv{fXppte2YOY6G#?BW zik1$2B$vwn6Zk$&a_Z^!5F@eC{=Zd?05pibbr3>Y@YrV~^8b(xl{ro~lhafzjy)%h z`d^C&fBF!v#Bv1Rd8)h;=)2tOzI;VIU7cscLgKLffN4-0egkNf@2yTaBgjBkqO%3; zRj!+c1!UNorLFJ~2h`Q~frLQH0nK|=z|pFUxlxAlK*|d03_JC|D(pPvK;o0>Qbf+j zBn($ZZy{7M&)#Ls_HG%!CVd9?i3aA{_0ae{zh0$l+?5M*qYGRVI~e(U3P0<$P&37y z@asrZ{JJ}{SY^YC-cZ><^Z9z?G~JBkqE9g_U#-i>rN@5NcOf5Fr%<}r&ZOX~&mgo7 zaQ6lWP@CLa1IhAs%nzj>s1A!LCu7b07!+>s;BJ$+KsmE_+wHgUdWpA0lgR2L?`KUY ziXQ@+rF&ZA0F2c51Ya#@Va=iu&9Pu<;)Lmrhw^`256CX{b7o2Sol9D?JMzPUIA`{n z%*MC#cDKAnbf}JjCYGzR%UDtJP&rvc=-|blfWPQoyu))*`to7<^|J;W9TxK3=SrVP z%zo+ADQ$eq6jmcw$o^aI(ouM?KlnzO7rMs|d>|BMV)>ML0J}{tCfTOT$?S=vp}vdO zT++qNCaU_#5d}#l_UnjGGl`sKr4(nmD;=M_*QZAvxY<%2-@wuR*ZoUiA zCZ*jh3_bEi(>YBJ!UmMIFo+Q6s6eSvQ_ql`BA1M2R0!KLY2>`KCxMz0A#I+LF6Q~n zK;G6yPWfcO-#%OPyiF#(93!iYR*ZZkVl*AapmF>FP3UVl6Y3{xybTSI3;m%o26X=( z9obW&9W#T(G}h0ubO$)KqM0dj1vPb&%$?|I?TKWMZO=5L zjzEj*vXh%IjB>P7^&z6%x2`Ip|8Dj_*iL&?Sg+qo}2& z$YjdoFh>abUM~Zj_5+&vT8@qrw)AsuSu3VD#-T|hZq;}^EnHf7K+fdi?jav)2TClb z0=HVA;&X3W!l&lW!4#{|Iha9s6z|uGA+{?S0aL1@mrM%%IpN!g^X5!i$ z6)cm|YBke)Z%hkR*2Rpg4e{!+c4v>kCxZ({fqO%_gw3zsWPQ6gyTz;8E`Q1%Nqd$e zp?8taOap__V4Y61=H`PwS?yJ?rb|MSvC>&dNsn<^^8$VSy=lkmA?YYV_;ksF<2|Hz zu1%?umbRIlmYHJLjZj^v#>}%`YU8d<&9VF#5q|{i$C}hk7Re4yg&Kc*WgCJ9^5T4k2ih{P$O3qz$9ifrjt!#z z)c0-t)=wV~Y^(O(<3HB3A;hu@_r;w`BcHeogo%1jkr^ZqfC_5&O3bz&Y11#VkMDPq z`T_~viSHRTAb9@!Ft$8qZFDsyYMf0obrB|ix^Y95v)>EK92|dY1%vc^r$+-UT;}&| z|G(X#>5c9_J8gZUhji`0$G0daBej|odvk{;*2<5a!>tLRkjF<`R;I9Ov|=;BYLnU2=Bt&cj`{&L>-TNF|k;VK^Sb^a-`+HlL-Dk)Ic8iGCl)F8vI-r^4|J zLDo`ly~H)$tcz5FdNp$KhvY?~>e4=X#to?CJkM+TFah$cC>tbb;$(;qTs9-eVHQrX zCfwg(VCP6b1$$#YN$JNR<&Q`!2gX&+O9z4{hz=W08XSKYle^98+avwJY>o8Ck%N!(@V6HmYJkb1B8 zZotfHa{sYj<-xeYvsRz-5?9$15I)u6qHw)4%^mLG@v)sCy)lU7HCN-Humy{k{ zP}KKz`Uw^IoSk(M#edt^MW$9mDYBz7O{%rlqvHmIMO8wMx3w~j?l_q^WE{#PRs zE-JLtM8Mpq^gZfRa?2hurHlECnQ55Ct*XYA`IS>8BEHN3_bP{13vBIVJg_|r5ghX9~1@v|>(LafqxHU%rmoOH1qU|5C1I zX3T-OJ3*<>@Y^`BtBl2sVQ1aG?aFJyRD)OFSTL^i>M;hmvDshq_$a zXxbvcwHWqLTiOD?xZZ^DuKkUr{~9a(na+8C{`fa}$RPCS*i}T|JXSi`gZsakU54D~ zE}F7KNz;@)n1>%MzxImH#|$BjHi1yVW2>Q(2T;jv-vas70~9Y{F2XhbasPJw zL0VIfSGVh2(3Eu(IjRygl5wG5o8i6pvqiPH$f1+R17L+gz*1!IX${b_JT0WklNE_ z3(c?G@3-mFQ`b+Q$+77-_Xc+pQAHI=4w zCHOYsXzPs}ru2TngM|2a>I>lcSoR#ye=mjkd#Bj{BYYkxBmZp}Hs45~WAkfhb@c4t zP|~da_QYE0J5J8(GEsIjFTQVG(r;GLm(wtt~bHEUKt8 zdt&%Gj>?ZU$3XLABHOb75XfE&?Kx*kHGGp{7>`e&SeiiwtC>9h5!5_w9UmAr+1eV{ zTgT7T%zPNnc5E^Rc2jNBg_=lF{**A}uzndlyVeL=I9_K3`nP*hUM5`rI)YIbxo4+t z?HUV{x+UHZYUONGpv0@It`=cbrRtDSq}%dMKSw#Qk-#>OGubG89Fe8el@ZOkHdQ#n ztOGNma7sa#xub_;8TW6MVq6WP(?Bu^MKhwGZX$CLR-}RHa8|ivjZRxC)n-ma)uHK! zClosd@1`6!T}Rhsh*;nzKJ~H~FX=iRZvCVnD4U=jp|QNvPu#QJT~hS%e>~UdOVgbb z``y!L0Q1MnMbLdQfio#oUy3Zx($@9hFmR~};saHdH0MUNC|_fI8tD}SiF*(;50092 z^-e13XMNuRm@s|IW+XF9ltKcI#?adVcuq|_V8LSog)O3&h7pCP|9xxqi?sw_)b z()Jy1F;dJ6FQY3i$;oFso^IBpl#d3#6L;Hp98>Bfh;W=S2mvkjqr0HHay;r+NX)xX zS8XdqgHjUN^ch46@V3g8sNd+2Xs6HjY!#2s@0OLeFkoNO;wrij#l;iCc75USo(qs^ z_$oZxpI)^50)YY}sXZZk!1=as?|$GaOiyW8w7(FeL@M2p@wYBzhhNIL#QTLROJCf4 zKUzQZv)T7>_y2wXM7ZxS#3Gf<4$N%+cIsSaPpL~i(w&59htL|5>~C*nH5tt(Lr!F~ za&j>$GxhEL7v%og34pAu_kFVKKl}65m8}+S_!Aq@Ty@^%$}({ir&2!0NhIAZYz5ud z924W);=MzGb}lbAfW^A_P6T^%M0$);Gv)yR3Fw~+V3{l!hY)5Br{edN1HV8gg#bsL zYUkUJse=kGp}AAL@>ZvT+d4Ax$K@#9@YabCWIyQQ9&+2+dorW`b6|qY%sqPUcBt2o zP}sD(l7G;&x#tbn=X&nzV~(=9vW_f|?;^sT=9}RrNc#rh{!3qETL1_PM@x5uS}#YX zaq{o#ezlMJV=)>HF|C^%8fQ5~ygphNOtj=MYZY~#rc2KV_?(w!TCT~Z+|(0@NQ>zm zQEsqxMX)>o_DPR2ckZah=Kl$;z?Y2AIlO&DH+F_YeIx8tR)(B&_u_DWh~9W%pM0A++OoG zCX(cbntVL3;8wLBV0~B(Zb{}jn+`Gh;D$g&N7)NzdZC~un=dWHPITFDS;KcQI79Z@ zsMP(70ok`&>!gu`_LdV=le4(_oXLaGMU3Yz0Itqs89}lmq|t2aD5i%wjR?P zLWf$Oa-6xkA^S^FYpz5$b7K=EW}`c!S>hX&;e%6)Ku>kj^V@}ePe_0Hx~dwkxWtTQ zIyEQK1Tvz#3*4LdA-g8S9a!rxC%2Cy&4zSB(&rS>fi%Kzlg zid2T7G#q2W10~@EUb+zZwNE>L`l}k`Fv<0ug+dA@;&{IEEdCdMsQKnU2P}exu1YUq zPrVx2xlKqZnbi8+M^F~dfa~a={uxd4h9Dr~gA$!isn!k{!UH#kWHG+#{n&yvJ#>*)A~T$5fw1i9+#N-ln$ zZ_+sb#L{$g%^wRX9FFV%1D`a+SZ z7LMaU0wCY+?8C90@x3>o4+!Lj=Gx`)X!C?LHL|?OtvU|-@f#>(R`Loc?zLAF$<2_R zZXn27*Jdm53-Ue&<00h)nD_1GnJbNUENimnF2YL_nq5Q0Qgd7+McYDLybk z3tGiVA+XFYQ@f!^^zfNkCR7o9ddBSeCoP6SxX! zjwXdy$+=HCpqTUdpZb%IUwRZZ9B27Hhc*kQFBkdE`R;?(hD^AguydqIY#{f0{UROu zwzxp2gf1^jM@Vo&;5pZgI)~}HDmI%Ya!dxw9OYiRti`~^46*AMCxPtjf*P95`Mt4o zvZ)-mn1EEN4K7!t))_Z;c*z}bVU53hUVEWsI5IauhI5vFlw&jp%@P(^7{hFAI`S>P z_qnWu2dDd!=H77ksR)Y(OwMA%&_vxxo{8kOc{WGMW-o=%+4TV9R}?$%X&(2+sxyHb zk6Wim+ls8l%Q;1Xc`3GoQ8kTmZ4;)2KXOOQ((;64Ok@n3n6ge``s$K%Ke@AqSmauJ zjvCSD*+6ZwgehEah@qnqeuW`v=J7#Twp0T{W$Ym4eTdX%hc|@e8Bi%V>9?CA&Lo<+ z21WL*_t(;dHkGZ8v^6ymn1mkDWqt6R$o^CMzGeznlF(t2@92!gD|6p-I>akou3Y$n z(7(uOZUD0IP9=xvmh!%mes|NA=IQRDX_`Y1pAlE_E#x^>U*YUz?_h#-i@AnAsBtlv zagNkwhC)~#$h*Hkn+Jw17ipTS-(-MCNTo7l=FdCVUlM&R6T$+sVOF-3!d96}mhkEp z&eA1|(MKuMJ?_dWIcxF zbEDabnCQA6Di>ZYF$&K*Z7wBjVuT{OI$V!mquIqvolFWnNUybUY)ZxIx;e*{%6v)L z_gU+!oE51@$EbI2N#FN55O%s^;D*L;rueZ-SLO>Vmt7V1afqfnD!L=o%y_~7>dUYi zt4MBSvFC)HlDMWUg;^bT8s_6*wlWxt_l)yVJnX#7<~>YhI5HF>gW+b_Azqt?RmY~P5z-Rx65t;}=(T;`l-r%|u-%;ROIUwQCYFH9WAyJyjA%qZuG9EN5|mg<;VS`@LL z(r}-exj$HQW|u?0JCNSOljLIsH&gXq(=>zWs3i};bx`3cjo~Hv-TsmOO#I~VpVN++ zYCSS*s*-o)7=2|cP#O|>kM`VVlD0v6DYIfPb z#=_CK;a}KvW zb}61{sS7X3{aCkFlH4>E-%$C|BS9$6`ALI~JF}fNhsW(@@wghJCJL#D+xtIs%Ec*x z>l8Xm&{U5Su8fbKB_JzsM7$lbEQJmJQX2kaP1#&Chv&Gh1D)z85|X0VvNwNG6KX%! zi1Aba#9OC79Mf78ovvIJaW_|_{mqh_B_u#CZXxIB!Fq;jnUy#ivg~dSvZQ^r50nZ7 z6xphh5EBKzYwhof2-D}e1Z9`u#b6>)2fsvTxs`bAfhT#)G_`+&RgS+RL+n>ru@?Y@Hp&Nmz`8=Rz;I7UmD_2R77h>sI$*kYC~w_j}Dx9{CMG> z8rbg1_kn4BWhlgs#G)4Tqo*0G99W`5FX!M@m7l-eSZeWZ&tipL^;&wK!;JX!?NS4L zfXjONZtz`^X$eotoe~15mJqU-$jGL+2e|eV9~FG`g*^s@BHN}Cs(F${n_1WxG)LS= zDEe`YZpGh_YRK%OMR}$3rmRNP9f}j7pQ-Pz3U~j!Rx$pYv+U-5q`6DcNR=m!L6XT8 zkI{vPycJfv&XA#&4u3CB?;*LHJt|TS0G-4TgW{--JEmvB0h^Sf@3AP9)h!itSBsU3 zJit*_{xkALlHwf}n7(5qLQEBU*RhLLPpZFzGppgfNW5BS=__)AE5Nvf{oOnP|-)? zzMYzMIgVyvs{O*6f6?~98!zfapo*{MZ@07_su_Lu5*<&9@k-*pjBpeV2zV!_s3~P= zAiK#L!m@VTHdHFMOsB*fm!GRE+2k6zo`p*o7FbKytx8Xbp>qkp@lGZksAqL*lx?%$ zUjUnA7McM~`>0p4*d(_X4jS+U6;t
  • SF|SqolnkIMFD>YkT1pPpxa?nw%B6&pX1 z<`>a4y{XifU=vez*(V~$q%ds_b&1{Y9b6V|Ne^NqD5^wZJlVY04n6;6nbb>T#( zXTNFPvDP}1^70n>EJKc&D=4S#dF^K8*lH|eP$ND!_eHdLMOhAC>3n%zPs`%_)*pCapMRB(=_8X}`6!{@cBP1jtEIdquXnp|Ja2zEEVgC}Y=oevOozluY3 zat+YchGwz)ms`ou0cPLMs|ukGnDej;Au zW8Gq5My80Ct+L$fV*hexv)Qx>B@1H}u890J2behbGKcX=b}KPp3x;O|*L(z_5|oB{jJ(pqANQ=6uZ|F8dHBL71Wo_tNY;KisjgLhOq@p~Q%?*3ilW9$-P>Q6 zXI^hQPwK(g&}%bFJs2L zye?Os1F6jJ>m@KwJvTh3aYZoh3kkTcJiGM5_4Ke~XM- zVBSqzO}H|eKh;iA#Kpj6Tw(Q^KfyoCoRC8AL_F{10sOLthLi%*U)+4Wt{PZnC@#sk zgs6JUYDO4aLe;HBrJvmbsY#nz0C*iDMjq7NW=2}-%L4`;)_77UZ^O~5j zW}XBUgbffz7ca!DxGQbuUsClnOHFt!%c$3|StC^r3l@eJQb_p;Bpl^~YHYp9&nE-k zs7b!7YtchaOti_SjI6Vs*s}|m`vYOhU?u@dzcNbJQZrt3ceMX^e{e&p)cxm|y$tQ9 zVr}^l>@pED%s=#KG<-$hO_*mMGKLBlDivn0e!O3mGtBlp62nHGQKp89UwuE5r?>pI z^$O$Kf|BT()?8?7S^?1F< zIQcHB(*6V;cx!xD>Akl2c+`!QaK1u}FE)K6--N@2qn=zaT9&bQWwWN}imR1W($X^o zFwt6=h8pm$i9D| z9EN%H8T5Jdg8fJ_`Z@yJ^<=RoHC|=9c2t1Rd$U%p(FtST(TnRaM{K^~<6Cln*IB4J zTD^=)>ntoV7aPA^D@-bvyiRG!_%eFX6IIM@N=uEnQehFN*h3+xx^}lHLAibA2BZ;4 zKI|MRM)trBE9z9RLajyensn6WZ^iTdM_q4^&puC^YTU?hoRLRo6;agpR(Y)GISt$f z#3L#@Lg^iH#Q(*3&28UDpnxEa3os<1~+srF*YKzbiA=Qwb+X)9kAxc|?5 zRbi5laW&3{Hflw5nYz8U!W3(-utzADtE+ae-^WfpuI`@8g%mQpa6S%=tQm{C@6rDm z!Hw%my3jLRIPSp8Am1E91>yx!f`VrSz)9})5fzNYbHgb0k%WF+ z+(wHqec{nKxjgyin%}xq-QnRJcQt^%JLSMzFZD+EX1`aA9N^0n>pmp+Rznq5KW!|F zy)=7}$_4)xUw09uRV&UZcvac@tvh9+c)@~Jq3Zngk~_J@oHt75zik)J4v}2BRj-(= za$Y%UsvrkiFNkW*7*4-XuaL>K6!UUTX}CLprY=rNI6}94M7U*JAMYs1J@wt+kGi{! zXh}%SsJ0)6&@H|@f$Pm{TM|yafI?jvPkWyI1a^{fFIT)<|l~5Bx75WNsowag^CjA0nm_S z^q%1hS1?SLszumirj+#!))XrRG2o$B9mjeK? zT;@%jv$~&g){-NGnEOgWJppntJb_TXpL@AcZz z^EwxW9%v?HE@Gr4QFnHJ6R0|;crTXAx#x?I93EJ$9PGeIG^JAy@Rx>ez{|_Sk-(`Ng6>?-ryJ$-{HRwF0JJ@GEc9WGNpsUTi{c7MNG4vxO|NhLo-M zITXGn6M)$+C6ylc$DB9pa>uE%GUrjF4u6FjF7X9~uLhbUy)fMR2J(%RBvYm_qw+&c6vsy%`a8a@CJJp$@i8X@dHI z0?R8kbZ>$Q)Tvg-=F?O9M7Ay%bez&4AztaQv@kvBOs)2+l55mmOm^Tp+4Yo9egY5U z$Hkd0o;TzH-Q8Jk&!IRXshQ;WKmr%TUKG?L<3*hERT!p&OO9S1OrH{Iu^D0N_tmW* zYD!nvzex!wTnfwnb2Rcz-V0x4fPNGS>M~(DrVP#WBIG}6AXiYV9P?jihS8CMWo72t ziX(c3ml$>2s^W|gX6K)v?`uuFq?5sxEx-sIFcAW^KoT>e2#Bf^Zo&$mVDQOvs3ZD$ z(L-||@9dS&w03$$v%ozIN?6ar0tA-}F>#7+)5@-MYeLLk(Zjv6eQ$>2a=-r@#mU*t zrRd0^Rm;j!2Yk3}1&h0D=<;Wz4#~r4LOFdPOb@x*)xW`n#H$H7O(9wJ&+2+uH6WEi z{2+`B4TOO;Itx~Kg7-LSIGv$3oX{6D*Oz>NUY%T0JWR4cLI^k+E4|fXStkr0Obrjn z#awLx=ELg&8c$P7v`&zC5ki)s4&aM#bfE)4yTN-ksY1DV?kffP)fV`$Q@rO0tO-A9 zl~(Iv*iS`rjYwze$OJO^WuPQ4dtP5tqP@i3!4wxwW1zHYXX?(%f`hXrxNmClkSq|@ z6@{~nX$nKRVo?gc5Y3YCyZuwkR z?8%M`%RCWjV4&06)l~}o6gC2nY=xcEq=E%Zp3A*K;ZE|h#p}xko*M(Bl1>B>k0C;r z1qaIS^Qh=I^&gW!x3w4P)$P4>h_E>b4-V8#Ewwx@_rW**L)U5} z5CFAyXRQWxI53wVJ|J&b<`Osggv5+^+6iZWk#+;$Ps#)L{)jFmzXbnz^w!`E_tu=9 z8nqyBWsnI<8ntIzbE6f(F>*@gu1|0j+4knnl9Hf^jRl8$1O9VhnS%)-FQ0)5_4B47 zLrb^2^yQr#pGcqpXB~{$C+46V6khe9xK9c~F|xr4=a6$BDmDYWj7jc2B~)^r9XYP% z3(N~?Hy@0H^`JIk(sa?|v#y}nHOMJ-nK!M5riQ8%fW6PPjO~v5Fq_}2X zOmW#!i{%&PVez$}jMDmj9C>S>R>_WN9Lh^Ud!s~BiarOBh99B78mveee-8Qkv@r>= zDg~N}behkY)<^r1xS ztY|vi(EHi*HRblE5au&ZQ>-j4HNZl^!9krAj$cb)crcBTUQ<7GZFy_SSe21A8PG{O zu4BVbcg}t@_>u3?-K7`LQ!t_3ZmdbnMSA){21fK*I;tLP5GEeQSni$6xM#i z7@^RmZ~GKVpHHQA-&kZePg{+f#h$>zYSsA+HQL^;smyDp+qvp6BG=+UxU+K6MOsZ_`iR-ky2NoNAj429{t~M2AU7%P*c}d`2NFMaP2RFoj#{mLYg~QNOuThd$d0X*EK+_k50tNz_!rU8#CzP*$BW3iw*Dpdc z#<}%}Wtwcw45T*ma&uK`PqB2lPiXXa_w?i&93}apMM&?Z3Y8yjxXrvS`E^Xn2eXot zS1%tvb?EwDH&No5#G)E?^IVXun36BCCS5$a@<<21z z3t~)t_5o**wH}$^m8rs@0RLFQdFU#Uc5w3q7t(ux&|PFBXK57S^PF$X&;chW;kw{0 z@@N|1d!>+WZ&es_f^c>x)i<%;iumP(p#(yB13~ip3+E|znQV(52nb(!W`mlg?2Eu3 zx{u`;X8{=(Y5e*men$Lng?4^Z$O08|B3bBJy;xP}-5c2ZF^`wJ3?rV_V$#WcD!gi_<2!Gh`^{F- zj2r#P0@}U8ebLq=xPlkIma#lddyIsha8h3woZnoVl~~3|sk2`Sb+A1h8{nSYSLdT{ z6cKhZlGRw>mt%?ar1VmW^ks_Mnbb{$PcyTgr7@-R14%FO08`LUbF%sra~XJE*5SgR^H+U@EBI){g!({$0tT6ILLGj3?dZ-`96>xs zAJ6h!#5Jk=znwl;5m=OeTUUTizC4{CKl~h9%b3Z>-R+}gB$rdHsH(E$%02wTx{L*cwC4^ zsFZGhw)B`TC8bn&l+=~k^D=6F1^|fE7(}y@9ztCrY!^rhz#u1l$`@QKR< zXCdC;u{IsimxKZip@FHUG)qJp}KPU z`pp@z&S?xP=9=pUmuZlYuU^9v3V@mjpyNb0D}K#MQyBw#BfakMTSt4uzd28=hNV z1UsQ^iGGcaBDR){)Kc5B&%ZRv)Pm}Es)lQQEQM!jwge^mM z^g875H54H<9X*`5!%{u`2=F~m^Zn_vHdF&aYOLO04b~-B{y5@Y#dtMs>o=p#Abm(L z4`B3JIZ+ZG9$tkWsukZN8<>cXg0~j#$!nl18SZJs4dTkia({)BUjXv=K;kMOGZB@J z%Kw8vY2fu7e{bM53s44~B$ScDg1{zIu2@(GfE4LCeMXNAMU+2&bnQ9~A=`xU%WBW% z!2CF-n`ch6wYdT#0pog|bIT?%qB#UukIiABpp60*bu$^DhB&;3L=5 z=*u?0J;M=i9An8}XHF#S>zi$p_^s~`p9_Xw5nnbrFP=l#Kmc*WD~eH7*IyyF9{5KM zUp(dm2yDjqMMhrV_+Oph6Lp`K=BH?VrRCb-KXk;$EQqN;g zOD=a^{loblpY`RMOs=BFb~tZn_JgXO7OGP&7C<(Yw#X&s(W7` z@6EQOddRi4h~9QG5eE1>2Z*FVxo7;siw!1+Gs`&5V>l7b>OLi0S4wO~a}9W5OIMdv zN}KqpTaG#p*_F+~&o$M|n`O+lA0v<*AK-elxF`k@}Wm~#AAvWS>0y7 z$qp8Z`hcAF(S2A+Ikj}K?)ACRFX*c4IN@*W_vT*$a*=KSRg$kn)Is+40~0?D86a^j z$h7b!Mk~NO`*?Hi_6#@74tLdP4TranqWY#{U`w}`LxZIA7)QGj<9;+BOBZ)wT@F#4c+Y&NF;d_ExW4l{KtVh>k*egMLwo-*wB_bF=QNpgtKUCWKqQjdd1yfCt zqn?XC8Iss$e5wg4#dKMI?&mC#W1^2hebG*2>Bom7w|zH&2>BSX28!-rC5ic{H{^ZF zHE4^<4Pu>-R&&#UK?DhrGk@VU8GbRE;S_%H+^ZW~d&x4JOl;oZU88sXEgbDcXms6d zaKQZ)ZnYyji{P=ea8SR|sKiKnjZHniE+1F!v_#XhXtHtzdd+WpUEhQBl{k$8ObCFE zHOj}T6k`=&KGgnV%4_TEna}nj%mKP|*j*3`Wl-E8AfsxWxs;r9g`kYkdDi53Z%wBJ zddd~XX+10y3948y6aL6E0R}oMo7AvY!yK$h=tejCtNI8zHKY4b#^ln;Bc~;{;&jZF zO2R>upQ|bR;#u|j=X(zx7niBR^#u5{l0_`C=*=uGthfoLD=3D#)6Q1B9&F?{^K|B0 z{2fq$S32A|aBdU9xBEQS5SBi-$yM-Y-uvFVG}QC6APrWbJRG0?iIa`C5jRkoe+tXU zPuV$2ov3iFL|dHCXVs@{ZRV+08j16vtw0+@jM0$>UTBa)san1~n>=FXaL0S(muYgE zx^GT$cgn&H#5h?h={y0WuE{`mgq7@(EnzD6G}+sEK$$CbnMBP!A>@>DFY_gaBIhHh z{V}xi-zpJwEZuxD8<7xG382EBQ{h-|G;-^-PsNb#%O;3&QrPHkt$u8Z7uxz3q zXYhTbK@vE7F3nwmdeszo&r9T=oMk(M8>fd%sxxUKxI4?y6nE$eshW9H!UfVt!P~#D z3t<6l=>pGzaBvW%^8dsaN1!}=4nFyS3#jkmJXT69SpNLtm2^}wz$Ty!rmw9Ph^Ogk z=n#iu<~TmK*ll86HramsV!8cHT$QMXSRumsiJGe-V100?cqZvZ9UBG5rTAjnEOWv{ zJC{M3*IJ?1k?ox1+RrU)l_;Qj+~>92i>2`cyAQk*nEMEdsGsE4*re~xjxzyNLU!CI zP{S!IDFM^Q)2#H@YPQe;Zv&Ha?=2e}n+%z$E}aSq%z73hKIJaJB#fSOzhG*Ku#%PL z_Y>RSErV&wceo|g(=k-}rPnDERU&2u$m6>dG(aTZO=AF30rH~TYDfeGv#UlxfFM8( zWJ@5L08OZN{2&OB1z2uwX+;yDj2ZwdL{}NGw-5XwK*a7VcKEniC*u5Jk1!nZ5+K$Q zRGt5oVj}UXK)&`*8f#lO^4)0XANlz|wr(Om5E%HK35*!&VFrUWL@`;ydy<~@w>S1S zM3gDqf*j`AikIL`Z0V8^tFT(){m+@`=oq-DB7Zc6FvuD4ls_BOm)SCs!TMm)RrkRF zPp4?-H(Q3;9Tphjd+h49uXnNHfS&(5;0ED6^Srjt;$1QonzZ(gR zU&?6`^K3+`)E#y-BpP;bpMQzCIZq(&q;P0^SLTOAUJ$rw1uXfSa zQvPn+^>=c8#N}0Gj@;VM<(bpf&-RxVAvxgMcWv1wIH{255=xsGR+eZnRw+ zD8dQ?GHl;fiLC50c2$YC|L1?GW=8yg;2hhvW!j z9)*k2^jC0dDRgDN<5`Z#DaMKc--nMpR>CRMpBScwr7uH`s3U02k}QPMeJwBTeN{xc zbg7Mm6!!nL(Gp1m2(?=Kx2>NKh8&F5dihWK$X16Nn)_cxBlEQYF?F-{AoVS1VPu8Mm}WTePm< zjwuo$$X2CO8OGa!Vy(nY;AeOfWC@qA69OSmnzY+W2hb?DN}En1TLhDjME@n?M|g1C zm$&Pwyx5y05rooGs8*iio6g?5xDM;s{_wtd#&;lXu50HGj!G{f2%M*9_Ux(^65`pG z8sP(Uxs+Sud#6ayU`-33iW*VlYlLZ-R%>G%ai2Jkf)pLek?caAKkp8iE5CgXy0vZK(@V zC=I_RLz`Q{rX})ww;w`lU8K@zN!Qo1+EkepXbYRMYEiOFkAX=gFx*MBTiSV9Lo~RX zkQuPYr&-3sJ_xZ1wMewX!7S#tT^O>ENEU}Emv>?r=>exL+AjKO?KjHA_vO|CeD1A^ z?AO;q^JEL*doR1sJc;;+_6UgnxBLv?-=v+s#Eu@|iKaWgTfRX%hZI2NK<1w?l(pj* zLc|aEAcuedu$A=vbsYK^x8h#~ydVRw=yo&zp?7|w%4x?CiMWCY%3xqJW%%0-zmVP< zXQR-|yE3SM2ZJ2MG}2A}b6^tE!bMZ7qh;^Tlx7Ve9GmBXR#s}gYXXoih+wqvqi5Kj zFd@bY=Nz(8!C%v8WhuEDg39x|r{0snHW-Ufc@@TC_5#q?9@2!Sp!VFoWuN7IDrqu> zovLQy>wnt(h(R*-MTsY5BZ|H)OuS} zc6)$%v;F`S&CID9lXtyup?HCArOVf+t>fMt-El)BJ}<$??7!@JL;_Tk*+Z4kT(ogS$y)X4H zPJM2Iut&B*%O@g&@IcLig>(6G&clm_`oM7xLer6eZP2$Dv{Qv>h1DN80x%Tx=AjXe2r~!3X?)s$K9gb zH6B&9aU#pGO)G|vTM<}avCuPr+xOMw+sUGT-O&*uewRHeIsYv`0~EchRh4#QXU1#i z$lmrr+&cdMtBL4;Jph1sRphf4u@O`=_qq_9j3O8_3gB z1zk))P+=D6NDapv0z=Z!wR3XYD&Iu-(8*CLVJqCgL?_1VfBN)Ry^WB|8`4Uj1>SsH zqQAt5dtBNg^BqCw`_0$jXfR>zSumhddWl}ualD|&=y{$y(%zD*+ulc7vw}3I>;$r| zt{_EiV+_8S2e9-aqsxtbi}AY!F+mkZ$Y-gaz0={3b5<;|H_hCsZ33{dE^))u`h9l= zxT!*VpSVazG4%G)Ik`vWi z@+%kC*1ky|BDj=(4F_&PUGGMc?+a8Yl$uVyZBc_L$>o=RysP|P6ZB`;b^szc-t|^Q zD%X>`1bL6g(WXm#|9|YgbwJeH)&@NGcszn52r8w6grtH464EW*okJR+0s;ck zB}#~NODo+VNDL`CG%~=@@a-8u;k@_0=iYPA{l52)@6UmmU+lft+H0@%tmlbymNO>V zxH#xm?je1@nrTm-2s@&hLY^%XtXUdTHt?^lr##mg%Z!tpj_IMsl6yzTXmRR9>im7S ztxW+jyDCAr8N&l|A(H*kjPm!g8W_ab+5L8y!0G&xx=O7s*^OG_=k{d6G*Ap_$Y)j@ zi2DG08<}n8d4_i1{rW(H z3T)8>4(kurNvyseL#dJd)F<7GI{?+UpEN!hsDHJ2h`jr$^YJ%%Ky9mCcHZCjw0U<< zOp?2-a)IuZA@agaVrs0jU|9(NJb;DLm8HtP1ya#F3P3x_gu=L%2~G&eu#cprJo>)^MpU>5vK|>4&-4w9ULi^S-vQsm0KbmJ*26T ztAS}oi9H&_3x%+R!8`Cspfsk%zwJQ9eUTJqXdoIluSf8p zM5#f+GOn|~&bHSM#?=!aV60QunjBpbp~#BtovurcF#FUD7h6^-hIX&)cbnk!F}q2s zah*C>jAteh3Ixid9MmZrs;dSbvGpit)>d6=uCR6oDXh#2V{(q4^t-s}T7@^zn`{f} zt97fxbcuf$`uOYiK0kST;Ra_NrqvJtHpLv0o$h397YxU1d9|ccb7c?b32`e@T z@5?)v=9x$>?=ZvIW4l)#|aPJx1JLs)e`!XCJZT zU;O-FhYc^7FA7JITao0qM}myIJ&=Z3x<~?IgI7YMH@Zv+FPnog#Fh_1QXz_H5VP@_ zj|_;K1NPkBb9g|BXWzg3i8bC&2*D1Y__?M0rwTv2r|Tb963NcP72Ht^4HH&hK`w#q zg849z4pw9S=9vz?on@6TqUNH=;zJx$D8BTYj@SN84CJ*)Lf>y^6ArMIg;5YB=NmDk z9_t>}>V#GY`<_c!XdR(@Af9+JF=c0c31H+uIv>W_K2EM+CqZCt!&VnfncP2g_4756ah&&wrOkoNFSEyt)ec~5TCt7Dc9U#{}Kac#=l(A%`RRv%&Cr8LznZfzWA%EJy^64 zE3|!v&&Y93uY5p%t_uxzkB*n+EDxr5_1*c5%Jno9F zCwE~Woj{kvIN&5u2^u2O7CkTwF6Uy}G<3?5qm{W6$0|1oV-R%AXME=FlQz8qCjhwv zbDO0O$b0%CkvICV%Ai))n^OT$JU81B)*aXeOJvuON1IQ?O6hls=_acm+0$gf&Da6u zp1)@S{-HSfzwNvOX2q@=OQdaq`IwHdJ&NVsz3cx*UK}9u00GQ?xjoz^(CJ#uNb0ylcNDv5DY#LktXMGGi-U32pX={n4F((>%^A{% zNU^-6D9Yb>_h+a>zQVD>dUou#K!__Yr>7&;02GD$QapnJYwePIO#YQn^;RoPde6ym z!4S2Hh<=?t-eg>q5i4jq3udo z3VSiMuO?~sa-U(@$!S2a+EhP$eCJi%r_*G1a^1g3<#)(k%(d>L>_EQ@;n$=)Ht_rC2YUcv@}kl)E@XSS@S)75RcI z4{mJ3lV>kS*3zVl!a6WI>HD|cN-@G1?`tH6juUj!mOu!zUr@m@xt8WFag5?ar@Mm( zJSNckg{N2e&bRw|=PvrkgzJNz_u{xIF**T6vUU=j)=1(rGR59FdiG+b_kkL=Zaj2G zhhJI7ARv(4q%De-{>`a{kM&QP$t;{x6-sXCp)DQ)UQJtkox%3V&-Sn&daHMdk|DhJ&URY`|T*XzOWn@(Ue=?k27<;h3{>fY1pSRqi9@{!5=jmarDZi^Y4g{A94fJ`v0ccO)08 zOlD?~lkX~bV<-c{SsRN5=Og#e^vhx>`*Gwj=qGye?wSg&Bd0Ov&cyHtEl}aKT#g7t z4jbM+uq;)tmL-424A_40YyoW>S7kiUaO|RLK>>-~tHoN)g&nCDk;Ifo0)V;wBQ~j% z?K5BUVG-gTPC4}93x2Yw)Ugs7WRWdfRysrH;6ucv1rButNQ*NX{}g1yz5z~9b9-$* z3oB!j2W`|M5rIcV*tE7mfx26KcF1y|R3S!veYP4Z31&h8My3o544DNj!)VXrE?dB3SqCMSoAvoW>V zWS%x^%AZwmWGd5c?P=2;dGY;#D;!sY#Xpg)Xp2gP;bqYyR+9jHGdK7`p}?joy_U~I zbvFW^oM^Z;@y!eF`{!%i9u|LE&ylH^G$bwBI6PH4Cq!@sCeI>XrkXtjaG9;It zh$}_cXJ}TtEaPL62mZ}dZ5i-h>F`;t{V9>J#qb70hT>OxT*i%!94L5nUrRA2C|9)r z9m~s6-}v%${b+7`YehrV$($R98p}2srhM6Q!>rJvR%7jpwDD|N?z-p&EVb+}BLGWI z9MNiRmD|K>J~OWM`WUhcpW`*$<8{f#sR0_9a+y86fXLIh@<~c09}eecMndJcOOd}ZmZjE{{2Y^wNI}G=O_M=94{_- z_|FTUvrWBK`g&U5`MNsypD5og;d1q_gerjm_s8V#yf27y@z074XEjTkOn(Y^zNAn3!$C7V_)e;?2OI+wKv}{?Aow}HqhRhu8o$@)atxYdM;dEHS9KGoFgf} zKC7x*9_INW%%0GST0BoyEr(wFMYwg;aILt}as=q@!1dql`b1KG;SjZZ0mOq5hgr4W)rs)3o+i}jlR^i!QRV)a zl(0dQVbWqkd`a(>XgcniG_3i~_l8RxE_i+MnyEIyXuIKvoShd%C^K1(|rq8e(m z^D{ZOS%E?dDf`MNtqCfW6=FMBRDfBkkag2KCriu)SWvTrr~?P0Jk5usB5K3U$`ZwU z?~H08W=ji^y+hMZ?|4{wvzw1pL z6x?H^YYbjF`?d5wp%tY z*L~gVzgummSg;`1v_R$a4TM*5o6T;(Xdz=##5EzvgXyg zw&3llEMb6>t>F+1c_qT+sGjo)BUdu%L!x&d79>9rQE#Ig!7GoiRO0X%-hh$wQB29C z-#4=VqF@Ym`-$)|AlB%YaAYi7G{}fY-dDrx?N#W0b4)HvkERYC1uybU#Ow&b^M#ttZ(FU^cCNC*Ub zItSI8K;uOlw7?_cdP+e<1P9rm=j)T#_pP=A5-?crnXsSU6rAA?$j0EF9nUjedB2lB zAT@(~M%psd{pBC=YAhF#nwp9VUz4@wa}NH!e+kQ+M@m$E|VVI=H4aK>P`)e8_PHctsUHm*J|@>tlzowC}it@;)62 z@aDhNSFkI$t9egT13PTfK;8J3{2o^Dcrt9`!^$7TLGd${OMhK2 zR#{L#7@%<-4=~#mcf`S>s4m7 zJt+}{Bt6Y5&u7mTqF26-`fCS_h#gO|rAH0Lan?EwhAF!_a+&rSp8hErbL-OIB(?&& zy~+g@ib<5;yvqtytR@WaYF4``rUx`%JZOt7`G@GnDhjJiCq4S)Zn78JMBilH6PP*t zWTP6(?B}%FOzdJk*zCL6b01;fWFHXtB|9NKtFx!VMSxgCXM45{sAO>wc(o|fkfCTB z0a6t!dV{0zhcxE9nx@?2YF-_Z1|$kUqSvVF1q^*P^yHKWtY^z-)1Z}P$^nm?T)zns zY508%^m3{kZ2d;xF|fc^c4=3J2f0jwO-L4Os7GI?k}sO<2=ApU78_5_uYYcOIR3Q! zl}Bp5-Tn>Kl->(Hz$CQ@8p?l?quun4vj4u<`ENZtYUi?y!IDFe z9C<6f+lejXM&Y_K-?|zcZLjeIkO3)PJ%{BB*5h9qNh{$lO1H-H=wl$`csu(i;7O|* zTVs|NcUjGskZ*M}u)sDLHvg`^0(!wKOGF@CJC5>omDe=`AHb%Qf8+e1(*#l?QcV$e zaQW3>39=^G23t-$uB*QHy{`E+ls7x;uC~js2Go^Dw);HjkBLm$pkDc)H zEt>DJS$}@$CHanv0VgM6KqBWAr$@h;(RqPs=2h6ecfdzz^G_t>Rjc(4fM|qo(L3-Fs(lU^*SQ*|5j7CSG6| zTlJUMV#mtE?7m)I?Fw;-(XLAve&FE5nT|pF}PMex{TG)4NVB@pxCbb z;(5(0WijJZO>pIF=dgZz#x(=9D6*L{XxV2WaG}eR;J%P@qkjgAm0|O2MQjvrP?5mI zY#ooSXtwTZ*V>qcjn0B13&q90cbaJ0TB#NFzoV~nr(~4`xsP`-|9m2 z>~?BKu}%c94M8=J?QFIjbJhdX$=Qz0f< zMvj%CpGdl|Huv&oJFD<67)MA*ZT{vM1{%%)5k>m$jgSDz100-EsZdB~I4cI-^Tn&> zRbpIrMC*ybJFkQluvcw62_TdXoknh>(@D@I`kt#yRt25h%iJoIM|Y&JF1^lm^)df< z^h=`4n|F22fG4Tn?)WsuqM&9u@yvOX6d)Auh9IqS1q#si5julZX&JIX9D&peNgOjH zU)++cO$Rvxh_p+3c_Rv4wiF@|nduydvYr~W)Fqgvm6x&|=fd$gU3zW1?dWED{9FLB z8j(h&Ajh&HvLYBQ^HGssJxYxH;TT+{AeQ4qeg$XoNkRSQ+^(!wxf%G3kwe)u?Fs8$ zipaij&L<-41I{aRu%Cnh&jeTen&%i2FI>>jd=nhcg|3UEtxRWKm0L+IpJO;w;J&k} zL0iq&@j15H1G*zW9KC-wKm#@d=XDG{N}S>cd$3Hx5y6m1kK!aFT{>cD+p})h??ugs zmHcLg(zQA)KOxESOAfonr|jlI!fpz9hqi%LCTBz2)~>|4=&qDuaSF=E-k#d+c`t$z zlnyv-FV>ae$bs&K5TTNqT`_@H39IwB-|l9dPD;6X#PS3+l{zg3Z_hoSy~KJV`br}T za4!tHQ*8x&yG6XSbDaGEB>){x&g*$*jQGu4)1wJkE+1@L@w)WZT~5bj7yaOAld=6)|KB5w4Ll14FTIW=%B{f z?$3n&`DbyH<3O(*_^*snll_r8U4fh%$j9i@gnNJKN?MP=2C2>(7RIZl(ml3?#|L_a z2vEI0^-ggWK50RHOLI_gURwdZAWYZgMY88LxmN_a1N=p;X8pmI@m1euoFP%%vaGUJ zc>l@c!}vp(k6j2?ppoSRwRfzWG!EaUoq|8z;7p<(&OT5;P^B;H{$OcJrKcFAmXReY z^uE!XYW_x{q`ZtO`Vx|^FaH9~bc0}p(;%RW`~7~X9m|=%6r!6|czP7U21Xshj!ZZC zYnJMH4}u+J+>mjft_1dqI>)Daa#+nZP#cV@RVDE}SZ5JUO+IGg5||kLT(v}mO{kLb z(emW`LfN3_wn;&z(XjV-jvrxMP#bBa7b-=eTN38pg?Go)og)W6xS+SzlK4%N0U_$D&Rz1uL|}` zswQPH8druVe=L~UO_z0G;WYeMIF0Mp1U?-Sri=b?u@EiapfZ2N$wnfQ-m3Blt4?_> zZ+MaeoVM+pKUE;X8Hq-bvChMN@2~jQ8!{~OtZJRSao`Yn+12M-B0XY;(Tm1PwK3mc z-lqsp-dQQ1Mc!5c!QZ(U+LxusVL7)DACQ`!&zLsiZK8ue8I`c0FpU6ODu(-3uQ^xQ zR{hz3K`G?lPzTvLa$nt09u5-fMMZ}08(pBj8i%cfc!}Dz8$HR|6U@e*-~N#<2-ZBs ztEc z2Wg$IiT7`tZ8dJv%n*nm5<6Tvqf1trTlSJd(8Z?)mvWvyB_1RhSgqi*Wi81?PSKPs zJa^U|sYVV&d2hPhC2xrNSbbljt9$dtUJ2p}-@Ss7t@ZZbAHoevH)Tq<_zD}7XOBNp zlG74x-4s-ILvqqoWHhvH44YF(?2_n!BHoc(jP?&#f(K zpN((kyPm5Z91<2A%G&FmQd|cp@rz&h?nc2N`~zxI_K4Nq#9-IPYYmGi_bg&SPFJ~Q zK&thT(!_u0iB6Or-+biUs~4g(qNArAl}krrrEKB4Px@k+JdCB{e6vnxZih473m!=u zbCk0)QfmmF8>F;cW^S%rz2|v{YUJzv%DT|HwhYwp?%wzjnwOjFvQbt!?MqjFO*)F1 zcd0w66w$Y3kX*-=Xs_@_R7n8i&S2un61wPL*xMJHndINbH?g)_rHe2T4O;Ps%truWN-^mO#m+Mihv;Ny`+W|$o(Sb=JOVR=FQ!SxO zFLMq)b4aZq2N5Z?eyh_}a_!!8;M$66lD4DfMB%6F*r=1EYiylb6&;;K-~(Sq`oy`) zCu2sf3QGf)^}?x{>!NiSLT4uVSUu`4)9F1#C;{Hk{SOT!P}_$@2u}~myiyFJ?EsP@ zYuZIGvQ+~ktgh1s8hwkJAiyO-ugeB3(4$A*Kk{@q58Hom$`^jfs32~dH$p>w>SN7EUvwYkf{?P4o3GDV5#4G}N*X8c8sBNge=NZ;Ldih&c z-OOc^>`hAx@4psO^qIy&moeT>1BLg)a{{D7oCr|^e7BN8f8}!IgQgW@ZbU<;e__w` zHnM9;6SY!1y}k%4jEycegoD3h!BF)5pbse`2sF{8#M1N^uL$Mytjeu@?O67o>n$W4 zjEetaRsarJYz212O9{$zVPaBf)7EJNg6L-3EW{gcB&thZYNo92Rdhp%gfILq7+IX; z4CF?_3|xgh*d$`ErMB$K8TwN*?zE1>%`We4N@8@2{ngH}1gI8Uv0Icbkw20TwDGs_ zx`uFCUsb2hkWE&%dg&Aq96{NU9MRX`7{4O(jUlj`>0|&Y81v6Iw73W*X(HpQI=`uo6wDbCGG8vWl zjt$5yRA)l7%=#^pCfO%OxIgrHC`Or0B?mlUEoAZ4L2yX4@qSBFbe`B?uJlL0x8gYKZe(ol|&o730~3nNr(;$)sTsc~$@92wpa2 zkMIdhdj|LPQne+X(ko8649iu{G)2S)4~?sm|5ZN6_GV11Z>sM0@Z7gp%2|ipS*a?% zleJw-%Zspc!wh~TL?~%a?@488@jiJ~t^mH*n#XMR$wIv4q;T4(4o-8m#&ycK270@4 zEQJrPx2eT%_~@592Mrh{35K}XF+XcafRgkEk|Al^3C-2W(%kB5ftpI4aR^hQ%+oCM zAt0y`r^Od%+v7B?XK(ydh@?S=UvNi=#MOa@%wpP@#s$xa@1*W@DrWEbgcF@40}~3J z+S^kC#2Z&7&U>0am)cQwfV^ye0>T;R2p46Wt<%Xsqmx@_KE+~y7*ka;aWgB)QX3)j z@UwF}sjAx21$7oa-4|L@+NYBEljTT7qx|i!Mx$HmL@TEgqbK=#Y$#Ow&>0eQV30`muz7`@R;78YFhV6tS=vwf2Pb@4vY5lBUK8qgYf zkDeHT-?*J#`pT*_$8ol9b4yh`PO7!9fI=Q|SQj-b8VEWGqPr#2PtlMiS>6Y3vYM1D zB_bn`CPEKL;3!{KR&+_P6mbdPYOxV;mq>#$huz1$* z#1>?B+u_rO!P-NFrftCVr%JrGgw>2z-?){JJ#7g_68oexAoKGKWsAy|NZxnQndQD4 z7XoaU!nS$5H=i4_M{o4?xtKBGTYp#e$U4W`PpkMPma=5D9$0ZVm2PW!=y1@fnIw(ek7gvv0Bf3VPe;^D?E5Rjq_m-E z=~(Bxx}FQyhfCg=C`{*WytBD!A<-o^Bj4x3r&@^rOR)t~fr0?x3Nq4A|F2@pK!@a* z#c=7#*|)6&1oFtpb>-3C;5v0PnxI0j!RJoM09EKDC)cizTEQ){w~R%abXtRZmJ{YRB8SjCkf5-@qw!|RfQOdVe785)^v?b zA{3_#B}OfFBtd4S+yXF)oG1~Br+Yt!T%r@9b{^VVkG#jqD@!a6z6={n)+Q$+38A^! z%Ht^+rL@M-lV~5)ORK076w_-ziMuD{5|crGt<3%5#5ct^J4}(!^9uqa*tA1yWh>NJ zEeAZD9D(vj+sSJGq)t*j(0>R}HxLLfj#dT&8NZAT{SQHI;p37X5QxJ|Y%T`^X}N<- zy+9t5uDoaHoGOBnXi6bvJWEARhqLKHwk)H85pmwG78CGo@9|Cy|_GqBc4H6;@(cJ5RX5KfFX9Faf5jzUq z*tAXQ_Ry5xbLJAD+KOr-Td#sZAfD;)yRd%1;<=PFumLhMSWRep@3L%`0lrmYz2?YO zEFm!WQOK=1-~)#RLq@(Qm0sBDE9<0_D$C|pcfd%Os&KC2h~T5a%LCE@w<)lCSX9l3uQ0yzo(n~QC0^>%fd=MFrBmF5PVdReIEAFS>W2++@YCKzH} z1;{zoHYxpa{4SrJ&usrB%4CH=);!^aAPEx7>filgvHFl6V3RO>n<4NbOc(}$Bc?R) z0Bwn~$a*)(<0vp5$Gyx)d(k-BRDQghB9Br`uSk8m!H#Jy8T%~wsrvM?tea(Ihv&6W ztWrl~;{!lT326}}jA;QX*qq!UUit)F_BfT90gyvcTHQgs;bFQNy5diup{U+r64e*eqziDc zs>Sp{9O0-__4L66p5{)YVa~I;9;yniO)d*RtfCb;OSJ*rH^jjMm^gf6r>C_#)p;gi zJLw_$i7eRgz>Z4~yU!jyNa$0c|>aR=CU2TiK zz3q2}eIl(00Asjj>0vNgR6q~NGu@B##`1kCZafxDkOk)36)e;LP=*x&QiZcVTHGn| zq3S5tSivJ(!YoUdmzH!(V?I}#iW)rIsZ-PoEpLvtp|vxwHo3NPvV#LMjVGy;Gy8B;$qbl ziKVq>=@)l>Kfu>hQ|-^Jl|NNgdkAL`P(Ajrm64MdJ$VWg1rWk7{5za?1 z3eMt3*m=y`rI(8vXAhW0Kg*KH;!&TGbBnaYBbDCPEDn%Q$^aVTp%>IuRRe=h?_BsK z(O_L&-Nc0N;d#H_aYXEc;NXz&MJ!w2dPfV2bRiJJbAlg4(xHq%m&Rpg(frcwvloGp zgnp2{dGqGTu_KVTAHa)d3VzDTVdG_A-SDVBa?T&1Pfj-YS(){&t_2k-foq%x*T{u3 zPEAdr3`->@iAh;cHt|O~58|t<_;;R!Jl1>-9W zm?za3ErpWgrJ9+T)QW_K6%F8=1J28lOR9ZHq~CxJ~Fce1Z~5${EizL<<}gXX#m(Q9J>v9=C!LBtA~qIi$oVY> zYl7{@MyU=#2v6dMW?UU+YG&4~8ih#Oc=%Qd?$dq8)=^e?kqq7-iAc%0!4IA#bVAy+ zK=heN)JBX1o{Ni)PpS1`h~OREfUn88$vG)-u1qE-95FbHSR_ANuY27y{hNNy#ih?x zvGJw(p)0kewhpD|+|g*TgFeB{&0-=nt?v_BLQfrfw^mJP>hcoJqaF}L3R7c6djMQt*=qmFyi+r^tG_7*D9mDHjM z!)Q5o`};G^s*I33(WE1o>kz`)#%ZUxZ6v=2Ts^KB^-+k%f=rsj_q^KwY9>`laG7( z@%De@vlxWBemx5De1?0SD{9y+4a__Fwo*ph!~Rcf)ZOChgw|Zl8^=@0BxL=btvyul zf_1B%m55Al!=LTY`2KsJ@3_5_qw8{3c7^e}hsb(HffQmoQnn!@)yu{v+2~3d5#&-Q zZq*A80nwW7(SA_+{1JE!rr?6_VUG^(?dGm!%4c(}6cM<82Oq?aph) zMXug_KaOxIxTv~&tKTA zjyR4JRAFdf3eklrpE0 zLM|oj%-vH#d(>1SVhJ1{ zM+Q9lR$fl=x*bi4!|F)q3Gu!eizt%fwO--0V|C9&P(`*5D|I>bX#7LF&!{gXuzmir zmZl40%so8Mtmfz2hFL6!rwuSsK;N7QXc{yNg4}{h0@vH}DlRS#pKo3EEl-GbQ|&1V z9{V4+)Horx#Ia7T#IefIPl|UC=StcT7;vhZn5qZ?BAR&wJe>y5A(Ulwl=-T+N{x zJ+?e%sbgJxUnt|v_@)rSHgUv_$^I`Xuu=Qx`4j&qF*PW7iyYUxC#^ zWF7sJ-$d$PQe4P3JF{-*87X^b{$u1b%b6CDJBp6tr?}i{e7?VUs}#^AYI@1DoO-MN zB|+%dg;GTomDlp8Ag_(EQ+va}(Xo)rZg7>r_k_Te)9-sP5qTlr^>38Q!E;wmCv2F< zsJ@uRzi5a|Ac~24yk8!t)oBks1}G&q!ogb`gI=O$!LG2E{!e_) znQzg(ZQz>|&&U*_4Z<&;vE^_`)GH>`zrX5lpG?kUv(QfyH^rV-XLJNYdmQ_?coj`e zK7p6ORZqs&evUV}AhAA0X?m$!dBax5ltQ^JS8crXitm`X=j4x2Eng>|B{TK@&|u=@ z5Xtk{5hH!;c*>5Rb(lHYiRJaxSD^@^uZQ1gXQ-Jbbx4lh_sCh z<`{;dk=?FSNE9=C3+8Z{HkW(djZxuwl*jUdPk+*+sfpPHApeG-aiPx38Sgq?RI>zp zAz)yOLz3K?%+Hi8sJG&!p-h&9+uKN;{v&ozW%Zch4x==_iL#NF<`y^D#8M`r?9?nC z?mXP^MzaFnAxRs7;D~F7ruK<^`_+bzXjlRRHbMdx9Qc?{b~!I+@w;DVfai zad`Sn3^WCHB72~{-*5IP9|)lzU)foCItwUhJ1i#XF6{W+1{XmJwB37%;|ptsRf{9D zksIVS;m#;C5XI2aF-P@6v&g+ZSh{XClRHj`KVVulREBlu5MR{3|3Q#eAdlgh-n(-# z&T?QaUfFqD#`i{U@1jS@6m(3Q3t6WU0wdL%Ry;b?+&a3X#%HEG`pdl}d43Gg+Uau> zEDMvT7zCk`u)ltawbYl4?*(fXIRGiW)7xF!@B(La_l6a;Ojf%^q}Vd#!+1_6#z$Rlt{`wuMgubR5Zxj_uZc2o28 zh0M%M_xSnoJ)re7hU&&zgiKp$?J+< zYWZcLfSk|(_$9G;Q0`BCfIk=WLu*~9ZRzk9#e6hyosBpHQyiETG zgE+Z21Pbtp#rq4kKUhT_%?wHmUT8fkY;zhE9Cv@)#WX;&^>rq?=fjJlZxaXJth0VO zf}h``LBeHy_!i;{+ll1+#f zsu8xU<&L|X(^pUwSH1hr7F&7@(GbV$4~w@e3Okow?WaB`78W-!i@Pi>_%dzJ%xy79 zl8ZcWBw1DFB8qV`W~N<3B#_mWvQ7Kin|%*)WD+oXNZ>x=Z0C8c7vqb?fCP2S^=XXK@ z>S^qTlh4IL@9-;at7I_I+NEzZv4UB56yEXMfpBeqG9WC$x3{}h0@BvM_Y;+@TTf5V z67nL8HX^^%3lDN+_uevCyCnbb+NJVS!A}_(8J^Q!AW;AUa+aM<8oQ5ncYkcxqhlQw zqt>+?>m3?;S7Z-)t++Fuz;4IJ#$=o|K^`E$gHwjD%lPJK<&nn?dprN%;oa&LVL@Zz zg+}k=a%bj+NK@J$#&fmiN&wc^U;A_n7v-sxK6n4+8^{u|_FsFGH(UmM?XfX7;=8O# zF9gF2?ChT1=t$a{c{ERCLxFTB^N};m4jWw?_wUM5Og$RKweIGu`NO-Z>I*>F?|Bv> zy*Xu9d%TDOBS8&jD{I?{nYN`(E#KpHs^$Y-+_71u|TW*qU1e}xGcht;SB6pi2N{P@-_#QCTf{U{r|GZwiw_zCUV zx>dF2)tImML~$kg8e$OK*)yD<4%(dG_ltwf)q2wTLZ6z|V1!;ymLquYnx`4JGy#D* z1Sx=9wYrrNJ7F2Qyo0MxOVjPNask^jhiKk|c<1MkD8M|aPxais3bfNh1jn5`*R0&o zSS7eCuXZ-97lO2N$9lB%LNhZIqtZP2q_^K?C>iu`j(#VJoZo(WuM_@;WVCQ2J{HKp zY3!^DPI>|Aq5X5f0CyP=!-fd zlRTX%*=@BHd#?iDR_czwQYF6gzW zCr79O*mExeB8kNACF-OcHl3bjYGdQmt;*YK1N<2Mw>%CJ>CXugzkR4r$o!l=iKfx^ zZaI|}WOs&sIyu1*l_-&tG2FoG!x8V4m8D4S^?&{!wDw7>$aOC&!R&%ey#sT zPtGZP-zD``9wsY(VST&6PL0dlFC+Y=LVzBzas)SEvwlJL ztDdGo<3Qsa4L3z)6);>2xh--fH_P` zrCjIrdZO*uqx@A1KKQ%;#h#Udf`XE3ZpkUYuz9Avu=Oc$Y>#(6%%2_&|EdM=yYN{C z0T(aT+#kx*kP*nw$az#ShtCKP8OO=VqRGBS(;!u(gSw0-b5+OM|xeWeZso9qaMD*2gc6 zoyy&B4<*AqpBt4%PxVpSI)2@}eaA6x_2chfa{JyCmbb&^KdQRDV~h0G+z_nTKVY8H zZm$4Q$exdT5B)o$BGGhc(vm?EYlv7wt%nrw#CSWF55mYGY~hCG^*Inuf^6h1-JQUi zN&%FM&hJe6-2aRqvm-!uye$@r!Pn)j^KT7b51p~ zbQ4O}ua>qpr%J-;Zkiz>md3TD-!D2t@wFtpYe+tAB{`L*ZQ+**gS*g@*Yjka5_>>J zlfpH9bq-}nk9b0=*3b?t}t3QVg zsG&e4KthAUY|m!gLR5s`^=$FFHp;jLdursSLCGgDkl^ff-p~57pg!vDvPVV-H1Op1 zILFVa)cn4-$}U=DKrfK6(aT#|7}1|uS9_Y-`LOUAG9t|Fx@`IPg@PlI%W84$8*Q(- z9i#Q5Qu6d2JDF-+x+Gel$*=-4B zxULhe&kXU53Q>KV{*91ihWR#UfG$E!MAn&o^i-nH%iv!4^pCH+ztR>@M025zq}*k1 z*lxmPHAGF10TPDYuH&V@muGd;7pCW{!L3h; zK0rhQfCvy(46ui7ff~a0kM-zdmTn^DJfJ!Oa`>H{ouhF8s{r!m02Bd=W6Hu!#V{z0 zniu;h2`K8-P;d|M&!>X=HdWTnXiy(GO6MlhUL=he?T8G=7VWSVcj_Ug%p6vzx54J4!+;Mrr(nq6|Tv#&6dKp^fQBMpuvpu|wuVE>k9jV16a)z_!+zKct_ z^2;n5f(kDYU<3iy0b9_Lyayg95w4=9#&;6|a=e@8{VXsSqn1CD)1LwH1PDJoNa`4; zGM0mUnB9p6Yo6u_>8BBM&9(B?^o=t=x!O4kyqP2&e@a%!n=WjnrF!IUt zd?->~hguxfE3|#yZ_ROUrD-!vDTR9bC;*OuryVOTW}myOF~@p?ik`OOFZ z&3FUV6zIM*HQ+KZEaq%6r{28D^_tAXx3~<|FW(NDyj0y>+OJY-if>yZK8OqId#`Xf zO5`2pCck2g+G@zErbudRs^LEbATVbIyNL10c{mV*&p_&p7mFuK%bR!*pHgn)l!#&z zFe@O8DfsGQR{e~2c!snqs-?&YU7O#mNO=@OcoF;-Z0PN4GOpW*$=9uCuj&pMoWn2j z%nUwT%*$Q!Ed?5Bm(M?=XOjI)qUXb_uC3Sb#XIS3x8Ha?^yY0i2qjwoi6f%?Vxjz? zXPhXiO*_U;mAgc{v=gcC>uf$MU6l7B+Gsf^>I**O^YPQyYkX62Kv6~Zc1iG z#%1R70HGrY!+ZtA8H>FYr)XRVKfK<;2RT$ep6w3#fgc3Gj@(gDl` z0EKcLBA7_0d0dC)?dZ~E^q6lDm-=-c$6lWrNZi`V5sP;+k%sd)eQ>&Fwa|oY{ZZ8pB|6i>?4qBLoY}&B@6rD(Y=`>rvGyQRFyNnZZ1|kgTY# z9^46lM<9QD*JiV4E(OkGKAGx-2LL-y;df=g*#ZmVfz#~*dtgAM3J3Oi>A4F4x+@5l z8~_Df2BU@p3Z0Pxbs;Rq=OsW`;c!3uE~AA@*%cJ5egAS~bqduY0muS7?0SBc`|h^S z!L#3ujLnb$WWn8(hoKkv!OFWc`b?}8wYVsZ`>yf;VrqT69G|~t>JWtXtmhf2r8H<> zUS68(s{1*rQl5n}07;+#+4m5NDQ+|8ZJH^RX>Wn4Dhvy;s=Nh*f8;xdMOiddCbBp4 z5JL%dB^Nr7!MaQjG8CW?cLDGP7sA2G$;nlvRd)jZ-|n7d?Ly2C(@;-E|0s8dNRon= zy}mjj1{@rZrnjUozvDzxv2SuwtZA^Q2c{={w7_ZrNnhW>d&g69PJC1qe^oLgLn^OX z<<-ONrH_SH^_$5*0#5d@)~=3*5}WpyT;9cD+_lls=%XvUJI1`V>ZRvf0;BakT4h4H z+@BGW%O+5m)XO*|t0*rXbTuw+E>Z4LC;WHvfh~_J@fVhGiRW)QUS{!X7iX2jxRPH{ za{x;%v7E`=xC6mrLe5C_DX+S2=cLSNHaGihNx$XszbGYozvq~jq|Ey;XZX<>{RQ$* z1g{t!VP9RkQ=oSUQifyhqE;y;qr*8aN#F#Y4qUIzvN6_t}dzg&hZ@JE1q^DdH zv3+PJNGnI$Zecqv=k{f|r)^#`(zE5F1s^8LcGZS2^m`O~#-lM@FRE~Blz10fQ2_y% zLQGoo7LO#khYxMa70+u$84hZci}9kck0g;4=1vMfI320U+~-`^*0A|%OUUDhchKvQ zq$DiT4V&?m})ivdd1*6=T2@J~qmZ>KuWL5DUKiqM)L3o_9O^ zmg_YGlBtV|^7qwPA-7zl+|Iv>jEwBAoEUNSBMaz#d92KD5J2fg0RaI+yJ~1Lgc3;Tyg7mRy|v!`-ny>ut@q!_N>0wqp4nyg z{>>aC9`6VHVY?n6>-bmiEv|hf-b<0Ng94Y9Q+!Gb)jkkt8Ri0RC28)9YVU1<=!5-2 zA773>pUD6k8TJsSB@DiGFf%hFQ}BR%(Gxw8$=X2B8}|A6$48^Q_37Guvv@k>re*-B znD=+WC-D9N83bVEDe3&s_0b7hjzhe=NPz;YnOA%66mEXCH17cj(0q}}@Nh8zumB#> z=+witk+=Q8aDIYFg5y23fu*)q8xRwL(D!^pU%EvOJa@fi3 zq?CUqj#g4yIx-LQ^#lhena}0JrKO}s#d&2~s~Nm4HZRo64kf-g0tq zauWQv_#USJJPW@5&T}1%R?C96pR(x=$#z~J+qo5owdr~xj@?@bpxAIEl@Gn}MY^;x zLtUR!qkpA#%13wEGgg=>>=>IsSWsQyG&E>Bjax-)(#(xfmFpA{$JuLJl&RnaxsrfN z3l0vZ6ienjv`!Qp8+u2X7j^pp;|IG_`40jR4luMPD22o4_aD7(HoxTL72y-T16pM$ zO9B*P6KGP}qiJ1LRv~4u%QpXpi{U2>dbn@>s;0WUeQ{(~$T%u49(d1zaz|}rDOi&v z7%KG#=sw#a6o&js*^?`gUPnD%a8jOiS&7)pbVWm+=TEk(yWh_hmu2H@VPO_fFPH+S z83=PNY0vXsgG&@uyMAU#VslZFUe;%BLKeVSz%pbraY1h$-gX`Wi&|<)Pd?u1o(~3* z>J)ghvDbiimoDy-JuT`$u8V$X+{kp?dxVoIgosxxp++O)F(cxuyz){uN%cx8}c$iqv`3>GfjT0pAOiBT;?@4 zzA~D0c&qQ06u4h^%rcHT+k9->i0R$Apl3hC>is$N8c%d_OsnWF;HpTjO!MY=O^w6V zlRCj|Wih89hG-)_q)ha5oFaQ9F-47QTmjE_aBDaI_$=Qbbd|lT#9y^+a7y0AzkL_V zC6)6*0%${!_bqBnQLY7d!X`2gK=Q&MB-1r3U^r5Ach)^FLp*;q^q#%`mDtqN0&Qc= zki|OgWvNj~LY1(v?!roBH;v@Pv~1qpIK9n5!|s8J zX50&2(~2PnD+fw!O9GJiE#h~pxVShFH`4Vbdk}X@N%4%_xXGQyh0TB^{2>ej-dfv9 z4sE67IC2gxr_I$o<=algo|J+((D^Q;y2ZefYjO)8Tc{>y=58{oh9H${LGNKD<_%3{v?tmgM7 zxzg~@<7fm52{?j30hrH8M;)1N)=ZCI&Vj$^Eg?9-L2&pR6NoQ6!D!sv3gSy^km{2FJCY!Ta7#3Jlag{Q2r2*OZ|Ehe z%Ztm8!c77L15qf{Y{WJRfYsbo0XrCQxIbgoXi(%Bl3|ck(rIFhfvH2yIbQ$|z0AuC z;zNS#D)*e|&T*Pkm*ezrcH~|6QB?AY?W1>Ob zT_Tj;xp%bVXXbVl5$}S$oCi18=Mc9G>YHDxNCn;v6Wrw>J_Z(X<6xlPW2?E#OxaBV zq$KFL+{nB4wAvJ_0rsNh*Ps3$DoR@#be+|{_GR{qc;1Q~33%%@e7BNFe%)g{ezvav zkn`BRn|RudQfxwjPoGyUFh35OCx<4S<$^8C$T&3V;CQ#9#c4D=`W%q804UV-MjU$3 zqh9f)D7d9Rp(rAK{PD1 z^CF@cUr|2L6ao&7r;868G;}5^h8=J9A()DZbM3Bt&WuYlQ>5JRdQO#VSH{D0DYI$EKq~(3vE&P?x^2#C}!8(r{+Slpd0CyYPGNWND)St-;&Xr9aNj)leF)C`|no z-V3jsiRiXb^PpbClGRsRHJpT1K&2JT!mnZ~s9D@lp%h*y%}(d23Sz0gXM!K>C3!(Q zW%~z6&?OjP*A`u5UOP+LnWQRElOx4D21SeDlRRqLC0<55L568Vj)%~<^W&S}P?|(l zY?v!zB43c+)VB7E?aop~1Te3)U9|M)Jwg&%c6?5;jT(Dir)o4-bT$L0OMjLhQlqwymatmU@Ig69-tWhe ze@$Kqo~{uV=Q#xPM5B`GIHPfXNb?kMrs3wze}66T0U4itS=X{5=CEe2B9JH8HVhPo z&MfMNyFk|0eVc^;hK9jm-5cR zDgBs(Rv7u>rH?%vtuH{69FPQI{FGnfCT}w1B{2{X8==t z+%P1+cO5o?+(ZiLc`K+qWqVRuaQBB$`{9TQ&@9S^P1_0OMS=Z>vBo1`53PklNtafg zeDM|gTSxZqUrj7P9wq?0a{$t`Z&|ezUBppIALj)M1Y>Zgs^-bt1dCXYABCb6InF$_yhmtYFqWNG2&whS^= zQkpj5n2?d74=r)TX;rYj5N=_ z&SJRgzVx8=;@gcbny)F3V;K!nu@CIXm$Oj2;U;Z7;%f8Q6r`AhWkHJRy&P{ESaDDa zRGahB*5|~TP(GQ>3|X>y1b4)Vp)>90zMq)mr=GJJ6J$A5C^mjLTMXI0tTkdYQ**Vs zs*UdshM~D-qAC>)xOrKd)C66;x&@LgdDuLG1$ko@$HbPw8GElSxd>S#(y?gpTGL@U zrQ9nMDudI<&AbZ!eB|`8=*UCGEw|!^uiZCr>$g}0hwjh3AO1Qlu)xQ2nvaDr0Vrst5b14wL{&EY+Dehd);RUO{5 zM!uWDxK#_Q0YS2x^XKockLY3773V+aWF%T*|hHYKnwrxeeEwj1^m>~l6$VAwrbuN@g8V>A;f%>3369y0e9Wp z7QvRPZ*RObLaeeC-;|Xd7ng+zZnWp``}t2~L3jnf1TrAHt#Rp#$?sWWqUm9Kv(IZ! zbVV-lN!8m$hBOJ;aH#g%)iU1sGF8j2Vx0Aa$_V^Ezf>#xq7!tE>4tx?LNx3xWI8s3 zj5LhQ{|rb6U$?)}U+PM@vT}5M9$H4ncy|Tuj<`@u@b@>Ah`zF`F0`y0&r6+TLi!p9 z#oEpeenJIz(4x3=fpd+2q__Ul7)#x`4-*5*x^&Ys-Tlpt9>RN0?W22g>>KN98%eFwpSsEv_tOYJ`V_1k|0dD6J_~qp>ORzD1!%?mOXxb|>YW&|7 z{rkD3?OSUIPd-M7+%+&OW{;~pVWqIwwzpM04UXbz%qyZM>36&5{q*=!1B@UO6aY2- zXh-08W0u^L4+P#))3GjnD9B;jcdyPK*-aAlrWUg&uZvlcXyiBWhZfeLtiADU*|my> z!XmlrIyaXSd*QX}q!To2k(v$~ITv2fF=cZYY@XbZ;;w0z;Nqlj+UniWxPBYXv{Lg- zT(ABL<MYr`f+{Io8Q5P`x?qFtkr4nj z!e!U~+7Q8^afdld8|vNb@(xE=J;c)TK3C@sP*0-ARVwxY1-+la;m>@(0xjXk$RMzt zcT*{~SkPRijE=AguzLN@HJI=%Ef@E?-N^4PDREy--Fj0Kn$SnCgZhQ{hLicX5$Z3k z`JF%)_*+nqv6(-(*xDARJs(&MfmzL4xWM*H2?0h$1KP&;?8oL_D2Dp~ZrAEXYuuen zuk-A*bplE7dXUQ4lqblP8PRJuss|W<6$bh@2QC z^Wd!!O4UJ*$NW8`6ALrdg9W$9>7mt%bgsX1#*kSvelJtqP4!=88B8g&?&!dvTs5d; zsG5nr`%JtvmL}-c%1^@ZWBZC`~DB3aZoAhP%NZ%dH1M0h<5a6YG5~NEB}&KJbQBg9lZLo zVqtE^oJfdx~1qE!wcGetG~8Tfqoq#)lUW28RZ zMFc$9*)ULhOa;M$(J+r09}TMqFGGXs0KPjd1GP>#IamI$7N2kSNNtmhE=Tuh-bN7Z z(m+OQ(KhO5o0suaL9&BO)v+O2z5dFlDr3s6d}2<4 zhkhL3t0)?1JzRE|HaQ%+eJfHX#Txf9VqUPpI{YS9A0?do%Bfv7pg>_%j#pnNyxQ{k zm3Et>_uTJzC=ljw`DkjqYeflnHqQXJ1GAmxq{!YXbkG96KBH;UZ%U(16VbKUIsrh1 zjg@Ui=s-b$1UQ9Q^#(0ef%`VxPR)PZC}lKZH9J+$B%8h8w&yR1Y(#~p( zH^zQz)$tIiq5g1^$Iy^Er6?sV=foUo!U}=UNKivO@{u(HxgRLNFu&04+?paLHPPZe*YW)O zGKGCy#@O#~s;etB7bYh7CN(_#nuBL6y&J4O?*E~(7~xq_2#y-CBDpPOyzBZ_G3d6@ zZRIFZIy~m}W_;Xq0KAf#@mwtOM9s!b_dSse58QO&{Fj7lkee&tfBSQNef=zfDdIf7 zrzdK2{RguCAs`bE6P5${CD=<)^HY>Uc2XKxwyqfoa;x=Zlz(JS$~oab#WDbvk{-_A#7~i@A^xt?2*zj*i#$HsqQA5#;MOAXcM=kq9|2DSOL;!&!evynl888xH`r`gxv-)~=W4{mV#4|c{;5XhGc zd=O-`t;~*&)cP-mCEfg1mRX%3=~Q1sTi&k%3U21ijmPuk4E+*S#NvybsKvm= zuUlLVn@H&>@IofwMdG$4nF#|+X&Tf(l@*+dq}6D@WeFc2}Jh!>el(OyE&iJ zLs+fET12PwG0+egpRlpg@9)D$ZO%C4so~|&M{1#jP&yWGOB(KbPkyOcS6b@f=0^Ky zrG|z)mJM_e3R$qE+8dJS2{YhBpkwAXsKJ4OY&FHLz8Aq5JB9M~nfG}KYMYBM{m1u! zo=i(Eqag^LN@OS3Ed@v5dDatV)UHUWfvg{?fJcXh5>*lO;%E9Y%2wVASXs21YO-q zoV^ngivW6US^^^|p zziNH!a1G<{PJ<3!6f0HUAg}R1oPPPm?65OR@=uGiP#x|5T%U=QfN6q4aG-o~jGg=g zE0`o9+fogm{q65H$v{EqoTa}nO#4INc|1(;>x0lBR95%VBIEfm4gaW?keW0^s2qeq z%G?}`QDYD(d>tAGL9cYOo5jS$^n1g+!X}q4Al)evf7RYB5%vMMrs-JorT85w8~^F{ zh%8myWb$a0iTQ+i{a&q9tHdpQr*E0yw|HaNyVYgvtO z%iNndV>yhMZSO!UCj^oTyoEhQ=0Kp&0vJY?(dDUs)M zaMRpImKk_jnoF?SF&ip~j0J(_v$U8W69zc}53{dSk-TYNFZ-EvBxQW8>HWCbN02nA zra57Tlm?}v33`b(Q83}!V1_UA&%K~rl;ko7W5PNi(+gpiNq|m+EGCl5C0M68pEs_6 zj)A}qM@alwe;S>-uzctU=+%Xq<~>-_%ZH8U6gO9TxRJ%DLGy34g2sC=6yZ%nvS^1i zU@k_6h7(+;Kv%WBQEIg-b6nBTc*qfopC?w#?z97__TI|Hr{B;HovpNGz|Wh7ML~~} zXSor|XnqmIhE`7Cg{_aU0eHl7k?JemC2cQ5lKSK)7w_WWqeEl`1FFLGT_?&De=K$J zE;F#XY^y3H+=MPHlhTr%rNCXkz8Jc^IHmCSohmZ{0fF5q1OBOjt9t=V!u?Z^TGQWR z=BIvQQ}PLJn(>PGH@OLz;GtzWat)TpZ5Ei=f2B&UK7D{P5apIUM$Q{mbC@PDR1{X~ zZ>(IhT9@`?xlWo4s0#L{LZKHnR4EbcHQ!rzcwY)0F7eWMjhm zY|P+0;k3zyUM@y{o{y$uj&f^C?Zt&ZM?-Z^qAl*m1U_$+a1`i1N*Ylf@AfP}4pYaw zrs^yvGSR56VEl4c>iUfkF8)setAzuleCmwe7=!in7~##)%<+~AkhSz3R6>0GiPRt^ zgg6=DomBR1BZ^TY-2LWju0dY7Dcny32>S z$WZsB|4pFJc?PBgyhM7kTxIJ66UAF;`iB%vTP}KB2>{T;){rP}*@a<_@A7I9+MHU^ z*o`o4BqOyzoB3A4NlbLB<0mfyY~jtAd-4m1^O2DjoSSvs0&WJ|?0aoyn9`{udQ{=A z?gSxif4s3v`S88Uef8i0o+W=K*9$YTF+61cXj$*l`li?&ko0L2l!CmxsUr*;@U4O1 z;h)mV|JjQ$s5SBT>)VxNIXki^J;Ak&@jkPNy7=-;c|-myYHp)N{%Yz_RoDPS!W8+d zS&NnJ!lH>=Q4pMxEA_cA!G5Ocd;VynE*#~dsHH|roZsnIMtpH3;v)+YHnonFmR?^Ikl0g;U zscR`Urr_3-%G2@)4$`U%Vguia)g^QRCl~*)+nL}&tW7w&;qY(+u zHB%2Nn(AZGES^HBH>=+bb(HpHv&A&dz%HG~j56wS08_D2kMW=0;3~Fc5Q44(fr}Jt zjPW9MwbDw2Ll#B}dqyA!jI8<(7R@LT@|U?BNm@)hhTH|Su8zU}mU1JC#NXnKO-xLbpo|7(W73JS4xvN;}>1}OoJw11Gdi7ilMa;5Pqw7PKoz=EBmU@M! z;-d+<{xoi%YLcF8sP>V!@lRvLGHJ`;2A_Wrsw>k z9>AKRR=4d}{t$ZU1gRGw|6*kYGTPPPxUkN*@;Vh)=4x@{l z#HFR{-JapP4toC$Sa%>@q+4y>LECM88?uWQs*^$#I;z_PK=P613Q#emD8Q2w_&{$9 z=$DrHtt^~7(*ii5#Rh$*ThB^MP??&qtkw|BsPvEA1FF5B!d;+0?&VdE4WfhrK@d)U z&=ooXTnQ7XY?vHZ;!{<_0%xS1)06mu2P0hUa~Y zhN;ZObn_)Qi3qCrn8PRj%q@!ltIb0|iGXRZO8Ql-GwWxA7@*Oi+cY zNq%MCI;)xFIh*9%(mqKuet1W7=Kf_1S(BGnq>5hev-Kj^^~j zQ#6LTZjV+PdI=Q^zicnUw2u~KIud5a9$88SFDmK>7t zPEgj_``*h-kOZeya97J+>TP0QT$@mF3(-2Zbk>2AOw*qYL>F|jfZ;`=dtj&3ZnAqb zm+rGaG36W=hP}*m2E~IujY6e@att7;eEZ(NPvjn46P)nN7cEsj>3yN$x|qSGc4JC1 zCg+RT&6G$w38}oU=KwEvTr6nD)b^x=;;M;Q8Mb*`r`;h+x)T1mnmhrm=0t< z_!Cil8Hn@fl$1y{O%RCM4Q>e8qDzIWx{$A`Jf1Xsei16`8p0z7>eETsn6D6HGs$Dq zQH|#nW2+~Wh^nOx4MNCQfVE_51w9NQ4`+?F3WjR9i+X%)f;a4cwC4+0H85jqY8*Zl z)p*Qnwy!_|J{qB>3j)b?gVU7o0RU%#$&zlW0{}iBKmX)5W)_vvSHx~~mJgO#MQ{If zeEy2QqB;5?XSjxqptL`y6q&=ACLpOt!ptJDwSvGZL-p%s;@Vo|(#JR8BJA z*!VQoE6b3X>a#CWEiNu=VTBkg1ybKjr8_7!46_@6X8=-O5DK1CJaUJwe&tdJx)p%e zQ@;>-tJ=0?j|F5L@p7|a7F1`36`*h#lTrujaI+R;tQ#kmUvn)Nxv>7eQ4_rSQG>EC zm|+cfe+5;Qk*%n#BH-avjsZ8;v}7*Q3|+!HWbU9w!9Jn#wsE=_AFY|X#3b5F;A zdICVXJU~MY#?nP;5pIbwLsN}qJlLtfE{D{9D}HS-?CX6vD*yxby?|*ax-6%ky|S?0 zH>fgTQmnpY8Pv-XsW$0M(;5l;kgyS&C!&U>n=ng(Y#Dd4)N_m8*v!C@qCQh2i%kQ% z<%AX%rJZ}aG*jip&19`?iS2|KP2RPllJr3@om4Z~eji9T zr?5FCB}G;^^-Nz$z4ydx5v^qW?+~Al2$Q1cl`dN_zKh2Z6pR8-+(#F-!Z%69F)RdIq`Ogi6Zp_MZ+7#G6 zG9@+*G2)mMil9zO)V5zN^^cz#U-i&`bA&!n#XsLFB+#N*D>kY#%-v%3^X&0}%T~+h zRH$u{0$5q$<3J%itp#vtGFu@xW%NNB%dYxZYA@(mS_LDY5(Oxm{o%^T=f(P zwC{yfX<20@jny%=offkX$z|zIFmKZ=MVDnYu)(YelU0B^J$(v>iW`$6Dh37ohIlR1 zcPtP!Nu0&(hmNcQTwXQ~4Q#fw@E*{kYs(47n@;25K=!KrCMKQqXSA|_;h7nn|JMD$B%x%ZLpJ+ItnCTmazV zSB-ZdYlN%5t-Y7m>S{qc+C>;SGy4Q{LrFH1gI61vDQp>Npo72va9sxg9LoUUh#(U% zfbRpd;P3++*pZ<}`XF@&>hD0Cs*oyKS%847Pp_Fx3;_TRpfMdrdc$<;>4Z{^4gX@j zq?R$(2-_zHB1y|->D&VoV_wXo{r3)cf zR|Z4q%P5TV3{6zuN+NGCl)m@<-(qGH&>7*VpbSlBD}_ZQ03?t@?9eq75R24Ng0ZJT z($@dYk20URTd*m|p4g1efuw^(OS8z_V>Lcv^k8C9Qc}{!x{vIWGt?7C6klqWk<_35 zG9YV3U0aP{Fo4o%!$+3@3=9RRV;~zRFwAaufYj^p{Sd4A{qv!^Qepl!AnPhUTMcb6 z*_^$yu~sU=g*-oa(7{N({^$8=U8(2({vc~3;0J<0eymCtQlxrH9_%QN4$$k=0t?0ZDKiW20F-xw$|qg0Nz39eVA`#KlkiKeI9 zrN+i1q`d3#XHqD$(*-anQjiZpbC^WswB60P@gz%oA2+))D2Z zSGI(+6pXWmoo4D-*EUES87=@1u;qO$&e4ZoSyNJvWU$tmxCSR4Qe{$t$2BWBIFa5g{mQU@lqTYci+ z;a`n)_BV^%3&GFe)3beqk%rBQreN!CyKq{krGE=lbvp;US*n0ei)$`!P!1L6a~H4; zZcEDI>b>k&I_{I*vBc&`)aZasyWA&2L__z&{no$)CCIy~n7XC-p@5#n)Slr&%j!;g zP58_dKu*Mnn&JcyS4Itb`}|S{ym+C8Lsj0$j!srs`m2L)!$nIcORN}o;;NZJqy+xx zRK=GN0$jGnM#nbhXuA&cB~RPNQe*AQ3-dl8AD8*ykQWuTO&A^sh6r!NrX&nhbT+o`~Nx7j<*W^RrqciOeYk+tNXm?zGw0!N4@ttJFBn zeeCxuEPr1Jg@}2Ko>+73 z|2*a3fy#PCe%0JccMA1>(si?zblXlCEE(jo-0(4Fg@U>Q9L;z9FCOkihFxsD>!rnkY%{ihDHtQBSI6_-OC_)9d_Z@<9#wMch}6p(T}nN)@AUQ9A(=FPKJKInAw`*c#2Vo&Gt za`=QZV7D1v+gFC)XIGtc1NEmVhi{12n{YS*Tmaa8tnt7X?kY1g;((u>J$!>NUgfJ-cC%B8Zt0BpvA}afB^MG=< zF)X$y3l|aYG>`mE^Vs6G?Y;3pbw+X@qzBuQ=tYuA)ZTW({zWf+hO6AeZ<)&3Tyu=n zAxLYQpOIwHKi8Z$noxW=r(mDe-uRH_-G8J3R)~x4%*vG5&^#B+9+LEkXFg~rW2(R<>8S?=#YwiQA{Uk26eJzUDE|AKwky7L*G_D2~Y=eAM>8=qnQg@F;;`{$bYG z%1WW++@rI)9N#f8n81~U&{%7IeQP!jzh^_+tsa5C`ySx3n+4CZ2ZHl%M8Q}fGg1UeU47HrFi0Vhhm}^9M#Q8a#2bi@WUzJklS^O;Ze!ujq3JKb)aQ9>RE2|Y3FTsDsMpd1NI+RJ|6-15x$JP16sjQ3OJUNd4mM>`-u7eg z3GRaRyRDm)5+rj-K&@Sn+#X%x?s1}1+iSqgy0J+Az0uMXod8+lzas0YzW<5Ba?G_RMthM z76-Ke+Uz8zDR^_4zl(nI0o37uMahHPhK6ty^`_aE>8`3TCK;rQqB4&fw)gxaSYAQ% zG+`Z;rJfzPQuu1s!Qv_{UePIEvUEMQ`rAK0jPyhKlm>~N3KCN&@-$pvBAlr4N7FOs zxmyIP(xAhCP?C88wa53sE58>URl?Q6bF1BSC@B>_7ceL4P+)&NJUO3VovSZTc43J0 zLGMISf1h94bt!(WRJWV3x*$AvO6ZK9N&7_^>5*-Zds^3gNBdtP`Jcf4U$U`(X97bT z6jGJS2H19CS?(W00`{K5riB4CZAWg$biwNXukJTAWc*>a+KUwRAF0oGx_3P%2dE8X z&&$ZVvi9!RJ--tVI;?J;D;kH(?D?L?{vCoMxD~wqrvWIdIZJi&D6uHCl+ft;k|${atcdhzJzKf za~h}0A~&-&xz@Ukx4ww9JT#nSCZ;Ig+q@q@Zi^e@v9=H-U3?k-zMFnKwNR4JrA459 zD!V}pkFTC+?R+fgu6fP^t&?o})~<_j$xL6obo5y*est;n4^tYJlTc#YGpoI-6%w*1 zQ%sUpEKmUsEkLOemy{`P0<+N&6@EQ?({N0DBr4^KLLhl`1YWRAxw=OE>xi$)K=u*D z9k{%|)kpp60;eNdi^DqqV1jdcURi&Q7WBIPnOUl%Ui4@fDppqz&Fz>ISD%xCfue*g ztI=P$8Ho1*W@>iAkZg6hl4)5d|8b}1T7?&?&@Q`{Q8uEPS`zDXWY+hilAL&5K{~g{ z!clxxjyvQ7SSMc5jJ#F$o?uXIH!$l++2mgWKz!oTeXSo?*J!44C7wmc%-ZIKoIn2L zgh8dlxJ7WBqN%G#hP?%^5szzcOm5@SEJ+i8Cf)D?7o}bdf4%0h>Y+~G_ZK~IYOmj- zmw&IQ6yjZqX27B-p6i|Hw0Zqq2qzaebV)=0w#nrFPq$iY1hmI3FpqfS6l;bVeR``M z^8L*V{BRLvuZqeTGECAZjeDJZwYa(a$Q-u4%5ItOx| z*tm@X4fRnUJ$Pm#+y|fC!3~q#f51a^Q~{cK=G)tUeIX`T&%VVT|Dt<*_v%Uku!Aph zcNPAh(mT9?y#g?=faCt~1Ou?8iOHO`x45KaveAjF$G5{;{v{dEFWWQwUx2Uw2Us0| z+yK~S3f+o$JUwl{+O{Wm4<``3+hIbD!%)SfC%4hRvfZ=7#V9M%akP=TI|ZgU(! z@X=gaEPMSw-OmX2ED^#dxoG6n5xX)?TSoS5!3Gqlv_R~U?)7BtkF_rd(~Fgu!C)uS z?S54fYrJ(eIfeG4{P5M(iZZq>kfBd0b~>5!d-XcK^foGPo>Mjn^KMGbF$SV(QF@S| zb!fgdq{|Cj09K${43B=|g}DVF-fxDP#qb)HnCRM4(rRJ(+24fIg#U%PF?x;iMme2t z<~Fh|4p%|DOzZ&9;AZsLLqmz!prct{n!)7{AZ{r1mHg86fe^Du_@TDgAuI_aVxa$x zi*janC>LpPRM&(4;S{-n*4%z>hy=jH>P;*L4Jt23PEL`Z4m*tdUe{VA{yFMCj~Z3l zimgWApaN^`roev+r$11Ek6)mRF-smglSe4?IY5=)NL#u{&~Zn_fNAkm{O~}>(9xra zENdJTOoNs<{@BNBv5Laday2~NxB7B#+_oz$zfm5wUfiI0uBfv5OIh*r0#s!ZJi~-c zj0!1U?6|8T8SF=~z^u&iuC*3a>{HI2i`(=TbWD#~(!j+Lr#Ub&7>AeLb+ciRrb|CK z<#nOQ-pTpgQW)b1rA*$~_{)?7MPK8#EdCx(iB%ms7d_zHvsEhV5>LvS9oyr4G~hh? z0b|ZBXT9d2>X@K6Xbr=_mfdk>mCI6Z`m>YEO%Em zf_qS51$U=kVM|47H(;ovoCWIHw5q=j$pu4yd|QbJ!pM&W`R|7jGqVLCj7Uf%{qG7R z)91EkkQ+04tG;cuZ;jFm`d$C<-4}S|d*SiP_g*gRhDZJ-$aHLtfihu4e6ON_VxA4bE_uFYhCF=OUgwS19cF~XLwa@6 z+fzza@qEcw>tVNByyJ@qdD>(}kBr)1?+O^0`6#$9rH;Cq)+KDC4}-h5K6lu&y*R5B z<#hs{1P}%Qy&KtC^vwU{(dO=6qPy)I2+!t>LixZ3-=~ZSz6;Uos`4k*tlsq~Apcg8 z$G(hv_h3tS2$n!|P0{v8oVQ3UeCVn>Hn@6aUZT9gQDKr)nci)Bi>Qg<4dmJmm7ClJ z=Qn2z*RwWptZ^%~h^kM=*ty*7hjz|(1-07Gd#9#iY{NtwnyRG53~TmK>||Td_c;wb z4K&oM@?1-qXH(->a8;ezJ;#j!Ev=?dS_8UxV-pZ3^E)iiyS!zW1r97S$~A8FbxyUu zJ+%FhA6x9b&OcL*W&3+AOo+t##j3|`jIrN&Anf$fr&IWQTJmqjOENkOp7$c9O;%seK?;{tXL@P*~(GH|V%qAs1Y#guO-0wuN@s!+VIe-s^7x z9X3$p?cC|*7;z{$tNFZKelxOel|-#g>6UX^y-Ry08zVEV8(x2A!6eZ+dM3E=R$I<_ z)5K98wGIotkytu=l;|#;Hu`)_k**yqMz=yhwI%dCkIDu169R7#5>bLs57+dle_$U91=CgqODEXE|1i6yO0gHYv zA8Rfdg&<22L}KKpiN~EYRx3lkC`^{yR2U<17z85o(3+&LZ~X(t5J1HOW%wHa6g7t2-^L4_RN;l0EcpRJf*AB=$gZ35JnEF|8LBL~WP zW~Rh>T}ANMD()69tYkB5Pr8B~T(zVs)>Z4ph|e6LS4%5j|ISDnYZ!gRP+UB@&1Nin z3=cNDJuM&>b zLey&Fm+*#&ttDh<$(I&g+o?QRTje_70AY7W{;&r(RIDj1cOornRPW0SfExx-V^Iwc z4nLCtA3XclHU*<9nIdp4U#irs!R9mqsq9$0NBd3l)hFNUIF14Ru>~GDu2p=jg!x%K z!Yh}pV3Jnskp4D6Sip5Gpr&NY0gS2g3r3>079j1N`>5QjqNLYjRiO_;?`I^hS>0Rn zh6wG3Hu3G7In^jHy_U>-Rbfi_TCJYlvV5bkO*y*1y*FTPP1!%Z#(2$K2UWB*OYQA7 zcSbW;)favjTfblJc$A)QXZS^|_6%*w^8JrQN$bW;F$b-JV$FKkv&D(}(1HY~)KhtS zanIo+BH20@%XtWkcNByezt%Wyj_|4)nOlvKO=8~2V9|b=vzEFD`&zU>d1x9vnHr9e zvfj-uml?C>o-8NkUANn8JM{Q1$B?<`WBYa_48 zk@5re>1hLe6wCL=3Y+OhCb64RKABdbFI?Ym1)mv)4y>#t1RG<0&od7E^4|Jid(){_ z%8S+v=+a<_dZfO)kFjhCc<$Fqbru^eH|2*Ksez-?+FizmqXJys>BI-sS8Uv_H`8TM z$c~poYx$+md+3}qGT$mun;sUNFM3^}j9tdhl*lF8+c%sA`2wdr07bXGW%HsQ_j=cu zQkQf+qaGOf)^exxckByX%^vKi=wz5507z?mA%;aeQ2T0NHTjSOSRTh+v`Bnhp$ntq z#7F8M&E+&3j@3NuDC6lYbafiG3R+DG@Lx+gKUvFL|Fl7B^cgwd#$J!~ZiDi(vx&Q) zp(Rmnkr+jl+%x~Z+7eFajQk}oHu1Jd+uJx}($Vm?>=LhuLhIYG^5T)rUcD;{1kp<~ zCj;W9UeNILJp*=LTv2N-mowu>@Z|&2xCg#s6aFf?QvU>zjOKnF^2$}!4qk1fQBDj2 z?9o2LS9&+G?o2|zW;zDfnHQ(WIDvTc7d&tDg?ENm6EP*x^4F@v-*spvLFV!bk98;V zbIP>7G_Gw1Pbelm#CvvXtyRLHU28)G(oA2C{n&VM>^E_P@Ire`{apm@{$SOyT%PSz zuyeUyY6#L+D{L)g?9Pn^mU;@q*_VYvuZPLK(lqa?-Oz3eqC+jGl5;UD^M< zJUHR>)x-aMh0+T0V3m)hZhkcq!LjG3lpLxx>eWdXcL>NbAoS!!79necN#P%njG%F@ z^pJ|R)`X64Q2~ESBH|mETSaCF786Txb8~Ukv)v*1r?m=COd%91-Adr%L{@KO5mk!4 zgtV&l4?8oWC#6dopi_+4Yb_9@r4iWB>h=rUS5Dgj(ID1u0ha;{_%0)A5m_Bzrq&S61Av*x);Al=srILT+R?Vkp)3NIIyXz|#-;@h4=T&%HP zix;%}1^NtKkIgx0k=rKv3-X&mk4}9DF#i?i6o8R+4Gj&|)kAaMk|9Ck1cJEiqfOwH zdtNYPVL)Q_?Di2Oz|ER!ag-*sL%lh85zAnThLn!#7I0{q&Y^bSGw-hm_d%G%0W&}; z1Lz4|IAXouK?fgmJhU*IyI}PzaKL*49Y6(CtF*5v>_g>d+h_jL)cek~K91g@n*3KdCdN4&YMU)+dugv$8vM3Tx*7R?~a|cX$3K8OOvvc+#5*F5i|}s z=4bUV!)AQ;>WXZejgwZ;I+-Zz2vY^*2j=?{e+9aq>b~_i^3U||)fL$N$@1h;+__+B z#G2z%M?fEmW5~t;!cySuS(j`3Cr7mE>gs}kUKh*__NyFX4-#)}BaRKqk(Db=WSWFy zd~x+zD)U-k>VX*lPEg;I?dNUePT$dicp%@)Hhe*w>B_i8t`jO^&ZI2(@{`sz;FNT8 zIWv8Ml2^+&q($&86avQ1QXVAtijz!%Ed*4VMYK6U>k!b73OCd{?O z_d+()c7#S^4Q9vswwZeXbB@*duYSoh^3q`L!3_n8NZM~}jV=|?uPD@vxQJBF7C%7o zSXiuY*j5NRPR^~Y-86^R0nBd+JO{s4jDc`Ey=vU&QhzXW;*zDD!;fC!V5(FLTM5xD zyg1vJq;ErdEwA$mlXo5+`gWsugV8xG=LCh4n!B4~z;w&iZ;DI4ZfH3wPmxZ9{rZUj zA&4KlV>o{EFldM5uWpX(U@iAz&aDrZ?ELB=u zfyS?mZ!WEwlMTg&6b?bZcYe64?%g>u;~dRM#ih24)iLXlTUNkuzlh{z%gxlu)-?xs z-_-7Fj~gOZjf$N8s=^$omn{eCrjuab+&^?}ubJBd+|rvjZ}y2;bqOvXQXJj*NJ6{0 zp?memi@n#B0q<6TJ@#7Nz*{*ZucH1uyKR;LZ3>trphN-g^!0-9ExCu+r~(kWYH7%M ziQ>^RlWPe>o2+6wsTYG#oa zE*2DjHHYM93o!`qzDd@97^U`xcMN;IiLN+LG_#fSp!T)~6Q#c>xvxyWc>@Mck9RnY zP%w)*?+B=1k^t-Y(2VJnh|s8Z#&rS8pNAE&RsQguQ$Yjc2|(kX_As3=ZABhGqq*22 z)`E1Wj*w>L{;}`E+#7YuUq~mmYN4@;0$WzxNOuP>uiiRq(EPRSV@p?59G9B%dNd_S zfgj{>dS<+e3>{|4VLi^C25tLDn^s|0mFmXZEf_`RWjm<6c6IgxV>CUfZWE4_F5!8k z{C)i_ZEtMl+UKNlkp`LNc7yl9*w=OFZf3tXYouD|C;p+V=p~J0TTrD-z+5=SvgtRUY0dIT&kp~q$Fi<-}_hJ?`Ue9qAX%|MlMISf%UC` zAL&0|HA9>Idi~1V+HI(P&~QS}dtya`+O^q=T9}ast%Y%%Jc9cuaGD^!y{)mvS5bTZ z+6KZ|&3iSE{c`Mk{N)1#;WpcYh?YL$-gg){q30YgABa7D^)zShmo>#-HG>+r=b>l2 z2Ym47r~lWX-->P1X*VT1ae!Xaz6}ScTJBPC3xg%AT32OuCm{WqTS`i*z`CPD2c|6? z;<55j4kxt55%bGTlQ4GCx$7iA-dV_MI_+qdZn1d}=(`-HT!rpT&RUuy52{p#Ljq=w z^G1Y?)hMhd98Yp0l|ET#1G@0}c67L~)i!N^{89e)cIw$)BXUmDm>a#}EjiJ7tCi-` z2c_*+(MA2J(zNOGGSdhauzzVT!q|W%uT@)6+;)1(YJLnP5+E>_^Ji}hsE>5xW>5Ik zwt8R4SrJ>4-R0`@KM|YUF zF=5yjM{lItAw-=loe35h(Zc`@Z;?7SR$iB!cYbxi-#re(1`N0=xS^u7)W%X^_sri| zS06PvI0(ZvumPL(ygeI8I58*t5zq#7`qX+Y5gPNeM>~ufR$=D?u6|6EwY#?+Y=OO> z2js=;$vd5>;U9E9&HcS4*t?kgZN7Qxdhx(==)~(`eV*_c*Lpc0qq+}`64i*vf~sxJT61F!BWI}Zy+x?%-tChq4v>Jbn1ye{crwp{5WP$d^cf`ZysN+Md9%CP zf?!qT@*<$+L$|;0x-j-TB-6qFoJx%70=|I0l=~{+fMA_sX0~OhnLFiqt=oai77|Ll zmFr)U8<$#+M~Ml!O4p0kwiOM?Bvp<1>NIFsawCD3l#M--_d<7U?vm8<%E}5LqMF+K zwihK3uXFbr@!tCHisSGZE*oFo-ONm$ecZ@x^t{D*3s&LXe$XA&qt0q`kc%#N_ z_@VdK0cK?h zi24019&zv3@2e4RBhTxp6hmd`9$5+R_?#>l%s|fPGMYfI{2SXI5R06I5Ss2gPV{^0 zmOsxy3@<1yq;%4;Uk@ko$m%oi-ih5&ejMlr&P`qN^ot1|NYbRQsG#8QF~3=~ttr0^ zE;Xtb)R2VcMOHcth>tv`Nb+bQ*?VbUT7zhHa~3pZj7Yyik;Nq_M=Nbn@B6XN;i~BF zbHC+?Q~`z9wls4cp<;+5pt>%1f^GX7T?Bh|pcfnt7^NMpvL35YRLdUKxly2CFJF8i z;PZ*~FZKD0_f+b|uua2sr?neFIWvEL&r8y-mh!*s;5@#2#uGrJhLAGViTp|}IVOC~ z4MskNc@9XmKj2(5e*b40K*!9INDTXL$V7Bou71zj^U}a0wF_CWXXORMyq$l>NJ(vz zZ9uXAJyHS6ryeGuTmu^eT+wx(KR)bYQ+Me4S=vr_q*I6@C~}9@2hMX_MmO&UGh@$Cl zl{uXpJ4>Zs4u6lkLJ>gsJH5#+8qjNXxSvpiL;@Fa#0<;Uz?sB$U#UirgQ6plDB9Yd z`%gdm<$Dj^*vzB4Om1qY=NR0}&BX6TF=lJ+J=!eLYpAKOlVPcs=TQE%Sp*QQlLn6+-dUMLGwme}eshEU%(%w^>TG%x0iG&U zHkK>*Y&@kocmK|$6FIqBDR2dl6i=Vnx*?nWfzEFPMh<=sfi(CEvXhHi*Q73JYm4XK zThJ%1DYy?K=YAztCvU*yUKb1_j<<9Cinhs@kgX@QGvaHYrwYins)#k=`0g?8D9M|S zMz1H!?+3$UZM=%li45P9cXKx%nBqG12{FtYP0?&DR506=3NOA7sH^NaI$YDMKkY2d z-+iqE9fuqNG>4P~HAxSIJ_ugPFG$*|j%S4N6~cuy40IY^EKUtbmZn%DD#nw5zSsdk zklUekAa*D19ddDXUD`@&J;KuU=%2)hqWO%l<6ASODaHj~x-42Tp2{~8ZK%`T03aZb z);n8@yxQi}E^DgzVXbOBHr8$y@2`c{=M)vSzN?0!w3E@PPz}V~^_+yPrP|amuE|`f zh`t1k`S9OYkL-rc35(@nxEj=be%eM^)^NO|D?r<=SFC41sZ`ZMCqd(b4o?BOt%5*! zGghgfYR;)hbhL#VwsFgG-2>nExz0>^5Xil-AHHb1+ND>t9P1 zc0?oeSC6ct2dUGH=MH0^5#Gn4?mC zRs%r&JE);{0RS~X;k0;%F$FXX=(&FGf1GD01oca&&*#Vm&W|J*0lk+UVtejw>yje4 zx%Tx>epfFC1J%i;R-gx}#l*8BYrbH#fD?kWwT07?T=Pmo9!P&b5L8EnwXLj_X|7-} z!%4KYW0$Vr?^5~;28+K**c?0f-D1?=D&QpYxP++K8Tm&$cBw9{dF<5AEDx)r{`~E` zL7e^oFj3nCT?F^})8K=%)ZaUv`hPq4 zL92<1iV6VaSTQ#mff<*RI!j{JFFI1;Q--~B-fqMi`_XRE$nUA^{Lp(%4yG6j@wg>7 z35dM`r~_n5;UGYYFLDCr%#{a#^$kO%!$6<{4<#6(s8&ZIFSJ;%KMB|I4@M-q_l&JJK7}mw>6xOlAdHJ z73hk5x>O<;-HE6)6!{boPiY&1=#NJMFG~0Tz}9Uc^s&WlnbsMw`dd@2!n4wH!N%y! z=_7ic-UT(p`^qu;o4oX-znax>_w8>p_mF3dT6tX0Hf9sT9Xo05U6+oQJpRsuPA+?58B7poIEroU= z?|EZD_}$d`#;!=g3!LkgYB-H;N;W^9X8yTfxj{GeN}!W%cU@6cHu<@NarJ@qVh^gX zZ<}-F&ttqxx36iJi}YtHoQB_&f)$tI;YQGT=krwFm;Nul9NM*)xP%R$g-QgE&08jw zuMo@5JH@y3Uy4=^u0VG7#23HgyFW$~!Ckt1&IYtE7L&t$vjVOVn{{S{?!G!-nHl{nsMm3btX;yC!2K$&bAW#OIEq2Z6GbqjOV#>!fAA{*#AIL8`uS zebmE@auq=@)%=*bse!6cro})OQ$Q;JVZeo=mVo)isiEN7V*j#EsnPANqaj(Jm})K~4{!14?9!kPbR^$0`$n|?t*FWlEtYa|=!Wxj zW8{W{@zyuugz8SN-VX@(w6wH6<9v&?e595> z{KE%C_)i*K7YR)+uzQpJ_+cXut?M;>P)SXNHsole3h0fW|7&1=Ni>7?0uG3u1Km7d z2(|hH{a`?Q@QnQpnO#HRjW-q~tWOF1>54SW#W|6J0%9F&h$BFAO3Aq+JMe#hL0Pk` zET(D8GHG#sZS?co&r=e?vdm_xfsbGB9{Uo$lic_e_aFc zj+h^#F|g5du;Tog64oFRUmZyE!AbAa}BV6{?8!ZFPgQumUb@0w?=q3Ze9}ikYxo<)Jrqhn}dIN zqz&rOGNe)y#xyG}8@r$9po_Kh^m{s1+P}?aac%^NyY1}kYKU!uYhkWyB}wK!NJtoK zE4Ci_*+z;Bi>QJ9bBEHq>@nL*N_2$xR7lZU+Gd4G@Cjsi9&+~=`4Y<@mZ}Fv=J)_I z;@8crFdBZ?%G(&7c!&K*Q(tqYW`(Mc4ze?Ti}YJhWPu)Dp*^gU%nY7j{n$o87OtDl zw*c%re`dK@&$3BbgF@R|C8MYqmrDW)ijoDR*ZHh#CzdU4CsG~I6m_l^_v>}%ckh2m zs#IAb1nE#VgS~rB@n2xV@?}LYea7S7^prrWj@uGp-3Hz{)77No|UP4)Nxvdw987GEyT7;}X^z93@x znQCpM5h@E=ki%$~{9#6Frh6+{2pxcE7uJXkdU_><;72#yJEKLg2y&13n9%6OU7M!H z?RHdgS_vhO)yhJ1in^lh!8TFx_d6>k^$X^d)Vj!*&9oezL57wR8vA0JHf7BN138WMtuzlR^>2Tfw>NfwI4@aRR$98e*^kqy8bbmIo72>7bToTK z&uT6AAV3ZP&6EdNU+K_(|D+Bs>!@V9yOhoop28eGoLqN0ROVsnyfB)}y zaX!~}YE}pO2{`h6fMD5%N8bhdG!Eqhpdx?+0@T7ooQi}4hW<|%c3$Mjehcsbe?bv9 zIjsekcM>fHxG_Cj09%!1$N3fD&sHVq+P>Z$Tdtt_C{Ikm@Ix7J_6{@v?tfftdFaWK zVSwpkydUaz2`jYk}Vy5Y{gB-MzfPkH=}$8|2_fUc|xF@ z=bo@i$(=Fjs&P79Yjv4qw7E&wA_3C=jO4-+`a5GldhpTbljg%99hZ2>f*EOm3(!<5 z=X{>m!^qBL0Q5Z2k+Dp|VD>CFquQ(b4&h)r<_cBgBMPj%0Co^%$$4J%o&%@pZmf>w zOLkYgXXn$G+Nf;bFQ+Xfl|%YJ$b0X&rn0qRduD7iVws5z3vgyM(m_Oeb4G;`1Vp4a z1u0SuC6qw09K}c*=`En3^xj)QC4h91E=_|Fl2D|CUf#7s5`xcpPk*0tzTY?hIUzfH zuf6Vd_v7hTR8- zqA78(CvDU)M^T&K+9-SBgx)%^f;TGanSV<45OGGDs4A~I;>c>ogdv|1|Mn=PBSb?+IFqm z+~{COp8Yp}4aA}k`2~RXo#b$qdjLW8>gwv?w%R0S?e9hAX4DFesC*)+Uo~ht&GH2Q zcftAlC9cOc{5_{K7JK-PL zmCIcrfrXBq-ZGse7gvzYu~c!6HW(r`S?p)*{}A0mpGx(Zvh(A{Q2}apWm7NQwWlVo z6mlP?zWMB_KQE&v`XQ=-V^Xnkx}J1E*xi(9WJX(ApGx0t%uHA5%*&QS(GZ<#-p%LUWgHc#P+8y7Wg;CX z(>J;Ff>_2Er+3u_GeoKBx%g>JFh`F)!wfrgjUa~sl_)JvPTRVF0L!snZ%$oX9O&(8 z*GO)ZT^ku*r}#@a`YiWzIW47~y^Y5JLozWpJrC;i zk0k4~O>VbjYjc>=KN%)TD&j?WX2#fF6mE>Y4+}iaI9O3QeCrN!>?AdcojW`+_}W~E zuF^RJ!3uuf9KFH5UQG{WSr5k1IKBuI9e9ra*M*PP2g8(FU>#?1c(0|LT#k4OBKZvQ z1xdK9bf^a$^tH&BtUP7a4nTL*@Gz{s{{?ybE7HB$24i5LnRRSa2ZN&oINSx;;x%w zTkNF)DPd)|T$?(EDqXFWh(~?TP=h#a!l_7*ZICy;g1Pyeu2u_mR8~GlgZ?$U<2~w_ z;pZ%WzcZxU-<-ySiFP5B%|?~5eV9wkEuxwQrwxLB9KvBjSrE0&^12PEv_Igx7`h8| zGBfluI4yF}y|WI{u%t_VLRQgbvhdhzi(__4pe80!Yt)&|qrt+xZ_IfY(vI;2(Ud-I zF4^_@9N{Lr;C3u9p}v_#f_eRRrz_}{I=L!c);}0 zK>;4bS&x$lzlX41BA#@W@H4bMA$4RsxrPsOb@#kR2`L_&JP_@3G5BF2&rEBWoXiD` z52Qk9CduiL?$Xr0V_iQLsKl(Datga877L@)*QAjyTkBspbqc5c;U)#=G-W8jxoeon zHRdxxQVrV5m@@QNRp3@B-1^1zH!v<~k>{q3es~sx29$-{*{N2uCzv7-8n}(>4cfB- zSv5QOpRzHxTD0I+9BgeP1`{4@WasCQ?r#H0VD<@A`OQ-C|rVfHarlQe8Zxp{0%X+M@pU8_-Zny zV#^AnE0og(I38aRx1Gph10Ii@Jb+TW;6jdPYnQY0oyZ+J*5B)j$#ZCv?#-zwTkSI&Zz9VH z2p~S?wM()bY{?x?kki$~7x1jos`zCdO!+0^YeeSkB7v}i&XbKC7<*~vBW~1WJg7++ zBN1BFQ(Y53QocdG&!A2O>0Qf5tRh=0OQUF_eAqiS`uHm~&|_^uVV#6fS*K_X|AaFW!j;jJY z)QMx)a?!KhU>Tm{w<$3+_McVK2j6CHv*f=h)y|gSLn)4Okq(~8IOjr|%izw{X)e6s zaWwG2b(<1Pw$8SavKKWT@8kV73HP8V3*;b+=ff?m{~bzYs~*qYt>Wppv_NaHX4wfF zm2Uj(9H8coti|GuYK5{V&`T{qa_N8BRo!Yj(=3Q_s4SAtX^~w1l}!)gL7Sey+IN3u z8nC-npw`vrEPCLt882H`3#2@+Kn^KnBBz_Ps5cE-Xb5zK7oFkoa_EX8i20y+rZVFh z_OGk5Y$~4C_M{vTrf%VAZT!!zk*4cowl{nV)1vyJ>Z>~ z`W@GJa*X8DoSH9;bzBJ?>X?<*vr33M-C}yocJfMDLGiPi^c!}A?$3-TWOYhW7OJc5 zVwSqB8s$C_FMXp#`I39X>ADPKQB?=~^fo<9F$$({=EI84H)IWRqP=CgsP%(Zj7xci zmKX7}B>IM@&g8_Uz^JaHLLbIcS$5a5aF%E4fWjbZIZAqWD1bqguM|0)c*`-te}elD zjjH(3sB@+BiEY89qlTh3a{(&0a^lCRJVwsAiYLj&nsSB?%2_e8cYNRhg)s`GEa086 z1d`@nsl?$S1Dqm^ZGo=nZR7IUIe&={5%PZ4g5*TFb;Y@MgpiTqBj5*j576!gCL3(^ zOO)9aC?+VdCMzLv7YnLt9h7vESVC@GTqtp1BHUTYP$d`7z$j%%ZNkEzJ7xql0sECPXoNn&e8Y~jU}#cS+;#I z3LeHUNrRf^rDTVPxV1APRyL*>FfpL935sSR(3QB~7OoOB7^)+^2cCH@lI5>^hv1zq zSA;GqeT!6<70c-!Z!Q?xH4$g1I#`%@Ot=dqO^_gET_Dh&apT>@_U&lFB%+HCr z9OM(t;#{}l0nxY0)EEW+CZVg7<@mYY3DqL})V^E6c6Re%sgeWDsCDNtzIRStI_kOd zeZ|^)&lP}?Xu)}*lR?9S<+a-4dYDhlf&C3M!{o8W_*vn<+>L#1mWuWJKu2#4$Hh}*lF3H*%&mP?oFV-~Ozv2I$xU8|0OW{6F$22jHwk$PI51N0OI{A#@AaDG^cQn`v z2x`}+EFCk2AckcFbD#fOk$pu-Rw3zN#1lY74vL2Txr2GM+F`v2z>5K*MH zH5}b|(7TMB%zyTu&r+cx*p?g4o_B6)(@zZgqNXZ04w@dz&=Aq42fUbfx)E@vKNwR- z|D7MRZ3M9L2D?Q!w*5)o`j10OXWqjzW&Rj|QHsju@@x8){5L`pL%%-%Qa;?yPHZhhr%Kv5TEUS3;R56hkx_BpX7={P`BfY>q$?0ip4qtu{Nj)<-s|jd`0gaKia*nOo{cmh>8{fkiEA_?JgT47x04TK_J)b z0cmcviTA|UQOGHQV#7myR;lro!c1S^H^|4} zcO{Ht0|ym`E!P)F8{g#)={C0VAiWSFn=WF$vlcX0bFD`v=;4+4)I{)WlSIy=&5~4!AoS*e2X4e8+`is%G0YNE%-_pgM zWdWKmJZ+X?(V+$kYi`p7^&{-tg9SHBJIdf*X1 zkWsAO%vVYV#qW_vZ{M_|H#X*ZO!P+f<-h8mSG6$V;o(gV=W2K&R__kV^n=JN^8q3% ztIz2tn5NUiVjJ7aK`KLbiv!ZdC`t7BCXO^A#_dsY#fJ)0P%2*vF z7uNKLQaEX0Hu_oelh70yuj}b#ZHhQ(8Y7IDE-dK*42Q_*Z5xpr#yNhK5SzW1_&r=) zCEZ)2pLK&|AAv&P9j+ZkKx%hJ*LrldgP9g{3Gd5lM%p874C3x{CuMgYF6{lb1m7CD z`cci7=CIQbskz1u(hID{j^MZEY3|a*^prNMRNnCJ02?%0Yr<~ijb512@s`-45$1ui z;*Fk4Sz6FrZhKU+w;^@`lQCAFmsH%UmtK(~L-Z8xxty-|vues!!kEycp6#c7R|(H) zR)P8TL(y`iBwM@1u24|GD z5e2V~BaZ9@WeK`pnh;*Ep9L*CtWO(*INIPrW9&qdW$80)-Qs)roV?D|zPIpBmG|Bn ztE}Q0kH3%m;$_Nh+gx;e)y(uL_LttE+M!6L$;rh;~j+y~2Ou zW7w(YS503J@Z?A}iNSsKBaBW2NT=$&J$zcs|H5&9C;2EL2Y-s~kc3g{~3PEqt6X~G`UlOM5djPeKb zACG@K8N*21@;vDN-i>&UQ4MhvulPzPiIK&v|C9K415%8d3XPpPKYeMw%}DB=ee8eN zRgF<%5%R0;_J80fp&JKP;)7Ox8fQ>p8`8=n0v76i>VVXWU}EdBLuOkZ=O0)Urv8O1 z9u3jWPGV+?Zq3rejL_0OD#Sy5BJ}i-*A*q+K06sE>{smoQm6M# z4NZW6m-f>_w`4v2p;kv!+(VL60bMWAe(Vek9?(!Ulh~;ZaB5?V^`Hkt9P*-}A5_f7 zmuA&z**KkzGO_2h0)(CjTWs}G;SHlZ0jKRVT+ML`_NwC@V`Yx}=Q9(JSeS_98}u9? z6$OU^dze=k_wot<^^(sWxv(QK?mB1bQ9Wp#7qD%m(@HKYyrSGAnR4sRpa{+@vb986eOF$v zhGp)#rG!I=?2RoYDKRoT41RwfF_@lOFeA_^k)791xtuOaa-tfTF8e-6W%!I>slQOe zM~0vvHQ*i-_syFpW?PpAXulW=_@LvQ*ZR;`+v((Z|NZ$G$s&t$i^)n9{QlXoyvdR! zp`57Ev&EeAaaTdk6&Q|8sn2#;(F841Ea~7%_tkNrvKtpvPCOL!*ES*I#}^vKN{X!5 z^k!xw4y{Bt`J)eeW7uMCxZ#CIw2zu8k3E+UfC~Mg*O^SlYR;(J!iVw&t&>Pr&P&nh zS)9i+f)A-V2sRtE9==X)OdLaqM+ewjm%g)pfj*2nxuYf2q-n9X#^lG@km9VYACRC~ zik8!Z*6=5O1ONf%Yt1_hG$*-Sv*EOgvr$y_*B1J4zrZkX=9O*9?OP#pZt3S0NgZs# za`Os0E!LgQMKx4hYu;#0EgSXJvS!oPJ-IEGC$cj#c^)>!d5oTxp^1HfQh0Z%Y0Una z*p0dt+9~rbT&>3YkVh6H`umTaCBHs|qsJF!prUVPx@+@L0o|ui20E&8GnWKi{-2ik z|2KzB@)vC07Ux346gvF0a86(-05cxYn7_#OBdv^zz6+}8L^yX^C>?BFVAK4wr?uNf zOV8(J1!pWOa}rpN_%Zt}_CQE17}fXlb264=!rHvW;9N+t2NWiUl))Gp@~8>Xpw+9R zw)j14@`g@TTv1EzH3FIDbc5SFa}mDJzy5~BjWT77>s~1L1wG{jL&9kOd&9l<{@fHi zF~QFKyj}F(N4NI`XcRu(J5>d$Pp0a3w8R(vArLs1?WVJ8@HXR2mv#$h zR!nBCS#E0?)PY567WFbO$TqU(Qh*5EV5IABTcmz1U%H!jYlTL`0?sG z`Ej@u@#F0czH!y*f7qUxpUj<99z=Fcy3&J_?=*R|{5ozebp9>qzIP!7(5p&f zrDoq0fg;(}IlyaoeRo7LsUc>(#J^F856Xf$HRKWI3<$OyVwV77A#zzf+gk^8HYqr? zR=CGr^1rI>K;lJ!n5G|)YWd3T2+Vo|fA~;K?)1#7mcWsHOK)^``9as?dBT@a-?2Q9+C8WMC89g^p- zMY^vvH4J(Tf8M5`Fl%DG+S~W53H$OXVYL9>Fm$hc*Ok*n<@aIBvDKV7UR;2;j&IRB z6U_KS3mG-NHtr|(j%tR&R7B&`-_C=V9A|R>=OuZBI?nT6PUfg$C?B7_31B-Pwh8Jy zJZAmru;Y4|owDsABZYU%9hX-o53q$^6T|7Ihth6Pj&#%${lkXtWPW@jU#0QS;B@)OxEs3t5pWPh z`p+(`z%~pS=Eq+jDa^kEi44&Ayn%~^dQTw-n)xfh`JkoIS?&TdEB@pE1X0D2k&)es zwI4o2(L(koAJTW6R_Fql>cq=4mY1PCd=!WTw6Osc z{b`lb48%+_BYb}Zc{=F{r%XApo|#wpF?=DEblf4si%#puqvAkf}Ohl;G$ zlt{9u7h9(#>r)uL%0&Ay0K%0XwqjGgzYRVhCfSh=&V0$u5SJg8&+R&*Jt|lbO zePBm%5#Hive)IP+AYHeg`GDu9mhsIJppMzHr6heV(P0I9!$BJdS38X!yHgv%vg4oK zh6kuSwatgXR62yau+HJO!0WOZ22n$TzkmSsSr)BU;9K9$e(LbOT%E?}^03Y5ea5=w}iHQQ@TNXP`Y^L$e$Fgwu;e~})-@-WuZWk4nW=!?HdBS=Q0*hLfUPg9BX|PunN=}>n>{`z)zgYvNxCl&yIspPRWcR4?_YeuI2HIWXG5jB1of zXudFe$fad^U^UATsOF7@SCB#&d9B10dp7hv8qPwy>*1V?BP*sxN?x9wnVHY@!>#54 zJ3IAqRMJ4Fm$FJ^zfJSWac7bkwxNB|7f0Hy?bSbex`pEYer(`PQ);V0^W4uyqH##- zAEOrb?&tNLzt*>t}SsMcdYZa+E%IS(p&4!h#En<17wj5t}Rm9o0yla%% z>wyKsE5R1?JHsRg^u;|2`Vx7jz$`qy6?c34Z)7fFcC_i}pckSa_WfZ0Y7aT4`xpmb zfAut6O--@?jz^pXxEbS{d8@GpxT~b5CTI!GvpiGZjJ;`5Tqu?*pyEQ3V*PqNS8?KB;vPSgwo*V;Dxha#ke%~@s|!5lS!an)r!;J zTvxr^+*QV+p@O?7Su20_;@7W1gUUhMWwgm5P>lw$5@Zk3pftduNeH5qx5miFE{iRJ z83pZ;Ce@YtN57+&tDOZpw|(|gUtE~kBP76gM8X_4Z?x~#bNnjfLJwdPU|5*K=6&rw zq0DTWI?IFD<^!9jk#r!Ht!y~Ck?peoWWOKI>~uR?Wk>+6lG}@77HL zTn}+pp6`}Sh}$j3!ibE)3+s=-3&E+7@eyk!#@*|6xP8WX8!zImMZ;c}3!c1gns>{^ zv{C=POl!jF(>i%=1bNMHgQoQ{8P(HpPCdp8@YBX{#ek@~n(usC-<)x=cwjE9I}bas z>w`*TJ+5U!NMpYS>a4gWr#UvAg1vGWnx#!~_e#@}4Jl?cfth=*N35;zDVVJHysTX7 zTGyF)Y~m;jM{9;VWM&LJb`0%H>uPkBFnFHyYJWrehnm9ETzl@&xbY3NRBvK3T;g+LUxKYP*C{?V4PUDGp=(+O2i|(?;)Rjmx4Y65`uTZJO*jt&$|HEu#iTWnLps4hcrX zJ3(dm9DNGH_=9!#geLuUvh<_P4dQoGI7dkDEb=tj2_^lA;tGDV3ujL9GY8b|8dJ#kAty!%oh)=X%bSUI^rlsO3o>0 zQ$+lf0mp{j?9aAPkMF)64A}q{=_^ip1N}cL%>VpJ!G0caD@!{tU}h$0zSc|ZEV)B6 zTp6fvpBbsCdE~w~+ljFf?K%)*2n}YJMD~!tY$=@NVty1D)wj_8)ayzHgp_(R*b7E- zN%z}>UUYkCfGcc_(OG^}EEG%^Yyp#z-w1U;Q@eUkM6rEgM+@ zM>a~tk;K>)Kwui#@qk{Wl;D@DoZg(DXxRb{JL`L1nFX0DS}&}uO*QPeqaaL}Of-lh z+$(#L7d2L+T?E-E&t21DJ_-&BGw<%9n)B5i{h2+Y=3tjF_*C=DCpw-pG4zoexqI)~ zLUNC|0Yz@FOLz!BV)_+eKr4uFg0XhxlGIs;%3@Pv@q_ewDjqP6$|Ncd1+Wy3yH+a{ zHN}i)X>wVcNFz=&lZrsmBP8O#k zfS7C^&EX0{8Rt2cs(@1ax`bI&V`VmyDeC`0q|a^tmP74`O!Q;v%&oz~{+!b5d}IrgP3$xhv6Q??wd zuNE$f_xty4Yr2K9S153osU%M6PX4mK+pFohX4XKtdzXWu}&R?qWC=r}I@(m|G} zRah;%(ACbZ|7B(M`QX|(xj56=7dQbw;!`eSuM0L!Uf3gnNp50+?jM2B!U> zHh;E#S}I3Wh7W-@7bV>WB?^^oQXV7z!+>)B)7|evx}VFpKtWP7_QuBThS&*=Ri~%~ zx_L3~j*hek_62_JK<$9>NSLm~OBnIHN%?o!-OZQ|e4wN2Z67DkC3f$_rUrCjuDUT| zO93yR7_iXmN6Z)IwVJI708?lNe_u{2I+68b#uz1jUo1*3(!jK%waK`&m%MjSF9oaR z8t=&M+M{l%aLT>6$En~QFV5b3!l-Lf77TjRUOwmjx_j~8LY@*~w1T(unQn=C5 zGp{2Jit5)M2JWQWlkEDSV-SFMtSpdA&dYdUv^|aXFDs;}hO;Nz{`mX5_rFu`!v^FS$)DB^yuc?G1j& zEXtN@OxiBd6h;H^@>=JLj1Xf7xPQw_Bs z3f2XF_~cA2JDqTyFtCORmf4jt9dg~ZYf<{VgJ*OyMffEC`hG??2ly*(Q-{WM zl}^OI1kvkx7qN=M`7zN`nA`fA)JGoI^AU2|SE-ksa_<=8un+s1Qjc3KYXq}ZB;{4a zzT=lM;hJ4BAOn6N%>_!XD>7-@(q`y3TLOH;>DHuJJ`H54bN73m4?1_X-jB6)_BAC_ z5M;v6=rMDQ|NSW0Q|p)RI;Hf;_ZD&;;_i{HN0$oZOu#8`yj7?h`El^J7h4qKSQ-$! z&T3=^HMCd5+s5;S%!&5;+zA@OZDsFa6p8d7M=r#6=r~B>8oWZNFGx$s!tpP@TAAq0 zRMcH^dFR^dx+}rS<$FGrlw{6N#a?fwfEH&P&#U z>ZgAwS-vx`(HU$%?>u6+UimTrIB?{l2#EN1=JU?w!2{fK6sa~wocM6*=G1KZu5TUfK@@d?NLaMm6&`= zcV+MWTtsZfJIat8k=r2yJLu3KD|b9=c5ywJ~6mZaj_et zG~6Ol6+>&X-1%q_#BQ-NuI(yxD!{)ylkYFg3}OB+@d(%;03ePuMRV+_ClCl=m~4NU zYZDu7m?uaXS_@8n`0#;7NWjX=dyN6is!5Dz)X_$0W-J(66c;JwGWQ$m_U*cI&Tn?o zfO-IW3!1v10~E}q1atkS0b6Qh&6-^_+kN_r1aObtM{HHFzeIQKJikg)7i69(Kw+3I zX@hvQIy)?iAUiBg^K&y*xQT!J#?)Bz&~RPzg~py>Xh6K-o(Q8j2#h-(uG2`_{!EQ_ z{&ql=kPFzo!JnRE0j6jDPO!uAZ3Q$_Fs%>|07hRRN+(cARic2XN(8tmBXr_1IyD*$ zrlc#-S0f z!I~9q(yC;of(L5-v$c(Ei485|7M3oaIzvV&=o?-)x&2Kt8_iY%gJX=1<$-Mjrlww3 ziu)1FNdg?DP?-1n+ae)D03wpwB;-oi_qna&)dB7Hb%3-xsDq=DY@M}w)KV(=E85FD zn$+(2a=`@aj&u$D?vdr%K>mcSLwb72^joybkG+8uX=I+@=9Cyi!t@LnvH)JHG=#au zr-%->ac2Q*l{9@S&BOihn|PlUuKk4u2(e(Bc8fkILcCz@?G|nYBPS3*mut0e1Z2O+ z+v?GQV8%Jk4au|7w|Mjd-=nTW3Q-gUAcO?b$aL*5f826D+n*>67wXGhJ=pqL*j0(U zsi)~z2r(ris=`3cR&$7f>10u9ZFNn2%IVxoKa*!0i!WlRM+@becR#>_smA)t+W@kj zN&YQ$p#bU;Fk){c#ln;**EIWhL04npX0{)4@JmA@W-nX>v#HZ~N z$`-QCfy#&EFIslU;^o3svqYoQJ&O7Ow^qZiEfgC}y0@?L3yhA41&-9laBAblVNMhh zjE0^D)0hDwkB%Va6UcEKE{em=Qf`*)Y?y6M*flBR6b4||NXDiHGo!~IlAw9S07Cn_ z1s&a2@J%}nnVS9q#!vRNS$fchck3Pj@W~VMayi-EB3tRRy4a(YXQ-zJMLC1q0U9iL zd~gMgi3{Jklg2Si4}kFlOd|wgb6#HM;zW%>w(y%*du$=l3gBXb#%>%mxyXRmxYoX;ikg6@Y^RjI$(gmNdu4XW%?N6TOgua=JO{G`8g;T^*>?TjM!eG(Ar%T`EBWBAlkf2>+lv72ZnfnP1GY z-U6fTOM8I+(sSpWn$Or|ghkh%b+}I-aV!WBKFHk!ilfdsP%=`=2zw9PzsA`B8xK1j zC5U&ugu14yygt{_oV+VhCPgCNfOGI%Z>vm&~{a+_XMxj$rp?JL2cE&+sX458_jR7Y3;4s~bh-@Wa=Q3BZ+d{nE}~ z^39kt;nBsKW@mywrGW}^^0Q|XH!cPNC5Qb<50$`#sL}SgftY6=y@=rr(>#7DNQP1s+ z&ur3d3-Ju4xNmV7JP<+%lOcuAD*0gaqshy8Kkg+=HXL zqC0IM;AD7gyP|=p&0)LOuHl%MmEPZ?MsLZZ24;m&*uG$Lbf-{gEM$Gu4F@*b?EEv` z0lW{|@gO+9XcCAB{gLA_qUIcSTj-~>!xoeXBw0j+zj)fPc*k;P^`ZzBc}yS2n}-l< zy?`wCnb0y%B9M$0Ihs3l61WI5V*6u&C`*X;o)td+BRy8f#wUQd6rSjF)A8xRcpdf^ z9TC8X?yvCbEoY)r1(LJzI$1`GMAvm8pl?Gpl3tJwnav+Wb^)z#sguVa1=wpNfft^! zplc!117r^#B06l9TeHF;#);39`^O$t^xGveVGU z`@>3_j_~^YHXVpWE9F7Ha%laB1EP;V#jpdat&jBg*FaS#r=QA<6M${2O+0SdLtG(9 zv=~=5s^$XC6 z8*1%Ej#=9&v@9(5;<(O%^^`}>V#}E~BSDzg4a`pf!xEI~zxN=YJ}e<&J=Sr=z4e^oRV~)f=_icat7c=X z{lqL>zR*QVu#QpFSZzU{LjDb}8Oc<~Y5!Z?MMzBlY-!rwmX#J)u4TX<2SXpg#9A5@ za~qOn=)+E=m+X<3Z3MDJ`JgQFfX$%~CHzu4YL?%NrdP;Hqi%XYoO`wNpn42)Y~8+q z@bqeQWWt3xlXKMA!ot&Sgt=4Vw~>x>C;DHqVT}U{CmlKE{Sqq9Tr=TJ5e{nP-_Agr zxmJUL#>wpa+ahyzTOvDc9HWh&7B*w3B*#+O-N-0i7oE)E5uw#W+|;Kipt$aM%z0JF z`B`rSM+p7#&3+y35%uT)1{7`u#Is#TRw5yEZ0a|M80c7thYz^gCnOiodY?gjNvPN< z4QyyY?ks}xcl)17)1R+PP*AYR^9~dS;|QA>!pRRR0IYpS;LgLh<1FI`K?k$WB9ozrR0-$pb|N z&V7z`WfA~?LWA5tO38Z(pw$Z%-c@2z2*gu`4#Pu?XW7P|BaJG%L+W!bbNTqW0eE&_ zfZlk!`Wl}2Sr!;FU@rD#$2{7()ay5`$Vx3OCR6X*5C~g>O-sou0w85=A|FEpT(i`AGJh;^V%E@3M>k$D`)jh$ln$FoOhjbr+~hfm_Fu;8PZXLLxF){gK!HTD95h~Q(zR|v%mW3yeW*z&oggN5q&ZB@#iytYd=|8j-0Wug+5w%=HS|mqj z`#>bwbu4bc{WCDk!HbSMvU3wntBKKiWZ9ygw)1o9)#~C5>!SP0vS5gHbAc0ES`-%g zu0C=M(xFas+ZE~x81c;4Gz%z`yUO}sW6Mg@?G|$~2LoNKt%UJj9uDmqSVv@T4^^!& zKwfN`E{;lkC|y;zL>}isd+ac30tEd4IzfLT7x^cdLqe%39yjLpno-Joj3?4Hr;@Y$ z+jV{)x%3+sV{2*|Gbpe-uS+6Mwq52+jwZ)$ul1su@B~x@_P#%gRJZdo7%fp5^t(W@ zmrZfB-`|#Wr_w#W=;&lQ&eLb`#=z7Hr7muD!j+9BJ9QsiIPb`Zg0-SIYucnc7D>-b zA5KNST%SG1H=61am6mA5Cg*yo*Y6jOmt6t&4tg1+Cgfz-?zODrd^DXbhk9hwzR4H0 zgIa7rnE0gYY?kwG{o$B5WS1*!*kMw{j0W}!cTt7l=gC~o;XyYI)i%-Fa-Eu%+_e+E zE=?+xoMqF!Eq@79>wHj^==}M;Z(ZFXvl--xt})N+4o&HL`8x)UPQUk%=`6{Oyf2rp zE!6ke`@x}>jo~B^=%#BABe8TJkUpqXD&QlR456#dF12Du1v(9X(H3m%6zOR*Yc^ra zls#hqy21v5zJkL(>Rb)GGyBIIxyHGRV#YYE*Nz*LSC)`ir_uH_35S7mTPd>)TWr^= zoJ7g*fuChTicww2`_^V+?0YaD8yHvG%Lalzx7sld9xp#g#c}qy1M}U|BB`n2ktsv2 z0D2F2cxJmMTR3Lt@war6=FdMGk`i?y3stT=f|@c~T=aD+_^T@ucUtz00}0eOFc4({ z(Jt4fWC4nyt4U?Nd_#Sss8Uu%mxr)xvE?J=fE~_-qP@ceJ#NQL=A7&vRBDRT z5}WY2LSKlzq5p>pJ^6eW1$qYU{;wAqm}n3}fPDXlDcnv<>o%^7(~T3)4d zUh$|nu^thmYCg2H*1W^u?RU01vK9P4M#p=L zSaL+$)5`Hrq&w42uKj47FlQK|=9@P71wGTPnyzI<%=~O9g}vF39aWXYjjnXAD*t_S z8@<9OTN>08oUD+ZAS!3~wxK{7>=obM;O-Yabv;hb;X=+HQXeWB+!xL?gONaAAW-h~ zGX=(e0Eh527?cIH8yA`~UF z9g{vBs;ivx6W!l|=<_kxE`#C-3-0(gp7!?02;#ftqQo2HIpGJ=VC#>NIQyPI%MRCd3zx^F*hQs-%aTGaT=2vk#% znL(Qy+8G)1qzhBK{N)p)p%CKW4K5@BfFG_XD<$D7t+&8?W~mpD$FHis@8^lsxSIi^ zJOtB%qR8XLuMv8xH1Y`u9=9&diFbg!V0zgjkcnfZhivV(x*(=!LcN_MpHT3G;urdU zA*NfvwX>)>11d9fR(sl!;Aq)+L4uY*V&XP^v($<*S2Q@h>l-m8HZ7GiK=b@n3hst! z2e586UU8BYN3n;66T?FiLK4RXywqgBqi2AiO(vF)C+*jDS3cpT;08KJD%E9Ste+O( z>)^w;F!KAwkA%qpv=9d<@(x0Z&KXs)kj3WHbSv$j2|*^e?`*>^)kaM%XH5y}j#)G(9TPrXzP~ zg-cf0$EY4`9)LwZY?bbm5`qr|Gq7Ic<1p@|O1|LE%h{7rPUi+-+zAg-xh`Sm1sEhI zR5^ZX2f1Tb=5^1TS%dP<$8fbJJLMB`{M^S|+47P=Q8A$D(s_On|^-a z0AEex?~LA6pp1Ze0K?L>{6zRbhh9e-3$HzuPehS1#)9@kjK<@QW1Z1yym5n!Zsv`9 zV6-p)yS@f)1aZ+)8h}(W9#I{R0 z<`hUPwki4XiU=@xd~?9=h%rd)^%e*$z{-#^+qR181HmYmY45RwlkxNR~$yl4ywcjTV1}j~H@vK(N77 zjAThe>9cWOg!3d}W$o6m+ivmL7Nj#@x`Ty!P8m%-Y?82WC>LpLs03#=FuWjAin~O*P#IvLykl)#b_YQj6Kg0+u~?l`s&jpM+mU$92n|iW11b z6d71J)^n8Q8lY;YQ){@hI3U@GFv}g8cPecvL{~@LSXKR6TRbefEZqm+z&rILgN6s* zRpTr$i)mfM|C7}J*HqQk1NST3<(B3kCK8f1_LZ-O{ScVE!mL>WBbPu*{r~$kyp>

    tVY_bGK6a{1I=}d!@cSn80z%1y#ZT5v^r47K;Qi* z2%B0rCy>geCi#ydrMji_zR-AsNju;7;qlxg{0u2b7lxb)Y;qDQZF2rSsJ94=Xj9d*|3pLOuw1wTA5?jGj+@ECYy z0G9>9ETFA;a@Nb#E7vM>@U&So2kL``R%cW;tgMAy;i>nsx$+o_{td>SK8}U4B?a}y zn%8Kq#YjfpABHO%E?>T5&tknj<;@|UyPhOedcMD{a8yVpvlZtRF1ak8k;h?E-rFMA zIgmb3^#*oCUd5lqp!8S9jO!*IFv`+)r`SbDNupaLcFk!KM)!!V^W<^Jk#x42+zFRkxECCF>?e)hw493{dXdByX%Pbmu|j4btt<%TJ9tYaPM#vo7wk^vf-> zt}h*W*}UKZvHj=}k~!LaR$whDFYXO4&1%RxzRY92;}DDU`V~vE!B0z=+o9F{P7J?S zMX_Y%pn!U!1d7!CTvaEp3smT!O5J9I$ynY6=~uDNHn_4|VF&FDD~)EeGA*`>|D1{O zA^^TKxOh0`TRPq81P}XM^>QFkR+L5iTbsm|)YwT3a3adpW;S=;tSc$e^Xyt7dz^!-?+`cH6 ztreUI58;qNL&F+8nwmd{=*Me@%NB~oW+W~p(E>S#75K0#Rkb5BQ~O@@>ctE?Xm`p) z%3o@o@j$kOxG4*_6lzmhB-?xS1DIaoZoX6#O$@7VY#A(@Rfe&pFA`HBjcWo03v^Q<+ArMi@Nfk zQ@16(C0S9m2s|%IP49{Lx`@$$rfLJt{a_^3^ofjYF!~6-^hpeA&}V9U-~_w$xnrnC zGW-b7H)QuPo;Wt?S4)W=VI7@@9=G+?XASGNQRlo`j{AdQElniXYSy1L#<*}aRexGo z%67^UU4-s=Y8xZMbkZsBxy3dmUGi8_B%oF{MbBz7*2pvuYdgG!ej5rC?O?Pp zZ$wamDE_-Gcu?hf`}SpyJ`p~Pmcsv5S9r5Of*vL-FSkV}h=93fyH*BBO#KZ!W^doy z`HI!LbY|w?o<;Swyl*w-b;QRzwTr|!adNc2e5VPHTozMn&KNViI{5jltoZ zE(}8=N|(@q5pe=;ZZ8;q=8*NHJPVE%_}2VTA1?E+=iI=431(~6xQm6Us|p~&akFp_ z96N1ACWoPwv zxSa04Gl!0olu-y%j@hZ}(C790wLZxX9K5irF7D|hf%Q6z@40CXa6_C|1elpruX||L z^LV$D%Ll1>u?AE#1{FRZGEkbfkoIkX%A)W-r1@4&T^Qbip?=QdBep2#v9-$x=d2c@ z+5{2h+j?#p^x|07E^7LKfpoBRjaHcC=NLC#mb2AH858`AN2VILM8>WUgR_D{IbPJ> znB_T8(OYckjbxcemWwkqHELQByJ=)<^V|s?V^nYNPsz16Ae?(u;`6!U*ke;$ZQssw z4X%v77ijZrLTUfSDQ16d=KyWWBw4Z`@isQ^e~Xn2j02Vc7P#dZRFYD|m>zo4dCTOo zE!4_?E$pp`d3Y4$J_P-G9L6G9c7tLm-euQ&1JhMxS8QkTa`KjO8IkabnR^f6g`8;) zNI;PqNpxNEEd6!M!T9hpuqY?J(v5SaMJxpCRGAdojdwh!On0=+oJOAHxCDK$H`fVr z5vE4> z1wECGYFUJBfB88sZ**u}QVp#gg&b>$%9NVUig%(IG^4&{_R4N@7?R%Sl|umoX53AkfsqDV&3@a@`@R zoM_B0XBbz$F~(tB#a26@=CbYU#J(io(@%2rG*w%=_KLAY7sWTxv-J6xTaRWYt#Tt2 z%K%&cEf*LJSE^+Cek{&ANWFlHzl}~itF@r7h9msf3_JsUEw4w5LAkaEqX!YJF&Kkp zY-lLUn06-GHX?j}_Un0PD}tw)QvFYd`?h}3|9{YC*VlWO2Z@rI%jcKZW~P60|HS7I zYT|}_sxyB;$dp^VuEN~1;7Nv-vSX8VC=Yt>@&$As|0=}&}Hho%C;{v#uulplvYF~PkfRcHtFYfniq z*ogU8uI$RPKNgZssAHNAQ`8Rv0OU6K9N>ib!W^{?M9%e;m z3VgV<4lVw!0OR}ID!P>Km$7#%@vZe}&jwTFvGbT!9uegPJX*A}I9*<0&}%W(u54vR9 zwC}dE9K3nLG1HVy{Vq&hPI>Ie`g)(|Hz&5k=ay@nJXHHCrn$(gmLYm$#;dRExE&ql zKh@~lDB4^tkuUrugS#$T%_twPJTwY#=K48`aG*O0-<-J%03Vsptm`_DNZge&j{d6s!#mPpGMifQzd5nOlQX(5ca$WTLyRwMa-(TzNrPC<>e~TsEW*w zX=+>Ms;Ppq-+SmrA(9jGr#Djk%m<}ycjn_{y@4sXF4ZZiow#WYnhKd$1YR{Dv^|{I ztr_mVK3xU{yuV{?A27GH{U`Wg#)$^eVlB^iC|JOr)uFBt$`alU_qq0!WwMLFo_zQbG$!-r745ojLc+ zn{)2md*0{$351=!*Iw(_f8Sro{&;1uj!@+T<0$>v#q~*i zJZbMF)TLEX9Jo%wbu{yq%1&6cUDPe|6?bhpl#{t%j5vi_AR3RQ7pawIJ^AK&U5yu+ zNGmJTwd!ppACJ#}YN|z2)@q9i$jX%hS!FhZ$6`&00FT=(-ObzOez-j2D1^sFWQwMh z{Sq^J+QQgDLvj%e6ZH|G*=nM8sP%{L1Z7V&PC%7|_ve5*MlXOy6It~lP541qy*_qQ zcekmZvXJJ%zNRNX7NiJAJ1Z)_+xz_ND08YMe+*)En~RGF6KY?uRL2`cK29`=F3tRC zNL#5*y8$b*LOroZoq7dJ^FQO)m#S2@sxeLU2|1A#l@YgZqA+f8U!S$p=h!~u*Jzo$ z87N23>%l=Dxk_snt1gtpSdFu!q68iio*{pI280u1lPCb&LH?)wvszcuQR1^TfQ38$ zJ;cK0?Dd6MxUPVOOE`?kKM%8T8OO_6z`j+nrOABd#S|dm5&;318zSKD1q9qzQ+s_C zWX_B9nTy<#_Va%FV60|_hx%rg{W~TE*QC`0Ca_E!I}jHYDw=U8*Sd|Ooi}g6Z&}Yo z%rk9mH6M#Ts?kIGZM$iY!qK?gDxz8H(L#v{?&XgC=4H#EhMExh8T-e|y~e-!2W~*X_1?Go2K4-F+|$2u zD)a#Y*Ti12A|e??Xc=b$oXMV^o|BbHexOJminB8|Ht=#Me`DFPv6;b%^Z(ENq^^pZ z=`Awy3H*8TQ)R%RKMFt6XoKCoq^2*24s&eCKp;j_mzH`n`;8I+zvgd{D%^++&Fp8epxwgDXt%P?GZxSLhR zK4jtP0zGekKK|Lwig|1EyEWBhb%6S$Yo!;lEa3q)Zl>0WvMAoi8_Fi35Z{yy(Qg}h z$asQsj`Bd@OtZMFc(oMTWpxiB0!XRz11RqP7y7@s3b?U(|7z^%^td8%QtGm;udR%v zXQ|R^>%&GvZp+T0TBYtc-zv{WGwI);lfO11IPd}6HzWQq+$%Wh`pS(hMnqG)pdOc( zEPfIDr2M2vzw#>_d;;NvYpVS{yVJ5FY52|cT6NHYY=I6<7NJT(fsvsalKVnBNvEnCn%HiuEhV#Y8~nzS zS}pAt<)!JUbO}}dYGc_g$R#Za8msx(cEGU(h?Ek*vGqQV4I-=f1)bJG5d%g=W78&B zuW@Jd?Dk_UImyoY8bML!P8wgaa{QAg;wq>en2M;^d0P{;+ z-{exLNOel&@$zbFdYj&J4OK(&x`rx65RYd(X~|e*+cHf*uCWe`Fz=!K6zHmuMlLQB z3+{U{W0m_;JNKky3EHWo>t`-;Fj)gwJNj!h$N9~7_W*Vy_m~c(-M%ZRD*uhwx%&nx*i$5ssR`;B{CvZ6#C3=eP9{`ebY$`5!RSiUwm)+zUWgey<4iTQD}Jb| zf1q#JofAUcx@m~4e(1XJ+H?%ml3qj-XHqeNy=^x zd^V*s?jNGMdJN?xzYdGS``9aR1G`MZ4O9)m|~ha!%a#GEZr9}p0; zRz}t9P6*`?dEPd$dB0!@+PnUigJeF!h}n%DH8}ecPXf8tjk7p(2}J;i*$tUl^^m3G z8&@)DJ0b%VvuwypE@oMs%&+o9g6mtS^xNN;l$5+k3L+BWVKW=ozW;NG#)kR*@_UAt zz5n=S#^K-g7~nI&r8r zQ_^AZ``dmiq%QVzpnluWcgx0d0rC1MerSn{!U`@hRVN(croZtgSc-6g@eu2K5u%3q zf}s!VTL;8W1`WP0=|d%;LG2nx&nbEwpFO=HkYCKvo%_X|p}EV-gj8X}S}i`x-46%6 zR3e9N4tB?`M@!PT(ebuG1Q9<)o1cG1JhEfbtvD;Bu+Bi{kgNn4okD-2Nmauf6RQjp zn*-6~%8v8eUD<9QT1Q+QrOB6qZ=kIF)}5i;?$G7_M@1xSO^G-MaktOi5;d})-r8^D zHn$TJXO=4Ijpd4Mc-Voq1(Ce@TgG0YQF^O+hS+~qqrVl3BE&-Bl zkHO2A)a{ieBhnn5EKAMb0T+YSUZez&Z1ZKzGODCPhTc^BuD&7bG94ERaofMKk`;&; z?V=1SO{AvO*`P6Y*^j8!OGnrmCeVPr=MjYz~&p!6WP){eHDmqZA1_R${^4V(ki z)9aL5?{&&;IT!(jSo9nC4zdx}`raqfR+5*>NNf8@v~1;3PeI+4>C7;k{eqI?%<|E| zl1KJ$AMZ@*PcN|5osrZ)RfHO#^$6TD)hvnnKM%9fNw`bg9ts@B@Y{Y#MJj@!MMAQv z^EkuitqL=FsVBJi@%yDqF1f!%_a~t(JmO})>k04=vd-5S;BBuuAM_;f6NtU+o*oO> zZAD4Gvh$mT7dg&g;T|fK3lpt=W&VPE|AuHfx`p3kDl|9BO(B}A=84l{(qdYf4cGoQ zu`c&Kw4^iDJvfuAZaAjk!7Dudc|jc4rbbSpk2PGhAPW#^zuCWB2FGWQ$S}6^AAbD9 z?gq12zP`>sJs4W52MT^FcQrU4&$s{lN5yye7 zlEKDBW<|-nbG;V}%-R`28#<64$-r6nbv)aK^$s+nq$dy&tTg``U6MjILe z-QNM+I9<4DD;AN0LwM7)#c=kvNikE|F9keJgaXvYbq!jWe&X1|1fh}R1H-tJ@YiDu=EWU zYXf)ju5XL?ETA=wvQmK=?O*T(u-xgWC-$B$pE4fGr}oTbW;R?cP;Fei(EaI*itT}P zd^HoW#taN48d#+5Cwpe}eL705k8fDIT8|KAA9dY_@y~i+P;bVuXQxCJUp&fhOtOEh zb+0lP+Z-Pu}s=jt1Jjg z7NU-__p$jw)ZFs%gLd8NgC&DA=gm5jg3-Yrx+b1uovaTW|4PjbE(nUV8*AuwR;M0W zb@4HyXf`7+&YsAozTO@I6dZ&Gklq3q@btwdKGP@A992d1Y2mae&#D1rUHruI6>-niJr?9ZM(VKK~Q&Li$fPOc}e zMOGPkKj{_UDN@xSkpoy2)T0++1&mu(_y{sDcry%bKt{=D?Y;Jj$n+(dbQIDlwk}FE zIYGp5GnfV-nTJ$3HF^=zFk{W5+ulPUKWwlfvfK5i zjbbu54cFC5%N=+33qX-rc7-8NUt*SMQ>}j*CgLj zNaOJdk%(v7O?zswp_W=ct;ILoM;3<}b%p>U);+T|kc>_hz#~|4;aG)V~<6KyL zsZQjUrW`W!`LU`&N$iH^&~m(=qNlTloBH$PRn%%1ksEIpVuib($2{ycMC)Bb)psSx zoFj|UbgEw`>Z$;4MP82gMei*!iJfL#(ku0@YHjzkKn@eO0xa&57m1E&;SuVQU@PM_ zyxa6a!iUh}<4&C?%7&%tq9v9f-fJDy`cB`^w+ENFy_bU@`8v*!O%iz!`R#ctr?g?j%2%V*jD?6*Q0{g+;^wN zUD$E^?cFwB#ZY^?wwYLF_?qM%`A-*oT&4%kWxNRgk-RR&BTix{WbQ^MpZQO<`VA)c zB0m8FgJND#M*32n->*m3ttk0Jd1t0|%%$g7X&KXkcZEjAW`hSL3LHj*FtbAfg4{>qfm-e@Pd|#Lw zD=8}{Cr*!X0c zK=%nOS~$hDZ3~@)%ed){yx{$dUjrG?6I7i`Z|m=G*Ri@ozPg?S*!kV90+xbe3RO?S zD*e7EvnYB|4|g7S`i(cv{+#o`$A%15`v!*J{rzh-MEe0feKg7zq?U=SO*#j+%W3*N zOJVJg$tyTjm%c>q3(P}EPyX5xj9FWEkM3WbR2h6nb>}VEmhNyPrG&3+_s8u6ypyZ7 z-`k~BZREWUKh2c()TCgn^1UhJj{=lOG5v+j9xG-bbMyqv?mHk%ce3k`#WhxeuBBGz3n zru)5=1Hqd_X?lqLyBMbiB(G*2$Abm z=mnU&WJz=pk(%=>n0yOwfzu-(4))rNiLcM8wOM#a|6AX7!&bdeEn$bLQLg z5UyJWuXsPNp6dYg-?qUw709qX8@nk%=Mzh6N_Czo2R}A2S1qIKL%bRFij~kw_L8o6 zqrPj7##m+kTRCzyO;^R!?5aZvZ{zBM6UHpicd2h4A;S)Tz0Mbrtib3ZYb!yexRbm+ z>CX{8^=wtXO_!PvHN`o-3C_OG*FFA*kjii6c}6VyArgDRQ>DO&AK6yT>lw94=9yXn zF_Rg9zK?9|Rr#V>Jv7(+Z*n!hM(bhdw;|%j2({W4r@WIL^}fbmf9qs5I3+g!x%SP5 zOMiM~H>qvn3J9vhHtU@lqJjiGO`f^P}k+Uv;TM_xS{O#3p|@ zQ?FmhlDZ9-(=FMf>9rWZ?L)(N!1n0?XXURi$ogyVkMahteQIUO%+uGA0`tfKhFx`& z|5oS;^k1@MrY|+P^n0xhpLcw8r&5}^bRj-?Om7*Oxqw7qq{p@CKKz7_j?az+sp(6R z8<#js_`<(4eK7Bu>0>qVz6*`!od0?A_b5oxXU?%8ix+3-{iLgb!g%aH9$KR6uX%vU z=ptmLs@p(}1NN}Mu`O@q8s^!PWugLMfo-}?IcMhY4v={l@VrM}ux@C$q4 zy^pX&KY404&&tZtPAbxK0P_WwI-X5V;!I2D99qL=CwK6WOoH9JHho9`Dg%_b9lt`C zw5p{unL=ud9A5-xt*2UV35}k4D+=(v!xk0@rd33R@4C1N)`_69*vxFq+Dr&|r=Od4 z4EC?Rf4lf<>`mD6_C&7bFE!goLz(t$g4azIf@_Mpj7Ii~Q(wzuq8v}O+4n_RA-MC^ zJiC0+E?%74jcO$&p}lHGyJOkfCn}vDrDNiIP%*XEO0I_{2>0&Jf0^}c(4UM@-@X3r z_NXAe&i(c=?(=cTWl~F#>sqxEOULj*=TgM3*NO>6wR!i#tOk=Zt9{kp0~U(GImtjA zFFKXF;7?VXUCCb&+{CyLU*u6~yRrV+L}MqB91XTMb(ym}T+YVgS5#6dL(C+m7Tj(g zuGm!MCp*O;voJ9K8@YMY7TC@dCpDN!>y?ISe*%-3by*WxDTqnY+zAIYov3yrwcLqV z_m}utY}eJz8Tu$qRwmdv3aU~8ZJ%6LC#<`Z3kqo#w;i_jfIwfO4`P&zzi19E?U2wT z5P}zUzxGp3;H2K&BDR>jGxZM@`g*_^Ttb6VzYV$0+;f^bOXuXX4j94G*6M>UuCMvJ#V}diGIx z6f-R;Gpw~kepG~M4-^WT?VOsP20mKiRF!p+*{2yx5%cAumbd$%Z5MQVtt29WdY-ih z>6xloK4ZA05=Y2@sVqF+wmAN@SEl%%vAG)8l=cmKRrVM48EIc*9p zWpKPlX;#)O@aP1b)Wg)n!i3ny1f5%X*M^ibZ0+n`sBd|@A3CvdxfQkN+mI6AZJJ7L zyZ0ITQV`SK`H};&Z9v`8=8!AkP=cBwp?eO{l7mX7ZGZyG2A6_u0#v^(P)*c+z~}?t z3M$K(jzbP9R6(-|grT7?K!v-p9wmdoLA@F4{-f|^&yBJS1p1sA7fw3Av(y@wfg` z%vgsd*2FSOjU7gJGPf-p#0kYmbC}@+?%!N_)3A+6^-;yhqZ!PyRtCqbM36e~iL%;d zomt`UHaA&|&OuiUAQz4hjDQUUJ?Q0dfXAMns(F#}W0B&Nc<~jA&l&8>qqW`TbyHeM zyY$c=jkXWMQ|iHMisF=VHHSHAO*glR^qjTglfObj#lQJM*m6r=5D;MDWOTiYFJQBo zjqJWs2P6y9+u8JvrwHrM^X+1V*}=$9@q*YccVZC6CPIB{5)|AOlHH*`Sj(L*gM>j?JNDdj=6f`J(qheN4RZz3}nhuhe%BzDVmw0n-`ZBC(o=a$eyS7NXc&YP#> z;Y0uNrxebXsi-gQy=z(-?X!;tUw7?rB#h=uMHTZ&-TAzCST|?VC4X2%=C_$A4X@vX zOb?|7D>KV0-QvDlAVK}eA%nT=z$sP2k4YM4M<5+Q)MH%;s(-&9D)a((sccAc$?RWf z(?$wx+aBQ+JoQ@?(f*5kY?@u>WRLPC(rz&~`>P7rAA=6hJSnl=dZv$G^T!@DbA`{d zKq~DE+8xm!sym`aj;QM?s2KDNksGu$@p2hapk5Y9p}&Wdg0s`p)6F$SGo=d^I@@-i zwJ&dm&}}E#-`VT;u|J73&vSk}(%kO+>-~}iU;CRQ?}AT`HJo;T@_tB$%-e`)j;T_`h=KWA@wDzO?>FlMw-6`K!aoa6Y@>67zmu+3(3F}O(`I4*pL$xFYHzD5pyi)wckG>W)eLgrUb|-&5iMW( zVz;H*EMUQMXW=fSk#__#HM;7p4uYrd>(iZ&+H68Uqn2`Oz~>AqJKW%UoRjld@Xxw6 z3u14)v()WZukZ>DwgtSeTPu)xB%G z%6#DyfN#{qLU38uhD8W2s}&UTDfs+27 z1?e{OkUQGr@KT^Yrdr^X((T7_J7zXFjDdKP9?qu^Kx7s-=KkD`bR}c#3ezT74_&Q*;n`n9;~nN z$H&&%6iD1ki23fw0ktpeiIG`55tZZ60t!6=#(Xl(?K)=hQ3J4=hWlqDC!&#FL{DyA ztRZy=bd4>D%Ck4EPUSV%V26ZTE=VIOvsN7`D>B38fH!i}Q2t?%bkXY23a%dhbLQG& zSECfUZsS=ZwgFt8S31RTniJW5ou>V{SGqBMb<3mAY(R}-J_pW={@Dm{VHHlI_ zb1#aPC>94PL*fq7_T4nrJSs+iO@)FX;3Ub?4n0dI6`D>72wDU6)3Nh7l+W1TG6VuO3skS5h4aj&>aT}Xv&+ucywT*Vx}nxH!~*(Z z6HZvo?f7xXw{u_6jO_a~X6+SbzYJrag>F|!D>BaA#49#!%j!_iCCu|I0Hv*fFm4@r z!-87B+(L&em#$pT{*bO~7^zp(vrq>@e_|aM9Lb9|^Ol>BLiS9hiaV{`6@+`G9d|`M zwg(J1_Nvv#Loce9>bO*CV;&>*yo1EKOjk{kLVL}Gyusr(2_T-8I;75JvYtK&zt2!$ zl+K5TCCnToeag<0#AH0*&T{BHIi{-vEQgPK%~}Az?)ZX(Q}G+Mf{OA)r`B+pNxx&j zB0dUL)mG*fd6O55=KUbMT4yJZ*k~p&60a92Wd5RUWr)>L%paKV)g&P^WP)+x>C-iN zy~UO`++LHTz!q4)(vRy``l%ZPlsyPjKT(cN-Z!yY?Z}R0R)~n>*UX{Kg)+C%ipq>+ zt@$5RxT1rZb5dJcR7be$k?JPPU`!E1n@qg!Ulnvxk6EpcD>~h3K8VXw9Y8910W}b# zzg8`tiZc@NhdmmjC|#;K$=b}m7&$2OxwRM%bm6kj*iPiN9rq#SZ&X8^nkof8N6Q6D zP^NdL9jgx4BMG;dMeM)pF8LA zY)4&~M61(%3h23B1KUNljcF^Ic_F)=r zOF)?bjnOh1c;n3;g%ou3W^!0L;;Zq8IKTCq z0OSu+ZQj_b;xO`dK1Xonj6{N($lOjcIjl`8(o$)PcL%eeu4wIGA#6+@etH*C2H@$I zZwIie={kq5bC;+p&v)lI_#QDe^+^R)&%$r8Q5Wtg5QCGcc*r+3Q}6HX?LE65-P`#c zOA_94ugmmWtmVawA65OWRTFhnpn~ZEFdsurWP5tD_nAwIQy^RO(ImXn+C%+ z`uZ9w7O!OXq6wF-9n}h@?Y43dar5C%#kJ?6 zjspC?*{z!`Q#VNCOqJW4dV;N{7KySl6&mUOMe^Q<=?i~EcCEx!@YllQHar9T;<2Wl zItne9(VvZx&f-rn{g>2*1Cx@CAcM=kqh7cD2V=R^td)Y8 zwV}COgyfuxtWr)(E^+sno*CUUg8M=73$zu1)dZroOoHAgmfH0ve#(`VX>wAO5x_=7 z>j<4I7%DU+D0`pHF>BhZ;~M!3VMxQuM0l&2IZ?-L&(h{pOb+@Qb+R2!%-_EV?2pC8 z#lgADz_1w1iapM&RS_kJPkGcO#pCHwx0?5<#_{vssgibe?MVR6UjYo!Bah4?&?w8& zVu)9Zk@pZE2GYF+8nFuxScL8mT$C5%v$kOOoUho|#o<}Th!+T-2w)xGt*53yq!gfP z^>ubH+Wp3R!SeG9y<|4RM0W$wHCofB=#v`PFEl4BK0Xi?(+eQA%$FVyeb%mk^SRr$ zB&Xm(0f=Q}sAq{;f{UUcdKL1S)(aXg9v+ZRrZs}GzH4jfj>fWQ^bf6@pX>P_IMy4j z?n9n}60;l0n!|fC6wf;rib=vb_QOwQX_f8GAgys^DX>v~4AkH}hAJQ6Cjh~aM=Ou; z@}wNlh`gS`12^^t4-A_*AixDd$is$}rjjT)Z%!9v z+)58`mQ(9^A*bpE}!#%$ksawPB|L1E7PgLkmq^8IT7qwUB@ug9(!Pxm2Z zD~tD}vu74Zb?J9BYiGM?4M+s0M0*|89BvoLlF#h5@fghtUMi#XBfcKT&~OcYzeas6 zkL6{_qHXf!q5`ss6>aCE2PDE!c|Y<`%hF8^$k82Z5bTG>GpKYj!%FLy5rkT+C)T4% zeTH1bBJZ&+Je|0bTgZe`h(f2u#FaR`YN>5n)E)fXA_~HAg!&Qp3^{JtyWI23Z(t4& zC#}BWeTa9t#v@^EQdBR9l%$Jf=?NtE#NA0msk)A6*-keX5FaXaB<;kt`^-Y_Y4~;qGJ zUYgBNvAe-(DE#bjLctZmQ=GVkhOIs=S1jlv?UfwIZ6PAq7rHC@? zSoNe(S10{Dv)g5*ty`g#5BzPQiWv*4kozyAp2fmf$<##Xy?8ND6IKxdhWLR+2j3!+ zhEMktCpu}Kl9P!0nUgrz(NRL%(J zm^s=l-4?mw8fSccbG~fac^B~_$+ivjYu|#Dwqv?Ek{n^Fl`2WdI008`gLGKd0H)FB zX@V1erB)vju$YwU)s*lGk84)@)B*L?O~E?fkCL88!h%?eAu5e4R9i@?kMU3kU7fWC z&dF>Le5Z%sCYIbC%)TjpA-_i=d%A0ew-7QT5qwlGxWA@n>zuK3EMNge!lch0J_~ zP^3Kwjl(xBJ!DofT=5>HR|Ug=OGYRPoZ!`75bM;@n6A&vXVx$jxzSzU>8dcq`2MKd zhLv1Uk_UQ{jsCy&jV1iAy;RW3g3A_7G^}d{6jvtLBKA=Yg}29syPrL|Olx6QG7 zGes>*QgB@$z2^_Q33US$W)QUenK2&e+wHnhgZ!t9=c*wm0SacI@S&}aRhRZ|DNs-! z$89{vc){YiR)dP3P(jR_^ZCUTp8_x;R48Qm3w@iUoe)s%p|vF5B`g-@%rSPU4pa~$PweRn)s9kv zyQ<(9Jjhazx#sIZJ7B_AqK@$*Wr2eHU(GIwh@`*tw$Rcs0G9ppJ5|KosFQ(rcur)A z{?;EMd0HUX{m%4`2PeSPQ2HB#dh%2;pzm zLj-0XGGl$@_y%uklpB;+8ISjUzB&`Z!gK^|BJl8rlBO%EXDs+1=ypWM*@uZ9;8dX; zm-RANHiTZD>jyaw{g?f+IM!$zd0d56Kmq;+P60KP=ismhE9Cj3td0_WdvPwZ$gn4E zFYB-}jMj-#l)Z4%kh96UU^(M8-W2ILb8+H?J+QLjOODIciT-Qn;-3n;Z+8#an!p|H zj*M>svHbPYe)tgoLzgQ2?o!sf-u}kJ0S^EF_2_{l7Kn0Rc72pwTZ&xK{oR4?C6Hpo zDZ@v3`>$+P+_cH*#*M3&R02=u?e}5&bzK_l3yT)Hcw0>Yqj1xc$#)J(JIsDOEoZ;dUXibow+ zFsjuLygLLru`y|Js@`?9eO^2W@K@HKZQwWAZ(GTmlB<9=F^ch$QlKrKu-C$mKgcht zRUX_L+W5}p$8dT(YH(P9 z@E{+^c`T?Iu5Ot9i9-TIG(V9hT^C~rw^PBIf^3IdzUb{!MxIk837oBwa9fz8xqXIO zTI-C)Ky8DpwF`t{ZNELZV6{cK$u`98Nit}u7uo{~Rm4jNcoogYS!7oHrNMaeGpmQ~ z{Ureu2S0Ih@WgdkKj<^bN)#sTLvSsU@uNqYj9>BBcsUtYRe${etE{!Is%_)sZ{0vI z@i>MViv+R|YAQ=6Zdhum7&?ZNp1O%6Vhq<$T>^`6IrIP3CiwQ4{3Q(qvmQq1vQL1Vf+f3)`OuWvkY;9)KD%te5{m>kHhZ*HC4E zNo$pMxLPaRf4*_Daem2qafWFCc@9~=|CUXqaB`!y+nGJ=Ed!Nq7R*RrL$vqE zalWZ!XrWYH$oA?J**CN}^;VZ$e-oirC8#^1%q2d`*q&`^cwoj9zZ=OAW+ok%?bV^b z$+lEH==h2*Ubuc1?(tN9Ha(MkXvb`&d3d4;BqEOP%v6 zHb#0YOZqJPm}#39AwMy`hSKI3-ZnPIF4qC2txc#C0erMC1n%Mf=~S*%8xQ+v(^G+j zi#!Ul&gOA46?wuz%_Jy6F5W4gSm0RIv~r%=o@-#X6ZCgCw0nfzV?1IBc|w)6l5AWy z*V+SB0afWl1xmM)w4mxEn3#H046Ueq&`&N}S}`|TmAg0yd5^`j5hAAgZem=8+%1iK zDJ316hT@i5tOXT6d2#H1qpLP&Oo^f&&!uL!hwx>2RW74?tGMIw8D=+JzlXacVZ&$D z3)7hs((4*}pmE%4(D=vvpqqoA{66(EUXtZ)!>ThdH&ycEIydzS%uN*y6loY5lu6Y?QQ-KwXDJ>=<86>yX<=DS$-uzR8A9Q0tM&D>)vBre~<=@#_NpM1U zeQW>CM&4i3W6MzfjrU;OZngfwF-2y&TLQeG`I3l9k&~75a=CwSPyUi9>ga@9JfH?_ zFw0`yS#d9ZY7pZ|PW=iZqKDWHjY}Mc1 z8O&w#C8RDa_93C?8gh~jAb|FVdbo)FrC^SArs>i;)0E`2a$C0G=3w$=x?b{zX-(G8 z`^|MfDCDp^3wc|A5wU;Qg1Y^r()tzt_9NIG#a+2&nCiEB-$LQq!MLppm*hC4Pj-_flTIc;FpLv;;z=J(!I%nk9&nZfD%qHstv#e>W;8|2>iZ?ZE_k49vm0 zX*ZqZ7g`|p&1T(b_Wa+~W#7grz!`#ufnm)3#WXH7Hln%cTLU7exC*sdsrY{rKlnEm zM5zU|W0FeHy_IlLAYH4=!9fG7^xjIR1+2H#lcnhCS9sQI@ZK2se8OIrV8x7xIlivp zXV30p{9vg$s3=~t2P@J6rkjE|0c6&ZVz4V)^R6WdxLbRk>ro&n(d@D%`}loS#8!O4 z@tytQbrnD;2#FJdbdl^e_gbFn^nPIlJKMC8 zw9a~upNlf;ky~GK#Y?pk{gtkBp4QT+B5Sv?`wcDMpVfVs$S!HAYF0R&oBH(t>r1+7 zdi!*LC8DgWT|SPzACe4|ofHm^U?+CI7SOUXt(UrsO0T*e#})6Fv82AY%`?T9aAg7= zyq)U}zUkS#AGPMI;F`f@#UD+K6H!5d$u!)7r96t2R}0z#f)cnujAxF6c=s(!D*x)| z`$qB`t|7n#1dDN%;#V^sf}ZR*VljxCv8df|s5d2R)k&n)t!2Rw2ULfmRO#vZIrWb-iQ_%b0hem)7qPIf#wYmP@1cZ?$ z|I5xDTt{wCXy+$A-!Osy!IB1nk)2<4rS@Ke$eIApdVKERIL+$kU}x)4UyLqcCOr?2 zy$wcC(5-J=xw;{8E9mLL`bfX{(enn15J(r|JYj%NVj^V?mtG$5^aWv*jX#-&7d9K; z8Z3ru**j;RhHG>P746~NsuAL5V2cH{P=nhW>g?hnkZ2ES@`9Km$U=6>C^&tWiN&w6 zZ)g1)P&pr)+Ct=`z3N9^kCaPAM%2u(jsb?KdVJT`$%o;cW&F}1h(M*oFQ&|cVGbFj z()DjsE5jOI2ik`s1af#{!WfpcNId?=UQYGIVCHZ5p=sXRK}$`qy;Lw`zYiD)WM!CA zquvN)lByoC5t{^du2n|{T2l=B#wmK8Td?76uBqYa72%Mn{g(nk zzxQyn%uGQz+=`!E`HHbY^wa64B%#OKvpZ)_Iger3=?lwA3^VPJvzAmtcFxobMlhp= zhg$-^3AJ|$L#Efmpf+ugvu_XU-MQj41h(wD`DSo}?loFC*Y7j3de&`W27^Iky4V01 zv=V?pJ-o!@1JeZR(#;wp#6#vMwz>M9542+lUKvyAn;6VYnU^YdN5C0oF6>%IBQDyr zgjuqPC2@0m&(O6LbK`T_39DIsfkPP!`HpcSt9lYWY znzpPSMznL+Y@G#OZOg>o0p6GojL+=`EbUz#`#v3ygltNzn+SPfRK15B-Z{k)@Qd}k zSHmsWSSvcGl1)Dm9=~O{ovF^K$Y#b*-yWae?-~2Q5Vr@Fbl*Zm)+3E}U|;W#6KL<~ z_{K>4kA)iH;-azRvAaQM*6*}qmWSim`HQXQ%e(fh2NJ=&ClWP=+~!%=%6M=8#%cRz z<H$2I6f+oC$Z~bC^Dr?@aZiET;8dfQfyunQf^v2tXcdpWpX-a2iGn+B@`k z(GOqMSGT|X=HUG|3S(}vpxYZ6`;qY$#r+X6kpm98Bw}t(>budb21!z-ZIzFThk9zN zS_UWfJEgEU?Ryu+HzQGTp_FBi>Do|_(ijSe^qq{vt&JQ4oB6J=o3ogOnaaCk4qdi^ z4Jb+Hg9;)PME+2e^yP)52dte1_@;L`W4mBBBpiwGjL}rMEjCzJ7gLYz^F5?1nlt_r zq2d1E^;8YYtLf-vz3gAox{fF$C*r$w8&s`7{{Y-A8M?bg$yAj23xG`6*L<~7(!%q! zd_kT)_dHI_0flZ<_1Z#ZA@EONj>GL-@EY#!8|Y*iNN^59ndDy0Z;9aeD5jMQhW(5< zCdtYP2dRXD@GCzSDmXYPh{o^n*Ej%71t_l*mjH2u)`fbr@x*${!Xu3r+i@nz}l5idIf zFe~d3>Robat@l6%RR{IEI51ij!h$_r$K$BKJM0JCj(h;udUIn|l zGQ;uQ9Ny-FU^EEt&sLsfyg=7RVc5f>ACI6jE+~=>EAL)@D@@Yec50JUbpz7@7tVLZ zpQ8EQD-1~2=Fa-wI2v3&nbmmV;F9BtYptx#o4E|Qc?^E>NGbBAsOG(6g2Z zNH+Xom!XP$*mc+3*!Ss^JI&C+x9|RXEMTQPMa$0&RdyeZ?!RbQ@w!pO8buV`ox(8H z^c6A`wc`lp*Tkliysw=rwfta?X>y5F8xb0elqm@Ly-B3a9vBp|_%43MZD`z*PqO>eWkU*Amg(&wZG+1@R zG>!HrpIk6tB<%l^x&-JsuZ;`><7+|O1z;Mw{?P)Yb8X>`{P!1U08IwBPyDg;1Hf!R z(He}}Em~_zp;NzLZ$K3>P4Z|&`^HtQoi6I96qR$r905`Fi z42XU;c6hW0+b!)f2b9dbop}n%KL`usRC!b$I=;P~KIQKBm_2T|GJSN|W!$ATr;7YqNpktr;;YA!Woxf@G5mO3A%4TNs+ex$ z)%QNNosW+!!d2odH2mibmSV`NS`?9AD)s|1K%BSg#PK$`+mDHVL9wwjL-rD1b zshE1oae8Sidq&o-mg39UQh&&T&xniZn&$Byip*4j(g>sZW)+EfApCTQ`;x!=ljAlQ(RvukG_iwr>(ApgCGw%Ff`2k z^Ko{x+RDOsgeI!(_9c{VCjOFa!$H%jx)^d`n!$p>U3K8WX4G1B&T?P!O zmPOY@g{%b|&-6%nThFZs7fCmuNf`8O#sL|(3B~*GWVY?Vk3`Nrc-$jqCC8XdNn?GI^ zC_82qD)PhK+-oZQyYJ@e&Irq++6rT?ai8niFa3I1rEjbV3GO_Wm%?#{6l|F-q2n+O(AaY}b%{rI7od?|LEhZki}$Tk_Q0%|=?~g&$K3?cAL+pLP3dc}vOf zYfC=6b>NFLfkEDdT`9XRXFz$?pVM=r;06C+R?F9aiqzLp`@I)>Ua<5jD9n043uaoE zb}D3CAh7VVM+c*}NN5=52z4iJ^E3L!<;+A4@cub15>{vyh`{h73lCC(54!DaM|{N+ zDt$JraQA?4!bW+6NCw^#FJeZp)9pg8T-cFLaZPN)lbJ(0DV-Ax$)V3GS9jBpcO(1! z7ksyWdLI6eAppb*voJ+a{b*(>RLdzVagQ#KQ)JVuW2J2SisR|L2-sXTKq-s=M>aZ0 zV`yCWE_JrJ28I-^mpcAEX*d~FqN^AYR1BUg$ckkMleSoVjui!)r)Fy;w%YF_2KQ*1 zn3?+2&X-a>L5@tqbiFv?IScO+Xt-{xh+sLtbG>XNjb1hatlN?TkT?f8NP1E?RAcEx z5gVLE$SQ7vPJy3Xd(-81iQcP<(h_2U7ap|Xramw!ot$>&JlEGx9KZc!I-8xam09yQ zCDCqoFh7l*{tZY{uL%ICS2UC2*w0;$M0yO>NUyDK2M%5ek5$ZWRq9}luAz5NE8nz! znO~r!v&pp-5CzHhZlz}M)=%?`rNxLAjApG0+_seu*=I?X~A@)glJ;{+$c{1xDTFjAhPS?tGDZz+cC~D9+ zA@!D(J79A-P;caT%7uwaX`S;Z=zVp3HUiGHNpP_)AJP_6DfWvC7uEEyxhsY_@7_G6 z*J$9Y%gS3G<(3VnM7e@~2oarVe}f3jf9*LbQ#~@Xs^zI0)@X0c7gh}*kZd8M-Fi+9 z?amH)Y6*CwtB}7s>*k+~7c-rEl93bcu}#kUT$Hc&fp%7IO|B}AE)rlzuDUcC_{myN z%LYZ-oZlRnKi(7K=D+@RFA=6Exz__^vu-!n`3^t;xJewh$8NX_5?t%B2S{o%z>Sb= z$$&aSrVa!62q~HE#3nteuUD8K zd0 z)G|`Ry zJAb`7hOBtKBdXs@{kGIeEjDe>>G_M|SY`2+h3f-9I$wgT}Tjo(@ zHn}F|sp6?NaE{sE56z7es#_Jec258HsVV7@uHQiiOZwvhofsUgLU362t$aC$wD^+Up^kdFM;o1N+Jij>b{KKo z2TM0gnRI`^M1W8#>^t@7S7-}cX3)!iMG`6d~LUR&jJ>JAU{TWj=YxI(oax- z77M!eoTJT)(EvCl?KhHMSr|%0 z-p=Muxw26rw>=V=y!ue>SZWN>G54KGQtufpRPc6SHI(Dsq7gn*!&p0XiV!4=I+DTLN;QwpAUl+ZQI$8J#-lobAYRL0mUGJdmI1+Sx|)k(=u665-Bs zi}nk|-pG>a8tJP84Kr!da;wb8rLMJO7B2_IDo zCN*WH8@J{TI@xJL;R!>`#N6?o_FK(*njX{5ta%quI@ITR-Ca$!Fd%S5c#>l`mqd?@ z^l7~h35m}3gV$=DO4>jsZ=)0irV* zHrVA#h_M)PBgG;>(>6>ni%T~-Nuw#C_x8?8K?rwP{(wbBiKx%&ci|>#Ui`(4aMI!` z^<_EkBwhcVri6*hZKv_dGwrSS;2Gj=N5+&iH<6DaTm(6`dq(ycdXMwj3w)Wo?{HFs zH5J8;P@1^snBW*S&_o9W-dP3bRl;HL7x2Is`%~oS53Zlz4b5afO2kMxlwJYZ0Y5P} z2L*7YHf2*mNgL<#ypwr3CwWi0I)qc47Oy<-8LVr&uI$lA?M<}pTxpQg*U__Jv?5Np zQdUW0>_D)$ECr!4PS3L|XXV(@i<57@WE@itqy!T!pWmCfW|oVP++I{628K_($WaKg zUbLqcJ-?w;lC-*LV`WCZxB8ugQdT3>CHxIvbEiD6XVq5`qfAKeCHr(en`Ip;vPwIu zJ{kMbAaVIQ`E$B&JK}vI zmhH~g-?SX~^(B@7P>N4|3m{7YfCT`Y@*I%b0|~5`daX6ft}}XW>6D-ShEOm^1A?yh zYyF?rzB8<;v|BrhWyS&uDkx1y5e21)2vSuPMyg2f2nq@a(n1ZfAqFW9y$C3%NS9s% zC;^5(lz?;v>Ai$b@~s_;bKY;}yl38X{Nr`8lbv0j^{jTU`|gRJy-dYH*xSwY*8n48 z9r{odrq@I1)zTc$H#AwY3C~GRAd}_H=KKi5PTZmlV=!ZoMjPB^Xz;e3)cMG!U~SK& zl$0XuVkb616fKGgsNIUrMz!YnL5K8@*J50vyx!e$*w8COOIS1 zisAB_q775=)pbh29en%O2?e*vZ(9fL{|6sa)$CDdDo@hMZjwV-5ce4V0>zP~rKOD# zglZd8t+kvCbuv1he%=`$+s|IJT6o38%+x8A9w3vblaDv%xR6VtatHE1#JwgU+Ju*I z)T^WN2Ew@kQTKj>Lnmsj6KeR&usT9f)BVCUN$|nMmRQ)J=ldCVWK9Uwz8`09Yt7`U z&0Wjfimx`s6GTcN^RFKZT};CK5+>Jcc)E)Brv2yk^tmA5wRS6NPtE!+6Y;=#+MgP) zZ;`(mAuIMpa^idQYc-zh_70^jTb8~qU)94N{-!|Eq_&1p49eN`qQ)kAX+E}0NjGW^ zWqRqGzo6@Nzo)HYFD1?;lEcRR!MXmG#VfV!^p{nMm3-~KVFtG15hT*nE-hCK-=yi! zYY2#t=gycYOvXxw1Se zjKT8Rjd=kP%YSHlN#o@wWaSdAG>=t#h$W;**f<9x^nF8Qbk^9UOM>pkS=l6#yInUD zKZ!3VJ_)GRo>T}PPq4Qantv0B|3tnvb^w!^#p(Z4S3(!z4qT0_?Lbqsu24tKP$#e8 z$G)p)_em#hV4go-cfRnkK|$uMc>349uE0S!rWQw3bh?dydGMGo`i71T=TV6!&d@X1 zvDm7cXK8g-On;`z#L;}nEbiu1SMxWo5!QBQy_ck${+nFg3h)W4@}Se@%JW|I|Lz>4 z{njKnAO?rl?Dpesc_b6csZiG_@@?hTZpxX<)T9fQd1%E7q^v`$vgW4G$J?ZJa%rV? zT3EX>v7W&17nj{BdfGfA+M71Nuq`c%Gp6L?LQ8nMjJ;^{v_^z$TI|mc4&1YECojDo ztfOC>R=Z)|3!O@aBi7d!AFSQ8+1SfK&9h34#CTmHc0X#$dnt)EPtY12u{e1L!Q+7m zn2p^qh>&t2JnT4U+MN``*@!zIG-VT%(wZ@M! z1f>J89h5QEC{auTvS-9*D~Y_6Sv}c3C?;mvGb^RMya|F+pIs=H5<5^wLDhW)>qdUW zH5KO|A;3<9+6TV$6#rkH$Sa8e6Vh!2rZ}aX#U`5KfH#CIg9uy`$TsxG&qNHpLij?x z?l*DjV%nfQj^EZ_ih2m@HSQ0n9NrMTNI*hZuH-fYQ~iBz{D%adDMz766&k#coR2kC z-O^`5g}}V-Hm<2ybM`2G5fY5w4zv}^-)`FdMxT}x4Fkcblb-aukIA|&#t^|F`Mua8 zFr~~}3G5&Oy!0q}Us@wW} zsE}>4XJEz~cINOo{I@lMn?nA+82zK9bD@lTP$wVJ?>-o`&|eb{7uiQp)hu`{^b zer2c4Q$)s6;ba$Q9sWUY+1{D7EyV!%eFFoGuupR;Vt^UWz*+T6o;g?9SnH#F+Vk%a zU=0jd=GGBpSAbx)+ie19aZrY%r&4d+!Ub!zbvuC~ozSXZI!u%^C+ZN#_H?+s4DF#; zvRETA!sq9k>t94M@xt5cOJ|R#r_7av_xGm3Ofv>1ih+=?p;3FRv{csWYRu=3aD%({ z%NWeJycEk=y3++!o(3KEEhW9&-=-{TGJA+-d8N*dY5Y2Ii~)`hOw0M_U7oiNN(|KZ z1E&h&7#&f35GpTBluO*?P^TvDz^nfD(vhny92vw#ec&NJfe%SO?O~eWfLCw&7o=TqEBQ8p6`cgm>a6sKXF;<}X%V**K*e-Q!<-LW*xtcbANA-wJM zf!6Qw_k4LUHwkvx(W?=n<^GtE2zjxgMaGDk4^rSV_CXwIqke666}u`4j|YuL19uU0 zKl)B;*T=iR7JPsE5ypBJ>EIJndUWiuWj{rf;sDydXvGuR&4`(3aZR>9d z+@sut?gAN?($_UbC+72I@W?d{U(((Ip(lWmonnqQ%YDkZJtm1j)nuXAw3<@ zoz?eUvX64O!EiqC=2chiKpD&6+@X`W8GcC)YFbyGJZ=8!-6?Hn`ExPwazzX;6KA~_ zl%3O9qhAku*O$cDKA%T=A{Y*yu8R)xiyjI}UCH(@=_x(44EV0t{yQ`eQ)38MfHDD6 z1MQ0%t&*qFUe$g~b$VV*q^%L6*#5b(_8*^8Pu9~3cbTc^(81bE;ke-=alsV@hA6(D zsisv~nq4P}o@UNhy-U*ZG7{th5-a<7#L~NWTADGf0YGMbvYA*6`{3nJTVeu!~QAyTise|9s<OZmdm_*v996DwXdUeT%lP(aaXq>s?5U4`OyGu5~$s zEw635?Aj)xt6!m|`SBPwIysLAJ6W9gX7shK|YV~s< z!dXbXsd={6#)-*fl=fPUd0i#zvk(Z?uRm`p3A9XHD=|0IA*E5yfJ$!sTz4t_1&FG%7NdtAUho_FwfyX@Pi zEu!8Cx|jPhvuKEk7&>d919irX&slXJdNHw|7e`r{rI06M)Mi9}klIES<*Xon^2meN zIOZV5o0mIPbAR$#9xlAWaxEcA;7o8<^6@<#?lvtvQ5&7=eM~t z$<9&VRmXa?vm4X7B-a!9cU$-Efe;|o0El+1d&{7h@x5!6PGmeVidLujSZ9(2?&6o& z53hAvcd04W@82=*>2ug!K&$AzzrpWqDvqw9wh4bU>&;0RQD%jEo>tWwb53A@ECX26 zHc!ijx%_J4AF~vmiz!sSX}|}*`O+HYJ|NC*ZEbH2IgVo}Uyq9h_|W=Y|BdI4GwYYa zFA0|AzsWIX*4I}@UXyvydBubi?W-%>MeFZZ97+pp*2#0BDcq7`fOVUS&2?}!5gGUtT-4!YUa@(6xlU<_ zUgI29q)SvnAOgvQHT3~gaEWR*l-^R`(J-HL0XaNUxJOjdgmslQnx=vwlOibOtOZ&0yFs_!#;!!Wa^7NMQQF2in{Q8oh{8uhu09hTiVX`L#iNj zDCI*At<#y_=`hHyr`1a5msmR4$n%IFAxC2i4;Qj3Y z{pDl`Ww4LGB#Lxl)k268>N7yXDY?)SBLb8 zu;_2uzig%QKZ_}bEUPP!X2Ovy`$iE`Ic+2-qb?! ziRz_~fs~JfveKA{w}sm0QVu;dL_+Rz3$x(TX7{^zMd z;3u}9-7RCOBV4kw)G#{cb7+#Yf@LFjLvxrWZ*b$7^2bI(e7?pX% z?1f;t;svC*pj0WNflW~_YqSY<{yXX&p!LH#lG-C)j3K<+pHV;gf{$^0OkQX$3$L1? z#sD+|k-1Q~U72B)L>P2*19p@l^P7%oprQ@re?aqi%aal@b?nu$PbUfVCEB@*Ru>u* zHa$-xqMS3p%L8p`N_k7+e6gHC<((&S50FwcFnf!)T%1|{ zAV~s@r)L1JBYvgTG>Y`TU9JjygEA%NHZ3(Xm7#55pb@3yKCzQVg-YD>4mkbd$i0hG zJ%Tg*D5~VnpIC|iZz+ypI{|eRxAPpshPJki8!VoufV`A9%BrrAJfGX$Q7k{ef|&_L zXh!ufzCM6#Ljmgdaf|jZ?L#3^38y!{ir6<$C_{^aUmA&bfOQ$^U93}~{x=7d&}*RP zPwj6uKb};^p&z0%F+U$Ygx)cpWchf9AAL+AvTBvJ@5^<-=;=lgX3io*{AzV2tL^VH z%0^9$NX{vnV2&d_&Ou}o6>%OcvR?H_0WBsYhmfQpsZ3e*5{`At7wZ>H9Szbx9R7mn zoR&X2W-`PgUI4PdDOR!99LDeMygBj5*j1&oYzv(8=(Y-)Wfz^X@jpzj;FPI4Y^TP) zxC0@plG=<$-D*mQs9W*%o?zXWW`TX_r`*uP@>_euOmb_+fbU`Keoba{`}*JkMt8T} zKm`h2WH1#i{B8KSgDunLh8h7P^PF!HN{i<)pC@}ayV~CluJ3CxJc-BIeGEC zX0)aK!x)zLLVgu3=e5trmI{_15X_`a_BFv?eq9zt%$N;eA_0#r>Ey3C<=R^d8uIl9 z(LPeb+Bnj#_DDyMW00|cd~TCrk$;8wb`I&9wWk7@@KZ0<0)(;d7bCyPT39ueS43S8 z_%@rGh_n6)S^O~>VL{Ld^H!&qwAU#=vq-i)Uw@Mbl8Fwl3CedOj%94UcopX#Jy3Tw zKv;xZ)+-E&S)}ig^cY4gL%H$I+86L!UvZqR)ECnNO^w8pp4NG`H(OVsTy&f6yy%`+ z*Qd|k7sM|TFK|eAu3eIpwSCyd$s0yq)P~qQD$-<)y%q?(p~3r)4uI&AzLWVP>774> zz@bA?Lcxb579J4)yw0IJW6nUbMo3jFx4c`s=UsApUMo`<+&|?E|Hsw|)d7eVbO)39 z>_f4uErNf(hyvHbRfxF}J|KbB8KvEn7u}xE_pd!BGr8&s&g81eWgNc<)gq-4(krHz zwdYT*g#P6L#}7lGh&9&QQMS%}xwk7By=k?>H+w#vbWaE{PNes6)0g$iLtLlyy}f6w zLwBkx_Z(xtJE6XmJIA_VR-mB?&Rj)>}I{5^Tp2jPKnELJEOAOtvl50^4oqG)M5iWP{XU$ z7)Z=JLi`hd*y3hZX`UU6H?8S`ix^`-i?&)yvv5VplU@#%bfD*n_mowfj`+mR-6k&W zx-{DF^!szEjR%W%R!hQlLnx!KPC4i;j1_NLZQk8ojqlYEe4ZQysXAWuJ2^78BJ!0Ra$lj={f8j+-8i!(}wphw3YddlP6Qt6} zR!dve9ihm(T_>~gp8SQjgxf0W`&G^B-o78QG<#8qc}XuCr7e-7zcZXQx+q)$rz}L> ztdn>+Oyd9a9y?%kZhbqV4jHWPo9AW!>46L=HB32JosE$IE;@)Ee{fvW++Fh>{|D6k zKg*$pWGBy$0=bZc*Sxj3G5OI{ zS;Ypax3acwPjf=l2a22Ys~9W0_h|$X&rYAkKN6i8RcTqz+9l!?6i6p_DqpT45y>|c z0=|70UJB{&`XtVIVe=|@4VGe-d}E>EnJx*u-@ZuCmCT*9 zu>@gN>i*q!jGJHJ`{u>|FTF`7hZ~~c0NT)@HAd)*S})Jrc)jN5e2H zN0s=OHlIK168#8Ia%KZv!dRZIO&ybaE+Q_=w|8^1mBw*LbqIu=eH1nOdh?I!?MSVB zuPzxT)XYCG9h;MQ@3URT+@6@0iP(keNK1#ulti*=wd4&emNQfM-DW!});pB+$3sQG z{=RvZL%|D0?8}3o!nJ>(!ry9@^a2|MAR~sm3>aZu*vNbgLuyw=*xJVWQj zsXsKXW0YPm#%1nw8P_OYT03Ow0L8d?Q+a>?d#ApKH`h`Jca9x@oLWy*{y(jk z|J?q52*9f5XUPs$l_FvK^4Alvxp>6A4<`eI3E{3q1M);%S;9s&;j9x?c z3^Kgt4}z(QaX)e-v!PLBT8+orp{+i0Xzca?44f8NFKxcevs_d8l+`aXGQ1XE!juOq zJq|vdpivPOef>x%k{o^fauBC5L7E5(%rWc}ci&vH=+V#5{^WX;+B4K$lzlyxBvQLB zYPZnp7$GFaY@2qrFl@(R-ovR>NNV9FYk{R5;arkyvgT#w$Rc}YMm`DDRIod&Tc^qk zlyd8v+mRWJk&B&7Cx_3uS10Gbnj4wVmJNCHZ$2a`*~IX$_f2MR6%$wI15CTvs@s$yA zS?gYDI%Ig{{*NU67H-S=wSXvw@IO&J`o~rPZpPTSWQFBg)2Dy2wf^<#==GQ~AqyD} z$=g$OaR0weQT}wpf1A`?h~Pl@I!J4biy=W;Av#L6>FtMe96UGc2=|@k3YtBwfG?-< zNbd$r4jf4)GR;|mOmlACd`oSxA=7r9PZlOU{xZb@Igiv@Ca4{#**RF_(6jsVy{$x} zCSCTfk#My*wvjyR^Hby}GN&9JV^bsM6ahQzR%ZZGY7DiHH97 z<8qcD>kU71tuLM7AZL=Hl5MAEqOPsXKDw6RPrbE!dCTwIdotnU6ITM{SA#iKIN>@!3gt&jfxegE`tD)VLR z!=0l!d0Dp^Fr1>IN}-zkTB9Dksq=AibQ_DlEhQhTN|{m>G;o=dfzGdu%07WsWx;D4 zStA@a+`g|T()?36b2TOo-{0>WsFR4JJt%2R{%%`m1F6lFgniuRj^0i#%I|jmR!LJ% zeof{+VomOM@9v}|6#b6x4Gx!;eN|TH{9Npco5JXk)dMzBpUyhl$+9AbC}A8Ym?}6P z%LBFnD}t(A6Ov+Oc9`rGIAnG(k3H3olxRB#J3rhHX71%Twt!5ZrP$m5CkRPnw~fd<&m=Sl|70UHLe~&Ubl`v?)ZzUbuP$T#?^#1X0`HjmTD>H_)b znpM2t!jTMfkZXZ-qhViCUrVqeA}IDA+oh|$@U=v3qZ(j*1O!I@rA$GCqLw|GP;0tr zsE7PW1pVKEH~`9345JP(hxr#@{p={~3L3i$)z>i?PJsFlxnXon7iZN~kP8Kjl^!Js zm`}_vD}<(cFMUr4zJ%X5+{eee2PF?R{jGruF$qOjK)w|%V`Qa~LpOLmot#jH(a@QV zCQKxf#~EWO5{xt^Ju&(RNDU#3Kch|ps5vlrfi6ndX}pHL??|zH#RsPJO`yhx0#RpF zXuLA-zHWgXNN*Dm98mL>oUQE4&2}@1m&RWjz5_ZADEX~`_c$}PsSm^s>{oa+5UfA&BFy*@P&- z0CyTjR8tkny%GrCAyBN&Y`QlwJ|3n)iz)+FcHpgs9y-Y9fhZImzerSlm>?qeZENNB zhB!7)avv$oi;#Fb$zzHmJ{G-bks;y34xD1GA!jRld3Wp9u^Ig8%jv>1aM=@0dk)Cq zk@TRH=HXN{;WK6V^Fg&9*?yfm{iQWPt%kVuOmsVtT3+C_3}3v#sczEX6by6?F@C6# zk#9@aOQlD?^_-sF-!s;;r}4BfU<7ZZf3$OjlJSZR3e|fJ=MIc3f{aZKGsGzTj7HIt z66`7K)RxzEHn14e=K+hsV}Og$tF}`0@RSTtdJ~*Ab$xh1ww5pS^OGDjEo7v{+mw5b zZelJ1l`^6glDj<CNu7Z-Ih2Ri9oA0k^OK;$jHF z26atwv*xGN-yV@`y^=b9rojBWptT6Fo-xOiA7Uef*$s5e4V%O@_B)*18gc->2ErcB zNH5x9g{xdyIHGvaGr91$W^QefSeHXxecaY7AHL`3ni(I^POU$J$3)SaZs8GmE?Cm! z{B%=F0>SX~+yJr=p9rUu0O0v{!utTTe_GjDJN?eH1>DXS1^i)yUz^k4(xpZT4d2b{ zJdpjGuq2&joAqSosJp0!B*=d{jkSfX;d-o3fvkoc_dwxH10#rJ8y{}H!XKF*COo|T zCNBdeg!-r+Hp$8*W!qS-8XuMw8~u0`K`RL-W_Rb$(xv$Hn(D)xlvE8OThooNs>|KR zcMFaJfl#(vi}J)m?hZZ%c2cw*&$JZJ7I`)fT19+If_sZ((bSV-$_LzG^g3p0k~bJ7 z55&7C*|E+f-GORQEfjxKR8l&q44mEc9~iITS^C|#JiH!5=mm8uM35}Mpg{s}Hw;Q= z&?>n*21^a^OzB8LaH_)$$?KR3(v^_lZK(Gsj>v~FxUd4-3;u{F_HEYUYjrC8t7bO} z)%cXY7u7=_PKQFNy(S2w0DuNm^Z)DrA5H~0y12MN>lcIRTzMB%r@#!S^Wx0a%^qFsgbTG{Th*}U4l%(P(N+11vo{FEC?5k~n1(S!U&5EPEc5{?%*~XQs z?TwjSo(H@M_QCL@o%%~R$2AV0GY&^&jHWww!~QeVe(s@lG(q^`K8`}nGJ3#h8IjP` z*luzYk%=fObe%>-$~AtvWEjA-6M?<}_$b0a)oL}DiO)X*_6Ylx(T+Cfx&lQ+iBtHY znOs4Bz6)R)O3Eh?Nm{>91LwtbEG5P%6SYkWZUhDuo^%)0T^qU=iAd$<1`1GR$C)1T zo#Ll`4YdO+E9iuM?^+7I$4q+XxAeH8zy$Rfp7g_Aax1lF^PqMPon~JVAmdym>!0te zEyfcS%rmpI1zRe!5FW(&X6+$bk9z=-f@=l1(NUDF7Y*Q^kfj?j2Qo61_#xj5K*9dW&hPA!zDlOBhx)hgk!TE_qn2HA$;ZC_O;1i3YUBx_opogS z@$mz?KYw_D$eUJi!$8<`SheJKUY>!++Rl#ygpcT*PKaBiAJJ~lC2sLC3hny!Bzx}N zdKQ4>rwVwxdo*BbBF~EoVb0C9FqFzLeMujNuKC>nCWd|e!x@5kI`5TY0yR@Uj^P|8 z1BJ0GcX!dLsTv6`xkih}^c;$kcT<{~tbCTxxb~IrRu;H=_k?J|c$PPeDV3`jxfrkP z9bLV`JfUUpwaBcq_OTuV{vna~rI}%GnNPC)7yT!c4tmG@C!a*2wO)LS)k9k6{QQs~ zpJsQX*~Z5P_grFi?bS5WRqwrwqQWR5lY$na1t~L zO92E1($kvMHm|0p2ziuQ($$Pyf20QK^O{O7cS^}bRo#ywJ0-0~FFoaT2m;Jg1H=v0 zBU=o0;RLn7gaN49r6uPSb$xAeNicS)tCv&qJbO!dO}G$|)78PDr2vKab{e8)fvZa3 zLivl9>T(nxa2KdPq3X}l5CP8%TlOVEs%kC&jlEPs+kbo5*n*?WD=)(5OyN|J1~}4kr`Fo{-T=hD>hT*m;>`v50U@L{ zznexN4ggGen1oO>U<;*cuI`B6A5FlnSo8|X6%``Uk5REa8X2J&t~#Eq8p9R9^g$X_ zfvje&cdTqlLYNf@(Crk;D?2IFYf%dfn839qW=Q)@swc@8v@ zAzXx}1`W{>X(DqZ-zHb7Omxlj`oiW|E`qjeR2K9exr@!#?DXOO!0vaUK|8l>?**+I z5wpH@qW8pEk;j;GOXzX!j4s>99Bw^L+1*7e$&0=y>Nyu?%P13)bmucWM36FWz| zMI4{Bco2X0R#%BBG7QWTIBOlCGL4pdY^W8&9!m9?3D7H=4l>`nAKawH-=*Jqy`iSqdox zzA(f`*U%`WP-0vd#o#xpADyDoQImGWtV}$!{*u% z&?|XuqUsl@-wD8z52CGZhQ3I8KFeP4)DJ_Zy>r zhLI2!>ewg^6O4x(ctb#yK?->db|`CLj zT(AW>DFhFIwYNG`H1|91c=a(h5`6+=Tfz6eFp>a$AP$%hh+OXbRDFz@M6Y6m`oP3t z@{AqALShV|dJ^#4ubl%z4!gnhfvPW6+hNDUVFfG>VR22$4f-MsmI>+uS~_Lo2nmDR zIRcaE0$nIY#*FvW3R%uC#PkzH2T0C_qDj!2zc zGP#HxrQDyy&0HigKhnYMz|ngqH8A@w=2elb#r@H2(N5A;Z;3 zu2v*Q8gGfB$d2P(W~YLL<5lSmGx^Qlez_|yrWkfwH;5+JkmIP?l!W>jdkhiRql7; z)yt*iW|N0CD5vMU#FrLiM@Nm^j5A!D*gZ9+hbrTPCe-UM?~*%HCSj`F^M=+u!W8W{ zHK^h}E^GDHnCOt>e}*40&+!_K6Aa-6eNqR#$6spmdg7vya7DzTKJt3;F1m9e#kXzf zPM=B5R60L&i%(&o=jS*uq@KM5IZ0~O3K>9Q<$h&(rnC13xM*%aU}U=Bk#gY$E!(_MOgy3I_`8 z@=pW55y{)al-sKINzS-uWQ#~$*Gjxvb52KvQwt zbK@;Z80j9Ty4n)<=RC)AS3Nnl|UX8FoYP3X?*rz$GqG} z@e*eJ@7J-ik;ww}wZ+S>EDl8R+P4iygk2=W=o^u){Kp9IcOc|=m)d*)capErgfr%E>^o&99cb#NxsYV zw~>Z&dwO%3Wh_y!-DPI?)SP5)cB3MCT&J#2>~}W~G)pDs6++(7C{7{_sC=AZqFyQ4 z@|%jpIU35KXQ)g~8-^L!YUinV&jIw)0-S<4Q2wDnB_2P28lVR6eDwF9G>bHB( z$yaJP?!)4UqYkHLOjE-mcH}HvF9)a)D!yfOy&%$fN`#JHJX4q*qggH@ETJk>E{M4~ zQs=j$z4HE)zYn1LP^uGuz^-GM$EL;{^A_jbyhphw(f!&^e(sj@_@&ubi(YgbvMfX) za{32T_64cMNINg;C1vuaX1aPw-O<~ZbtqV?B>L^Ub_MI*vH<@QH5JXFqgOa!T#jye zlQ=U`lVY-^b~V>;;H+DN^!xi0v2D@8)Sn^a*#-`1 z-MatYAlNoso#=Tg-ehUj4i=4#XcJO_i(uE?A&U#c?NfTr1D2evv5i@5Hy^OzmD2R0p5S$ykJOfD z<(Y-H_l9a#>m-#Oylf!m58&5sD-jLWiIu`%@ z-cb@-1Gn2p<%Udo@Kzt&k5L+R5*$8rb+z|Lsf!7lJvoGR8^-?^d+S~$P7C>v?}1~4 zY|}*jRrGzDcV0nnh5^^5r7MGb;ln_*o^)x5j_E3IyYr4J#KGiIvViHiyM?QzT>UL+ zFa%dsD;4y`o&_IHdpm=pY788bOeur-+(V99Moh<=Z7obFhJQXtI z;Xq5w8FDo1G)VTIfY|O5>Byu*Z0Y>nr22#BH3DO7V&!g+q)r(Lac7JOH*1y#5@#by zUP6a`eEHoapkxO3TLO(nC$lRddWSERDr{xBU(rl3>p{u1lO%@FE!ML%>E2rEjZebE zMCxu8(VH$SISR5+w>{P{n39Snc)6^3mT)NY0Y4P7gaiT{pChOK`$eP=QUJz_nKFtj zw~(D0pf{IFVOjvP-*?%(2oTZ3u}Lmb|L%;R5Nd62XA*Y(&x5^x^&;?75bg$vRtbL> zsTy{_!0SYV*wqa++@hYm0+Smf!=D1Tzc-069jcI2WX*lAa$Ajb>awN1kF!@;20K`p zvwOyEy;h}4n-CWfDC!fR{zi4KqKQc35E5}Y9a&cZCLk|C3%cj_5jWSW@s5?jIl0tV zF6nAKRwaprZ+xbhX{V z=F43SizJ`RFXqN`2d09zCndLbAt7M-H>J6{$SS9oKU3e}YKV`V^xboEC^GeeRQ}a6-I3gk8f#7w^-5cMK(lF8! z+@EBJ3DvpVcJ@r+W>H-)Rs^_FA^P@6BKUlM$M_*>q*%n>?9FNQceVMh96mm;+=Mjl z%eNE`QDd}2U!$MMJ5n9X%Ru3KZ@)0xK(Q4RTH8&&8 zs*oKnbud7)`*(Df`b_P{Hy@B)j80Y~p~B|Q`1eV`##+KdVY6)79Ff9c=~3ndhRTPY z5MoC}M95hg&$EL5o2 ziPFsb+(90?)hLIhy_(#p&v0=D$a(6;sF?QMKO)Dn5=R=i5AfK$B=X08feS&gwbYHR zOxH-y$Mx!b)G=AHio-Irq!w2tAfeP6OQ zTgR6~>YumP8Y}3lb^ z`cPwfcy`^;JM5uG<<$qNON=`;{Kt>Z9l$oMNX-sP=DQtA7oQJ3Jgqf*fMP91y#e2q zC1bT72s$a#2DTHOMzi@vqmLqpgZiTP%z7f|)O$WXJjm9nVkDTSUtg;n{Y(Nso7$tK zt&AgGHKoS}@@eBbu`G4SBJVPdqI6?nS8~suHt%@iqs>6+tq`)c>Y!oJ+aI_;5SU)7 zXyJUl2iRH-j9gq+6q?^C@`k+xADr(=pHC5v1f%D}KLcz{nB!>^`=&~>rXkmc*}<+H zc0X_832T;2ao7;dpK+(+g63zZ+jmwn-cPOLT0Fi-&1hBTP`kp_q+WtRQ~Fhvh4LxH z;S2#WH0kQzUz49#zKG7v_v0yBRc8p4GCkd1ZV_+$VQod>t^^}rV>+Ai5zj&Yuj z>pgrXs`V~gc%RCs79z*!l#>}07!`VV4jXiPmqa^Y*|r!uv%V$B>%pF0JR40=V1nSG z@ddpQVAoLcys{lnsdsV8ngN#Pj}OS Vpgnc>H46S+zovLK`HJD={|D#aJ!}8~ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 4528a29fd8..f947451a77 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1465,6 +1465,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [MultiSIM CSP](multisim-csp.md)

    Added a new CSP in Windows 10, version 1803.

    + +[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +

    Added the following node in Windows 10, version 1803:

    +
      +
    • MaintainProcessorArchitectureOnUpdate
      • +
    + @@ -1600,6 +1607,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

    Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

    +[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +

    Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

    + + [DMClient CSP](dmclient-csp.md)

    Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

      From f58e9b2c1e321b511ee065167eccf45e4d75e307 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 6 Mar 2018 22:40:24 +0000 Subject: [PATCH 086/119] Merged PR 6197: eUICCS CSP - added one new setting --- ...onfiguration-service-provider-reference.md | 30 ++++++++++++++++- windows/client-management/mdm/euiccs-csp.md | 7 +++- .../client-management/mdm/euiccs-ddf-file.md | 31 ++++++++++++++++-- .../mdm/images/provisioning-csp-euiccs.png | Bin 14272 -> 14803 bytes ...ew-in-windows-mdm-enrollment-management.md | 11 +++++-- 5 files changed, 72 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index e7ed3131c8..1f6269d889 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/02/2018 +ms.date: 03/02/2018 --- # Configuration service provider reference @@ -1127,6 +1127,34 @@ Footnotes: + +[eUICCs CSP](euiccs-csp.md) + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      check mark3check mark3check mark3check mark3check mark3check mark3
      + + + + [FileSystem CSP](filesystem-csp.md) diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index ed10ebe33c..eb5f1186ce 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/15/2017 +ms.date: 03/02/2018 --- # eUICCs CSP @@ -61,6 +61,11 @@ Required. Current state of the profile (Installing = 1, Installed = 2, Deleting Supported operation is Get. Value type is integer. Default value is 1. +**_eUICC_/Profiles/_ICCID_/IsEnabled** +Added in Windows 10, version 1803. Indicates whether this profile is enabled. Can be set by the MDM when the ICCID subtree is created to enable the profile once it’s successfully downloaded and installed on the device. Can also be queried and updated by the CSP. + +Supported operations are Add, Get, and Replace. Value type is bool. + **_eUICC_/Policies** Interior node. Required. Device policies associated with the eUICC as a whole (not per-profile). diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index caa165bd48..06be1ba347 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/02/2018 --- # eUICCs DDF file @@ -17,6 +17,8 @@ This topic shows the OMA DM device description framework (DDF) for the **eUICCs* Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). +The XML below if for Windows 10, version 1803. + ``` syntax 1.2 eUICCs - ./Vendor/MSFT + ./Device/Vendor/MSFT @@ -45,7 +47,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic - com.microsoft/1.0/MDM/eUICCs + com.microsoft/1.1/MDM/eUICCs @@ -229,6 +231,29 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic + + IsEnabled + + + + + + + Indicates whether this profile is enabled. Can be set by the MDM when the ICCID subtree is created. Can also be queried and updated by the CSP. + + + + + + + + + + + text/plain + + + diff --git a/windows/client-management/mdm/images/provisioning-csp-euiccs.png b/windows/client-management/mdm/images/provisioning-csp-euiccs.png index a4c67a8b7e6469ecf14d0a29392968d4dad6eed2..387fdae3fb5ee2aa07af4d5bb8a79d5a1d42be27 100644 GIT binary patch literal 14803 zcmcJ0XIN8Pw{EbZq7fUoB}h|H>7YPB2nxzZs&uIWDo8iV957w|Nfvj`0kuLhj2? zH)mlp-#IUP=$X{iwU2L<1udKq3AbuyJofOz6U&_39OKK4>E?-l-VqN|=@?vgKnQp4 zHhpMoTK;p_p>b27%z{Aur~e$HvD^`h*4HQiiZ6 zCW0Y}U%b1tw6(D>4?$*AT%n>OB1txet>n9Q7j#RqS}|9@nXLmPaOnaz|p<0{d$R zA9>wa$F5}3p1PDGLkBUx*E-hS-Q7Ih5mw#C^tx5baVh>a*WUYgtGDclW6naTd&e;& zErXi%7a(n{p_u08=0!`Nbt%ug5{W|3Sr$d31K$ppIGNtrag<}Wf=EkCqQ+$(7Dq`A zdP_@$2)&E+-o*8#_tbSQ9)TR{vfrp(T{QAsQYRhyb=j(>gN%2OXGTJ#!+wp;&MJ;1 z7JXAENGY+E8T?$cU?K&Ksn24#2kYT+k_F$s;aHp@FI4b$mX_S2;!A_ma^IHmdy4al zPuw}LkjpwEEY?y-!=d#VW(5&!h?ECZ;TeQ@fb?L;{!a`lAJmQv*pioPde1`hp*qBQeO?f;Qs)co}Du+ zOp3?N#OPh46~bFzTXkVs|Ek@!C(-4JQX$pmNFRduH;uVGzmYcoIe6x}X7Hms<+(2J zI!5CUWVZ!|>vv3N+b3p==0q3W=<49BN5d)wH)gw90+HVMQCC+NRvqM2I+z?>dz`2Lj^Fi%p~NsX z{zq8dL)8-~Ub`##m%fe~>=^Z8MK!T`YbNykic_2Yl>gv`l#KGSo{dY?ZO?1`1iuI8UycZ7bhxHO>ke8XVM^ zKLD9>L(mgspFizt3ELKQi!6VTF5Vvhy6QKAO$+==Bu1~O zYG-wHx&IIQQ=CDVa5|~%EB#f)K@&qoZi(Oe3z?BR>7R@8cf>UAgY8X;;Bxx7Pu%5h zgA4W(RcqChJz1QQ8)LPizb0*WDQ6l4*Vok*kCRM93$8op8tFPb8T9ty6xJ^;uB@D^ zItYQhYKj*Sgzs69L;B_ITRF?q?4N@X=vIkH86%~Ur9cVD_he*oVWHEtIQ;r9r&la| zb)jKOfLwC`a^pIx+Pi54;hd-<;VvY9aj^%jI5)VolqZgZyhw9{`sf*XUwhwhQ81XJ z+vkgqu>BLq92y8sJnXoMzYCbod7R5C;KVISA@QbCdWdej{nd=jOn*kX+WX@@uUq9- z73kN^ympewOCbo!3~R-XTi#pkBWUmESK}gi&TqQ0L1sV8Lp@EdJfB&M*lf3wier4H zIPCF}M2;RYlGs2!w{{o8o7kwrig$FJwpy$g*O?quX&}7cnv8?~G+pxWv|Y?~w%yt2 zjUYPZWn^Wgy{3iq`WQ?K1mm?Y`NA&EP8f~SKpNQKhaf>R$fFSYfBeac0^XIC`YZKM zY3NTji1hD2*SS%Cetwfk*K)C6HP35u&&sJXD?sFBq3a^3=;-L8s>(2a+>v_$RS{m3 zc4QjP0FD5(*sF1|_X*bmQpHOlXWqc(jG++`5&5POBjg*kwi?QHz7tmio;s~8#WCWs zf=7bR;q0=J8>FTo#X0>vZ{x?#EyBr{E;Yr{*K0FBgS?Z5u3tut>$@U1Qk*V6`FLY| zLrs=dz9D`W#>da^=g7wRXNctZ#`^@GfC6zM#3TTw+XCFWmW{(3%dbNM<5&Gmc>{{Y z*C68`D0hB4+vTSwoSN5dvsV&dF$sIxhatr~SMnvN!+ts4Rmxqc7?=GG^sLcK3m-baKXZy?OdcEaolC%1iK?3PkhXl7x(eN8TdoIbNV+37HF!v^M|dV(wB$iq;U7AuyAj+>4-JHlBxBcf0>#G1i_<|Q=q0Yfq&89f$#b4& zmVEjZtIZkrm3hK}H12%q&kJJTlOH6Cz{ghdYXA<`bUf`K}~k*IZgbJX9Vk&l=W*n54VgU)|{( z9g6dE*q+=gE5y$uN*5c|ZOxM#Kl%4m^%r@*Pd#i^G$MCaSN{lj_)}{(ZCsV(w!&&S zc$ooOX6D!AlKZswx6UU`Nk7j&xOoyDI@3T5AB|GWIuLDe&bmNym?NNAY>vnbVJ&Qk zR{{zLLU;if&S|%+&NRJn1K>@VC&k}@Kkv&SM>@=+^yy`!5KkwOd4wa5%Do8 z$bUP~Y&kDEEA+_BmAaXSj<2}ymLv^gV|iKFVmSf|#Kw0XU1X(ch<_52I3D~mxgdly zr0aCOF6_DEEKSWH@Ncs}Uej{;7<+j+i+&LM^>5C9O=)D4i1Ev|OjhP}n5fg z^o1jfxhjjL_R>|n($JETm;J>m$FHVOoMhc=7>n&49E3$*Enk1uL~cLaX)>%#MtUGa z=RebY1ojXg-I=)Dr_PV|)R%}9T0}Fp+!7H$dJwxW^By|$7B-ien3$NG?)vHLC`}DB{LNt;z4T!4|L*cpEXLMsE-eoF z-Uex3`gNE_x(mEdpmhv{ciR(E>ARPXarW64lfSz>*Qhx7B8B?8Na$Nw^)(zlLy%0; zYc`bKaj+H^{G1;Qs?3)%K;l3dh~em!*-$y7r1*!ynD}S~qSJPRF(VZIMjgz~ilU|K zBi%359x#9AW_Eqxyx^q6J+ejyYJXA(73h=5r)vH8;3D?DA%@3pDJ0ouU8-J4Hj&z& z^#$xAUSKC@4DWL(5_Z7d2UdLmX?_zmb~>=UBcelu)1-kd<_^^Ob_8D4ur9+(GrKG2 zt$N&XYaRx*+J1vqJqYZ*)zJd8V3uzi8h&P{1C5j!cNp6A0|5_h6kvw3pqBZ`>6rc?na?sn{tlBx9SsXj zVQ#p3i%dL$cSW<}yN3}p+T&$Tsac3hfg1zzsDm%8`c+nw@j|J2p|+QPV{}g%@n+K_ zPQA&TJ=NjY^X#bciKNy$(3enfwr!H|$2@-@lOnAQbnG1RC|v_v=Z_#6F{-2+90dM4 z1|jAXf1T(*8@db|-h3(^ILEPf@gIuC29fon9N1CTIjSl^#smI$m#>VTRGx>!%JRS1 z6a~gT>_=}zCfd;gf$^`8oQKDhuA@tbq`VUDGD54`4^Wiy1?<0AH}aotajFHj)}m2p z2K3VNcpvE(pOd8!h&3&97ovY39WDp!>-k>zi*MiXTa{;>3+6cbUTunzVDKT+(IIT1 z#@q}SrI=z3GH-_5{7ZyseqZ)7RuaqoQ`P!L;@56FmWRbvx#Jq~K-zo8E#yy9L+7MfdWQF?VSecUJJjufS(3f|O z&1v~fU*b2n-;C?-h7PiCGnUTlr^>n0M-Ds^G8Niig7k`F2J|GsHUJN_eB$g;oiv?A z?(@C34X&-)b_;c7!S1Pw&`!crS1esZoN0WgA8YS4-A&rT{&gkaRsnxC$8KC5g z$7mH9+RJQG^Db*!StvN}9M<2pFf-RBKR#D zn;#dXXDh`@YW>#JQc2VgTkcf`pC2Ewb!8sJ^$e#cH*=zA&CM02Zto-?l}yr>CG#Pp z^j|o7{B{z~_#i>p{;s5<|ID%Bf~FtskEMY>7QgWChU)wrn-?a_#jr%qMS=hw469}a zhyIDMfWXiD33GH>FO!-KR-uqD_n^ivU7<9rx>Uyrc`gSvrhy-#cm6LgcV;)NgE4)H zCmop}E}lC=j3>e8Vt$=1rdmrjpgP$_ua z>|U7ubEO$O4?;{Tmp~tUg)fq!E0^|*3^=AC7+x;F740P}@l0ImhY9fa%I|d=Y_#(# zh))?ORh$0YTY60^Qnhfx;RSGBesFyQgNjc~0Kd(t6zim#B&zXrA-njcvO|1i_hL6jN!h2LiD#)e09F&F0Dny?g8o#hx!Go~0njxj;jH z?Df7{)uM~puezm}44Fk5ji)M?K4w&TPx%Gp#&8@|Q3n1>sr4iqf*+SQqR+RqRHj zx{v(P5;ilkX6T|v*~|~O!*y=Z*X?2Io_3pJ!{Iu7XGbo0I1%xVt4|NGgQ)znHk+A` zhbN}OLyfO3n~gUt zQO#VjMsiKK7G8dSfTihAgN^XuRWI-dT$)3CMhh~>84y&hHMAuT?hf3A*4F=+=Q%&Y zdt>r_PG#=cw0;~lac)jEJtYee$AL1qzP>)}0z3_RTT`}d{XW;rqMl5_Dzve4d)^0g2u~k|ebq441ND}o* zOu;K^`x85-ON;&{rU^EpdR!aa$zg<_lRaH~anVOO@LBQ$&N<4A9VNowsA%a?Ao6NP zb~d9_D;g$s|6GV*Yn<1&`3}93_Fy0KPQG~E3nq#=mBF^~1j5~OC_2VK&ow*%<%UdR zF2!W&YJ7wlc}{x%JHIj_*;?g$c|ZB9m<5Zzm{4ddu0Ah6U)W>*1WXoc{KJsY#-;V% z-rjx^x!LdkZgJea8lS1cSra#Ad!(|hkn0gAXMOF1Xf%4VXc+SZSkJ5qG=x;MQNAI3 zj;vWkGs_P|-VhH*9^DV-<^iw+?Z75S7uS<(Qg?pf3rqdif@P?#&Ud-^g5yDEHk9-? zuzFS$zJZON_n$xh0v5&b?}wFmHjd>Hfb~47shOS4@a_^36~#WNxdfaCcwk@##>dO6 z6#jnm4qu1_7d|208SsYHH6~KUb~Ol#k~>aTUs(69V_Kz0=%}vJ-aP`dy1KeJKD9ZU z3XA~(4vr+sC%70TLx`pK4*TgXl~-Jx0u|t)Vuh%I1lXRdu~+fJG;mw}55oYn2(tc{ z!4sm%3Pb_S5$aY-DjLR`^j!tq$0OBGS#qg!{;@oqoUIsMsY=UKx4-QSf}N`?JVc@% z+y1zfmXW;4U@5Dxe`^-MKuKE?Fd1}Z#w}(lyu7@r2TvW`U#^q=2B13ullg6#Go-zp3v?r_HqC$@0f1LwwS9KoZKyj2v^SP-8NpfJjhnv)=oifC(zfeD*yv+G-*Ubq=+c>{8m5nxh=03@*ji5p$*UsQg1>-Lx6|;q zem*&}R1~ou+c#agco7LyxcUJ3T!sy+1&Dvk$t+mq2to8#t>S$2lc=xh;5AMgQWxPq zRwk7t4#jrQJv|L74z^KTPeZ&qFc%||x0-}Oo&77uJCpab`tG)C4b&c*A9hi4L`l@y zB7JzO_I^@eJg)5;u)BIGcXi6>JB-2=-i!}+?|gP%>`ls-G`Z;W@dK}&BUotHjv=fDlYzScc1~PK zP^W57&*ho8OF|OOATIy(4_F9vu#4Bf@<(FIV`5ma zbvMvGN4$`${h!2f0w5mJz#TdP!_LCLt0nPL=-nUf)zz9_BGCZEf(+2ibGMlUGGS`C z3=ztWO;(m#*-O5b%ZFpp)&brIJl)sPp=RTNoAU8iZaXDJ8g|8ZVL*22o@h6{)>G6) z^Y#jLs(OH4hBlv;F1Xqh+bzycn$9O0$>Vk~ixad`4VCs%iPkE0u(OhiI_d^8Uq-o@LZ+T~0?k8IYz`=*$kNcUCN2950 zh;#yhi<7#-q#>Z_?^aEPVg%1A%4z#ZL+Oj@^DHg#gNED4r>p8eXdgUSSr3-z8W<%0JtYtz zd3!{vQ#s;vz=?aj!dvGx9x#)Wnp8FhtSye67_{th&aTgn!rDP))RlCnZr|Ca)r!nC zk_iQ>eij_ zt|b3{>dYrhznV(n*J<4}d1$%>EuYog*4#-!?$*Ouc3bl4B-=u92f$2FPDoY=d6nrb z^kYO&8{_bSP9BtD2>xlFeZe`>*4$XZXJ`K059!v&CRK-v{9%P2Cm(=>TnXscpG`zn zhPwvJC-{=no~uomCAmT?pwCEs*dYvDW0%e*xIimVRXHM$gi}@Q?4h3wlIfL&j``N$ zg8GX7LoG>~^W)c?Mv{HtaMUfa{%UFVmeSk&AzGPpJZ%8L{WHU5M_mh9B~*)q=| zzB{zS{&0z689Ql7xf6?7-#DydAhPp{iz1k#$cAqc`%3rQx&vH(ihlU;#A zN3Y${dXuBgLk|dgbSo6Dp~sV9nR)WJ8kj)UmpaTpvzR2LBosd2#SAFoSVdaPM~vNw^7Lv!^aD*uUWL^ zh8xlIBS5j_W8@mx^cQN{Ke}*7HFk=u3L0;S zKS3p?QKQTxmBG&KeRaWd9S;hf360i(|N5=h?{@m**K>=$M5QKQ4VB6EDKH_85Zl}} z3y$=x^}$g{1p(ZHQ@_P$1FZzF30M`%;f;6=qRG~^s+X#=bR0e+4}lrDNNFP$Yl znveHnEifPrp6vJbZHSXz2{s2$%i95i!^(Uy;0Y7OUeAo-)8w9fB6Oj>&CQ0;MdC!o z6T&9ulL!JiGMygxD5`aGNdFAsa}nw()|!?5SY!OeL_tpMz0A<(fBfaj*X^S+Re!RT zGEqXx*j~VTZNpYU+eU#ZVAd!$|8Lcit#fYQr2o0*3N(Sj$gJI*38!jT5*=uXBxDgVpk2?&6M zTu7U^C^bika22EqVPL%)kBad5jYDSumr03%uVCGBd?y>HKUAV&7Jr-nBOFm6=0@&4 zjUMI6F2wmkK8E13!RC<*+rQ^VY$h}rudNvYAKLRnF|<;-s|QN=u*wjtkc7M#?kR*U z$mZ#m8gMA;57$U7ujq(K^A@QCvv($|`;Eg^_QKqWBJ{yr0U!Y8PPk4qVPz-Vm?E>j z19eLOT+lLIHXUJD+mZh>tXGWUow(`EQ|+Mi30GycWV8( z*FrMHNLE8I1Wo7F#~&&)UuJ6oKQYI!*Khpsw|@%4j5d5trHg*)V?fF?E3n4$^SPCU z<)ytkS>{ufuc3ISvLy7shf8il|Jx7-`16vIl3S&%SbnMXe>iy=2atUJ2cYX;4JH3M zg1Zl`&tkx~=E<&KJqH?9eo{eV^?hh<$%9)*J2jWR=m79PzyK69qYa@XWM&*Tj2!DoCtw%Xw%T_WPY zhka2%7TX7TN#*7mq#jDjKNl?X*^^RgS??Uhy(&Ek*rfNtaQ!H2uvxKIf7HWtu zYCD0;$;@Uxa!)Ft^v#T<6kN8574_#wu}M`eUXOUS#PrJCs4oog6Qp@hMsrCNlNsNJ z;Ifpa0m;X7Ry$t=JDYmkO%GR(qaS(+W0xOnWi$0`V4DR~oI&>bP)}I)V-SW9aL5u3 zY@jmeG)5J8@MT;M9f0XjuogCIK@6Pwjb+^ z9p~{*XB&P%nQ?!5_c#pToIiDGdZx{QHcV+&}%;a_aL_-Uf++PNJFN~LynK!4hA5L2l z6CnvyidSGYy{U*DW$LWeWvyVN6d_fmf5Rh=xbkmX3ic&xnzGiJ&)U3|M zQmR(`EjKqlK$0HhO6q_K z%`6Ykc>6%UfJFRP>sW|)@wGk6CvI-p=E(}{^$G^oY0V*ig`@8U98MR=L-pP$kv@BC z-HP&7mzvd2O)m7F#oLizE{>OfH07u#o;jh+Wa2pyMEBo9)~<}7FATr=SB60dj}ak7KT3J|kT z?z`%Edlhpt#d@xw8`c&Pf~)hJR^gb1J*@vr=5qFKr-g`E-S92XOEKh_JWQE}%fLWw8~$&;KeuY&DM9X;QoQLFZz?xwoL)@cD1my2`Udi0dp7 z9@kF=TKcAWx{+nL%3FomkyQ=Mx5kdT@@lI;^Z?G{5Rr^lnym|fa4aQ?XM#gWwt^7wSzvw^e1r2$=6gAflxU* z#se&9I|NfB0eTPiF4THsts&ch5I6___KHgO0%9bSmCDuvPsF`X>Z;?~j_-5A|C3>$ z>i}4lP-zp9m?pj>08W)?R&VRKyfNGHw$wl16G6bJ!3;_GloiFjIaXVHcNO{q;AnN) zZJT$?8#~7lQGLEXF#K|VwwlQq1Q#l>rPcoB5R?KFz^W)U-8S}r?P9-I=o!<|6JLT3l(GQaPvHSk)P*`gldUa^SU9P{Ea`fxuuhKSi3Qqv6C?lH3KG&@C_ zmwYPuEZ*}~Yx*VO;-OR5;U7SK2uSYzL|h{_ehjvOQRtsW@+ZkdSGnKh9T$Ql`@Uv2 zt)xoorjOnPlMdo)8;;$yMbUl2mZ8?OE4=2D+{AaucV{Ptx(e-cZxm7^mR{W)kIK+? z)&zXLFU2WqFyR>oDzjg;s&uMZijea&e_jan(%rQaM-GP7F;I3n<$JZtsrNc+>-{gL zZ0>^Iu1iX%45zL=&cff9Ty1rV!Qfjj4I|1`SW(SdrTtFG3wjh9AfAJLSLN(T$`Xp~1(17E1$#fuPF$`xgj%-FRkRS*T~xGHbXTYEkojK*pZa2$wmymz z06YTFX}MWTXoZ50g$7&sw~ezz^+)bG#uf?dnV46Rhsc{ysb#*(O?oWc>E$rXq%Y{h2yS1rogM6t0o^ zHnhyHA^z_EE~q^-`%2<)hzcDTf+?h906qNHp!bXEw9SoQ&ynVI`)^2%?x_cSh;}n} zoB+~1P;3;YOvCoCg9p%9@D3)`JE&De!}=C1_#MOh2ci(xSnArTsKa6eS^UAJzrSA% zMQ?WjL~qIFF+3g*63|{*wzyV`nTjb_2621DmTfnq{ryim>eH<6!vsoGh=kkbYdSe7 z+WpRUg@|G~9@N7s&|aJOji=J5^~STsh>(MP6i)@}WoAvF|2n{Mg8<5Q8EBnI9ZDl8 zC?E5j9b*L=+HHST_iD?h?2|jPpke#xr-&9QugT@stL*v!n}MhR&_Z4Ic|fJNwZsEY zyxAFum#V7PRHrnvgbu-m_qMvXKUzI!E3q?D}{A2#jB_-cSFI+W3h z>}HQ}8{^|&KxhChQk2`jTcpr8Ooe@Bof7jTJLftIxhgt-RD2WwePJH67KQ*Hx3&GIMAalS1`Qhxr>4h6e*>tBkQaXf z)pQ#-m#5RKU&fq5fnv+8dz3DcUk=Tb`f>EPv?tI>asG`&xf0mQ@rwwxsfVzds|umv=9Rae^57{_7Q$vqN}>;O_YhQzN|l{e82acQc4HJ z#rePc3}HzOnZzyzpY2@n6CVaI<+FR)jWvLJp&Km(vB<*ss9!ZA(850->Zc5GR*U?4<;IyM~UAj?LL? zq_00OJ8tn++?0?=01)CP@@SEMnc!mo_uHiMpO=;q{ngUwJg8mfeDWxY3FLU5mvpVbyoP_?q}P z@Y5&{mpiOIUvy^HJxU7*4k9Qpf>;l_b7w1iLZ6AFS|pz%H>P^Aw|f2@1LR{esHLkY z1`z1r?X~M2*_V-q^JLP_4><3gV)gFMA1buq<=5Q-96Cscu`}R~#n*13{WI z!VdwQNNMoVm4m+Y4W@Q3c2ibKZSaYA#L@d+pf>oJGymU1?}lLjdt;E=^)#z1f%NDZ zzyhmgsjc^o?vLb4RS1uvK~ETTTQah;gy?sT(%}Vo!x?~wava|5Jrk?F z`GzX)P)hBk%!?tKKS>X@+pe2Y2DDKU>-w=Rb&?ouxr2Y0Yx&?+x=LA; z)=yc5u3Ky!h(ZJxEpaE)?G>~w#q@G5n5pe@d`!nM8*M^cJG%XznKn?j-Mg(l_YM}- zM0O$9o!a*Lg66AozQ`Z0RdpSY&PX>SZ`mj@$n&mQwdcR}k1uO%)f#AHMVt~>Al{BtKf`|W{!kbWbYz=xu;rw#a7Xp_k=LTC5}zr9LaQ2-&XiJhuRnY-AI`N z>0|hKLHFS;`QZ~@$C{(V-7RQT6Kq5Mk7fDeCVEV@yscO34$1j^tqp5xvoG-avQTew z;Fy&Qju@x28y~f2yVbeGPn$_@>j#Bf%5mYp*Q(i8sOcp%EIX#$GkLYRQ0QW|(Cscl zdQc}7UmL;Rt6i0e(ps)G!*0%J@``b9agLvsk(?JDQ2)?#q~wa-aD--?@aPjv+;_icg~_nZDD2*(!!^AMh0)s<>m5eY z%Ul*wGOONc6-dYRg=)SX9$rJk3BPBHsBQpFs7jjxsv@w5{B%9S>kj+saRKgNz2cZ3 zA_L6?-5E6v@unQvk1fcRZ9mvh|1AT0_;U<2sQ}pC)KHIWhGPo?(huzj;w8)$th3%WZ|o``nP&Jb;pk`|#jd4p&B4m#b_i7-Tj zTjd_{pZl2|)pTL#fgsu|u!p0E|IB8P#gR`cV@@&LA>dtBm^Y(_~KRjH9x$$N= zX6<5)AK~g;7=x+qpx4hG`UH^AbZ_oE@ok*skB7OmC=lp&DZVCbgV0dRfTQT?7X z1j1BF`)|)rOsXXWBCW4+P5F+8$yD#QGl!Mm@41bc`F(5O^b-S$6aL}-nIyoa;pn-- z$m)N2|K7={_s>Imhr6BP>d(Lrq6`DxNLCqskr0R9YrjzyZf|KPenN~Wn0-F+qyG7N zd7Tw;@!rO|Lus*U6Di((+3RiL$tk1Iv-TBBi(|jAX?r0}U1)AdTx&A|qLi}n1eTSR z)lgp__G{Qyy8Lu3hn21<%iXFUH~D%huviNVm9lWiV<}{TqqFnEaxW?=mw5l;Hq|=2 zTzq!k);h*7ZRRlFsf8Q;p#v9KoYx2DKHdFLESvk~%O?{gL@5*o-<+l*9=QyaHTt>X zN8hS&Z66L@mTAY1`OLi$;IX|1L2F}>D1DV zeUOJd@X|-N>(a3mS)3{nb#)6VT+>nq()db#t`?@~4N()b4CGjg6q&Qqzti8kFnGa$iWA24GMczU9>*cC zxVjD)ZgWq?6)Cn#qIy5p*K8Y4HxP<1m0lS6@Z&R8Vu*nR)43>Z9Nt~osMs$roWCkQ zo)$PUvJ^3O)-cH7aPoNnx9OMJ9^X6Uqb?qJEZarAkt8;G^r2ea*2f-8!qpIFr(x`| zqV(e@5=0-GO|eOtC-;W=#4P+8zE!yiZ)MmDW@fsau~ne4A$51^M`7TY zlt0^7=FP=ap2;b+Vm%aaPL1Sy-@QmfRT?^~ZT)BK zbp|h6dES@pA%?pT3sXyf^HDZzyk6uLIdVP=H1{7<-M%PEu#fz0?@T&duRhL`qOs@P zIn))mqQ%YepLmO5zc+RI=pxuX?V6}I?U41Q^dz1;(QyysSv~}w!C_8(7xRd#Hm-?G zouc?6SbSfk8&XE^Z5TomD^8qpKYdSGmPGW)b+@s(xOyJ)n28@{ct-I2yx@b6dygTX z;~F2Tp1D|MT3PejX}gL&pt~p0Pv3(}W@+F>Yxn6Xwss+@m=w*pif4TY>`>J$^Wpj} zrGqSfg4xH*;|Cc|G9(w2H;`3ze`mb@=%yRH~%#1L#s$(pO37E=%H74Huy6WMW?|4JbX!_f8WT#u&sQGn0$cF2_o~?gDOZK!l9H0RXE-t{KR5V4!x%?UqrGzXKqTM7j@a7T z{+OeX=cl2iKs&^_NqBbrE&6AYYlLQgQc| z%=78kjCKQJ=`yHhEPf_%ZjrahrQMDY^H z)0c<)wCC(A|5qyM9zK}U5tqF zCsZVVPjvZySG=et>pvi)MRtNuV|JD269miI#u9kVUgfrvx;uyB{zrGbe3YN z*3uZQjJuplADa;y@KP_|8<)@E2l+y4*e(y>y?d7gWj;qh#}C5-coVKDfDBou=}=rs z=!u46>f9Ue{@S+|-f@=0Fv~%or0JztDDUh1dAq5Nba;upPaTd#7vZF>vnu@f@?I0O zx+dD~guXNj+UY}$>pN;y4MtO#rGySf*cHeV#D}6yQ7AoO#m6q6aN)F+V!0BHD2lPQ ztcz_ziul+&h;fuw;k#o7)|S>fYKOB)znITOqvPvg0ZUH|FQ9+cx&*xmmksPPET{=2 zU#xFJ<~+(|w6xDX9pl!mCr^(U97fj%OJ&cHjqHJ)&obi418$6(Hn`Q})+?pFE6SUE>1*RVdxoPv5%ew!2hLl=`xvZMV5H7)P4eFQ63X!M&;bx%uGNP;BlsTDL8 zU*1%@{+cEJ;YXyv-4FttLP|8+Cdjgq9lVQ2lgjz4_|-_(5SsC%>_I{(BZ8b`J=lU{kHJc$8Dc*%QcFfch0DC1q_yYd?`7>d4FvJhx_^S*J&TN95@Pp&Wq;09EZ~^jmJ6e2Y2H` zUPc`uUciXQX-g%l?4m8?M-ZY0`kJ2SvQ5L5cb|!FMMNZZMdjZPs)vC% zXOh2B?p=QS+nD}17xIu=6T(mldK7iKtQ$Scv!V%oBCkyQIG#)#d+BX5-C)C>C${s& zIFSW^ZM*oZ-uJxuF~v4Z$yot*QHxHYOOelYywd|G8vX?HD59P9Bh`+tn4X<|${+r8 zh1G_e1HA9s??8r6IIR18`_Dn>+(-xOOliA2Qtp=Q6|aD{pURY{=Wqqv8VHKkX7h}Vc^xlN$u^LBqH@hD$5u2g_s+pj1q-qjRf6ED3wRC%C*u(ix zpF0xocAu3`DgFb?_dVG~tV+0|xVvnH((2XE&FEz59lE*xy{Be3^l_?)~x z;hyp090l)Uq0h|l{R6RBA*iEQAVWc+i31% z4B$98yNI*nO^ElKg?&*dNU^Qo=+7d zkq`moA!r@y5ajSDnxpJhmju^n?#Fi${%@B`cR-O;7yjRG|BQFEva&kNnXH?Z`kw2r z=NcJt2pt`MU8boPC|x@<@`43;s|bc0oAOCK<$HhHWA=Z?d;e>{dy&=O*>_yBDHlHZ zG1H-b1RuEWfyUZIzE(oA$h?e2<`!Jx(5*M2AIW{*9(v+KxgJABLx+DnzA? zncPybx7e}utdo}u{DsotP6fZI!`toCw}O1)?uW6JlbEyRI5~FKcMLx}qtok^JEL8? zR+A=dIxUmIDbO3M3LRe0z8ccub_mYEE4O+SdO*07U$>pC@AUeO=}`VcD+599ZRXJx zu?zpTi;s={ev8)R+?Kh+BthwWM^Bt0D@UI@D%8&2E)+F|>YUGCkABJDG@!t_8?C@& zy%+mH+6tD&+2+kK`J~dmj4rce+G-6;*Ko>A&Tr#0ESA)EQcd=Svi~ZtTGz=J@fsy@ z`Q2H7;F$EkRuq}nN~Ai8MCGopT5CP~K+;Kl;TC#4(C$@_#_X}T z8;j1Td#-7}UdRe!-id%!*EtjG{1DMyTh5OB=73w8GycDZ$6i7BW-x_CcuD@7OWRJw z>|KCmWo8=3lu9Vb)Vj18mCWIG)9DjW=$>=R|88CfVYUMM`II*DDjz0K_*-GnjBJAFL>Kb*914 zuaEc99w>o@k50!3$9TrCJeo?aP4w!kt+-VxQTIx(@EOPzu`xv@taR!=be;MYBQ*+2 zG3$+eE7)y->7QH!i<L!DIHf z9p#Db0sA_w_UWmd8lNRUHa;koSre$7buU_A(aD| z4;aDgU%>Wqx`~3Vq1nsZ>T>4AiWH;ax0bnJ%Q|r9I>pz+~m8ZXE768ykcbgz6b-5Bw%j40gN(D7Gn4GK&9 z;8={XD8o?(YSVg)O1ZE%*I_T`Qy709nFu|sz85&HGW2>)o7Fyms(6!LlXJyR<(a}a zkj(a-|)E0se`9}#H{tws@3l@_zShf{y)alE=iElGjW*AVXeJgU75@*XQ z0U4b3^HnR`q;Dms8}Z2SB!k+N<2ZG)5ce=awuUXBp9v|Tz=Y*WJB@vHvEylApceD! zI-}?4T4tg;jJ}xBvz=?~ne!59(k|fq$;U%$h5%rdaCJqLEh`~_i4GwPb4s&>*f-|e z>kH+8ktMYGwl3YkFQ!Z(5#0DKwK^U)w% zB18iC)^aM22tELi=Qmx2Ky1-dn;2`avwkyqv8Pmp{Yo5l%BucGdJnl2wZAggID!^fS_2k8Dq zI`G}R3>S98YPDtbxkxv!(-l7}7iVX^vWb_k={srgg8t+yrBm-{&E=6^=c0&ghxEIg zk9JnxWl!0qL~%8iPE4^rXaGq@p*>%eY|_x>Lh>gLx%cy+B-Db)=uV1j!|!V zdc>mNeeczg`9U%h^<;6IeXBfX*mQLsc2k9SXPYooVSc{UP;>{=`|)TxnbtO@QSb~9 z?d+`28VKEI%RGm&p1zK#rijZkzgLA$469xK`|K4(MeOE6tgZjAwjiS^63_ccMuu$B zsr=W6`>$?366x*{u>!RwJ1Z-_5i)reSOdF6bw#49&7qhEBkWe)ZIG_WZ;Os-d#qbu zL0ujs+pnZNS{VEJ5FcjlHM*N$WA}8*10Vga90fb`@uTr!DqH<%#rDMOZRY`2kUcVa zb^O8^<_88x^o>QP@;6!wJ!f;nH9foS@UyF(UKv3R(4T1zH`Y+g%yX&dwld0kCVP?6|4V8iKzZ z&1)Z3xmY2We7yiH);bas^>*--*g|Gv6t5&b23!IRxnAl&b^EM2`n(ZaD`}MB98Wh$ z>DrwMDQV6ADB+lU_wL=^-4!}sPi#^A)LZ8d)L^ByzRiV3&x03i3*@~Ps*Mk1)Yz5k z3A~6+69FsO19#D~`5c1lzjmq7Op1rUs?o$Aaly7s-p6_E5ju9PH`$j~wF&H|sU2r? z>AqnsE-l^dOF26AlE$Se2oQ^aM0VIYID`uY&Z=FKHKQ)Irle$Pr?Q^iaW>AO3R{oq z>a=~dEY<>Qjp&TilZr0OAey6&C2v%0Pv_}w14poBxW&i5fS4KNwRlF0%03a0uE7%9 zX*yEpD3C_dI8{L^L#?p_0==2WhXRQ-4kyI&=fx|*L2GDA&=OZmP>SZn2>4ibw5M0K z-1cy0WYihLOZunE8JN#%8b=Fw{_x3N8EW#LVJwX*^P~(_Y&UL8FAMutH04`ctgC4Q zYhDb5W%sU{+uLiEW#v4lJ^cY@ejyi+$LHkSYWQ?_W4NE`&qd!PA?sfQ13VS?9?Z~< zLwO3Mn(w1@NG_IR0Zj99UsL>a6-Yz4XU5;g_>p5xdXn(TNf5Za}bk8Bv8rMKaRT zDSm@&vQ?X#r5;N*+?vgZE5sb!&6_t>ek_nN-yeu69>65(rZpixe8M?C_k;rIHibDa z8WC%zLzTBg9@=@Q<{N-)0NOeZc(^G3m>V5+iirYh%0%Y{d{s?|PGuTFss4T%c}NbB zwztu+k&@925**7{mTbG?RQzE0S%VJO8@q^llJElzntL)1=XlKk`61G-ZS40~r+7i9 zsXpx{V&=m^WgG4skU4^?)uF?ma;}D8$mPO=@3Xz{7v)MM;=Trfuk+meLo`@BZhOsj zKmzZ;BKMx5^mkPHxTYA>(e`De$y`Wv#N z0qzWq?khDYuc9`?YNwV8L~QTkX0DwQ?Npm?I^#&6)xdHzCyZk8?TN3U%}0eP;TeKl1!{_ z^MVzHR#W4btTz6>^A^XAHmh^oY?~2Bx|kL1s0`oCa~1sjKB77eog~{$r@T6p+omYsVKb535Wf%sZr7`+U5ICiRBoKuh|Gi< zv+W*QAguQ5HQS*T-uVY8G?LK7+_GtBR^AuS*?+b8$Rg$f%y9|+7FOFm{RwCPKkX=% zC-hF{w)OE!Xc{u2ZGWImFG3N4^l)=oKtuI6i73l-lKeY{WN3*^{D<&HZVGTFi)m#X zjCkPQRkhm5HL%b}Q;{<^G`Ej9y?Z!lZWfCjFWJAtk~rz^{olAEu@rYb`1qQl^8U@+ z(&BJ5UDWvC2?RZ0!S#ShA~<|eJ4#hm6~Iz+HMf%!Mkbch>g%<37h*?gX=xcv%G+UZ zZ{EFF?d<__1@ZU@ylz1{QWmossr9eX_NLb)83(ciohxz^LzjEoRhIeZyg+VJZ>#_GcK&WO9KB zUgeh?pTbTm=dpmh_-r1NDo(W$yZ$%&D1O=*gp2TN3<)#^wx@rt|FK=vUM;IbKX#V( zFR5O6Cur4nG&+!`{@W^XIv;eL2xF(NF+~J@Y(YQr^^N{ps03be1dzC8Ysut~9^;@$ zMN@m-LFM}!vA30xe~aJ$kC^>mL;D5%^PNk5=)=)fC3nc3opCsk>!6NR!i47BFUdNs z%ANYxNc=bI-mWodo+w_mE#v0hn8~&8L}=j z$F?)QyLWn<{l+tr*=yK~^4>ez-LMzSbNu4{kvC|S_?ndE$|!W0t)U&h$a^=N9Mpk} z0E`i2kuTgg;qUY_erlFKO1;6y%j%aQ+=AHdwx57A&cJ*tL@em;3ZAz!7Vu7PuznHl zvXmE1$RYLJT6B*TO5HCt1=~{4742Fx(A|Au$*6k76g^MAw2Pyw$pFq+?t@R((J>AW zJKD?|NY)@Bb}7;IX8=^H4@Hr=|u+80ub(l5_cbZB;3DX$onDR`-4t<{~Kh0`7ocf+k9VminWwx|&7@>CuV*taI z`yj^l0ZU!{2^!}&l0KQ(ox4q2XDSY8aJ@=%EaA`CVn%fo`JAdJXlPc1zzR1)q1fje zIAvUwu<>?q71 zzJ_Tj;@y$fcHdV*OB|JbaiEI)z+>Vo()C8Qp~i%*A8nWuW%lT8a#a(P{dB!xo0LI8 zc!~4Ul+6dgzPTc2+d!iNXnEl5q2kz851(&73IYw~&7gZJs3%H^sR`CkE@Mg z)?+0r9(ri+Urm_TvpT;677E_cpULJtq2Vn~UGpscDhAX^9H4kI#ccKZ3mC<~_bR zQ{D>m6jl8U?U#>y;+#n6vWG5hC3x4uUc44eal_2VY{AD-=V~z*I4z7{o(JwcutmH- ziFb4dIGmSD)JkS(3vnK}_q$%$k%(1=mi5(N1hQL^&KNriiFcHqVa<<;UTn!-8}1r) z=#9DkU)C02dOh$vl~brU_EsZ4Ew-$!qB2h(ny}F!^}=n|*|4A6(504e-@?MTHzJ%e z3VnNpZaCKP4w99{#jP@N%~DV5qJ_o#wJNsrZ@}l5U`IITH`LigHx+aNEh4sUD~JM} za9$2AZ>tv+2c~GCNqeYvdN1fbX}~589O%!V zCEPMZBG1e>g)3I&YRMA7*Uhen>PB6YT(N@?r21>Ic0V?BYu!R$E-rhnEB zA1MUcsm-JyXZqVS1~7y0n%9Oe1!HNnDSmd#@kVz{L`0#Of})}@Y<*&QzY!3L9`++Y z*msn#nQV%ece<+?AIu4+XCXl}cgQ(lFMQJxR{}{s~*F8WxpwUb~ z@ikxZUZKf=G^$`9zq=Xp;s+V1JQ@2zzxr=ah9?qJ?C<22@Q=`ybo;?RMmQeu4e&7@ zV|bm`ds;+lbsy!AiW=F(ml!BSJd~7}lf4F&1KI5&5@>2CSt@X_7)JOc8ms{we+qw# z5#BSk^Z90kpja~^BGiEYl1exGb(`Eg66~P;FRgTc0p_74+l1iqUTVC*?Hqm>2>*Yi zqmpss^z4oV+%UVZLdfYfCdlu~(qv6682*s|Xs|ZNd)z@kRg^MCB?}%3?)l`l?0$$< zX!FrR`0UU5npCEmv|jsT@GyxY?BL-7pT%k_)mO?3*2TYBIH6G4{p@24@!gIYKA5Jj zZvWHq6x-;rFoaQP2@3O;fFo05PruU$DSHd$v)4-2+3F*cvOI6D4#IR)waEkC@44TI1%5No}qQ%y}2s=%W5=PBL3F^_U=t>-P zIqj#8f_bX+GSU$1vhCS^mWVA>ZG6bgx`sI%Sjw_=XG<;xmqs_Uta$}$ESCFD!u)Ud z3m?>@5Z#q~^w_sBrFIVSr%7S=d0d-Oot>HG)*E0EF1c9GuNjKwmRqb|h36uc(t522 z(_qCzKk*_~bk|m!w1%>&?YL(EO!g_v?e||V0DzZ?1Br&xTxJY#l_!7Qky9Be=ZL1e zFFGEeI0mL&?{j&MrU*AG@B^;e;NwU=O7k?@!!NU~XI^rMMN0u;1`J3Xr1|(Uh2?2U z*F6wj5V+M7T+-K|%&z@+-tRewLvz2mOp|@+DC0S7Z#4vY2s1f(aP(~ z&?*1Yg*9{G&|0t#zN5?UNa;r7pKBn$a2TS z4=3xvzz|4oE;;X5P1|!cpFg90#~4~sEa#l>II-3mY@?>nN8&C2%*Muv9MBQ`3Unk@ z021ydV^_Z6Ows_E!wiYnh?7y%O08rqwvDRH1-etxg+0H0|5g;4_I5sg%?<9UVhe}IJzc%5{R8;#g6Z8Jm zJG02ek6D4*cpRrZX!DKLE+*3YPQX*at%6~-Int?|f~{geY6>Y>XCTbI_tnP^EjRrj zA11+mT_dRYzG6Es#s7(d5oR8GHbvb(`rz5U=>}3kiWzO}aYpyH??Ffnh<+aAYJXqx zdS^*1z>K0%KyC7yzpVi#!z>ZMl#7%;7t}JNGM(qor&k2$3o#nEtz-|297-%k6_xds zR#zrrz@+4@Gf6mgAfUfh{JfQNDBkc4lCF%=r%r_QL?-szINo-%^;^Gh@BR7~!9L!I zg6ns92US*#jc=bQsqt;AOmd{z545As2g8V`Kz~)G&y&_Hd^>vmkM+gM(MwDDX}M&C zsC`3pve}RhThJ*Q7y_X0uAQCT$ugRtUD@_pKXTp4QL!Bt|F&B%yb??mM-_@?DeQX; z%JmgXJEAwO5$rg=ju+6|l1ST(i;-_Gjk6Z>i^n(}PHHx#;Fhze^7CNHpmk>&i_J8m zB0=lU3GjEGU97^ zu;YhUM%_){Y%ioJ(#FK9MuvW@)H=J9ZZe$*h+YPaizUsyUG!x+nl}i%bedc*II(n) zLkUXxw6wI8`)WXL)TBKqUXwfuW-7h^_Ue8g1PT_IlndY;32~=_5KLNPbrX+2e#(c| zsjCv&?bLy0dsKdYz8i?>u~R_9E)}13;v3D(D^jVDSqTmH%dl^(qjeviCHdIk9XF=o zR3vxLHR#*D=7EKUg@z5O-)g#p%YB!+f-$MTB7nwUP+XjDa`USOXtj0z%kbF!e$a(8 z1OG^C(5XV7eE&}`AM_Dv^Lc+7nlx5#R>Nqo8G!?4v-NwEou*WOkxyYLxy}T}eBRLh zW`JC!^+Eg9&A-U=_~V;+0K|C%qXUWS&?nD#z(NT?Kq7Rh49!Yk9t|=~eZnabcL0Vl zSht}r9T23G*6Vb*+T3y^fSAS}+(Mg7X&m{z2|;^t z&Uus}^FP?n1s_z{@{%7DdODrl%B@R8EBu>=_}I6v@J!*d$og_VCo^EGMiB??Wm*G!Y6C@ttC&%`JIf^NtVJl34v|Y)xcip*hz&e`9j4D8dpkwqfew- z7b&z0NHz3@rgfcaMpVl5Y~{Os-uz~xpoaA3uT#|RVA=}oMP3djPj>M=&|>G6e&5kf zY)ZyCZLfE`5_}is4!gbVQ|V?n(two`s_pF9W*^RMOKT>x?jhR@ji}jpd1bn1n6{Pk zbO8l-*CMImd=x1O=|)qTn%9(q`c0dX6t~5@37B_J4rd1pZAsr~_izaO`dm#vvHoyf zwFLniH}=yUv1MC4O0F;*%tBJF54J7~K3m>Kmz+V;4{hYDj4n1w*EG8Nnd|xM=EULI zf>r;SW$*kq&&wZy5^ncq`Q?DjANNmuPRu1}v%%O49C=l%I&stkPpDTTV@(zuy0;dl z&C&6+!~P)Gua+KEJwM2WOsg*5kI5tSIr$fyh~g6Q zIE#$xah>cXhexod*Mkw{|WZ( ze5dVd=VQ{0ZZ8#{XA0j6q)y}k@xqNcaU)kX>=c3h##e=K$hxisPky97d6s!qY&-=xDj5RV+&sL9NLcld)Q=rhiEMdXKOqb6uzOn#q?ZD7Tp^fW3%^Nr;Ypi`iD@?U7 zOml0;KfEH=BaYBSJ9F?Gk+E*A;mItV`DSRYlWv7lBHcJkUzQedUo10GWBxg3i+Z!6 zD!kIkav&FjB$jAGMhRpX1m8>56?3A@IKIL+nNom&-3QnGd7rzpjks9hu1-(I6IS<) z1^$qHmcRI^;tgua>;Y7V)&pT*lY0@P2&nNqvI6(z%Qsb-K%9l_&W754wae%}P}@0x ziDo(o2S(8irekxOZ+qc$_U+!AfaAQfv!b)`$*()7y2O`Ur6?R-&*~k~5D`D%i9{a< zk7w(q0Zt2mNNOVlcol^9n~FWOUs3F({cd7E?Z*{|AY*o - + +[eUICCs CSP](euiccs-csp.md) +

      Added the following node in Windows 10, version 1803:

      +
        +
      • IsEnabled
        • +
      + + [Understanding ADMX-backed policies](understanding-admx-backed-policies.md)

      Added the following videos:

        From 3a5a7d6a9b431f0fb987f1d2ecb5da11552c22e7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 6 Mar 2018 14:50:28 -0800 Subject: [PATCH 087/119] update note in restore files from quarantine --- ...le-alerts-windows-defender-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index 6708631bb3..c3162d20c2 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/09/2017 +ms.date: 03/06/2018 --- # Take response actions on a file @@ -48,7 +48,7 @@ The **Stop and Quarantine File** action includes stopping running processes, qua The action takes effect on machines with Windows 10, version 1703 or later, where the file was observed in the last 30 days. >[!NOTE] ->You’ll be able to remove the file from quarantine at any time. +>You’ll be able to restore the file from quarantine at any time. ### Stop and quarantine files 1. Select the file you want to stop and quarantine. You can select a file from any of the following views or use the Search box: @@ -101,7 +101,7 @@ You can roll back and remove a file from quarantine if you’ve determined that ``` > [!NOTE] -> Windows Defender ATP will remove all files that were quarantined on this machine in the last 30 days. +> Windows Defender ATP will restore all files that were quarantined on this machine in the last 30 days. ## Block files in your network You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization. From 6386aa97e57d0451ef902937c600e83e2abb756a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 6 Mar 2018 16:00:07 -0800 Subject: [PATCH 088/119] add line to access threat analytics --- ...at-analytics-windows-defender-advanced-threat-protection.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md index 6fa550565a..e2bb30d5ac 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md @@ -45,6 +45,9 @@ Threat analytics helps you continually assess and control risk exposure to Spect - **Microcode mitigation**: Identifies machines that have installed the necessary microcode updates or those that do not require them - **Overall mitigation status**: Identifies the completeness by which machines have mitigated against the Spectre and Meltdown exploits + +To access Threat analytics, from the navigation pane select **Dashboards** > **Threat analytics**. + Click a section of each chart to get a list of the machines in the corresponding mitigation status. From f86abfb7d629815a9ebf7773b1a3089cdca23a09 Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Wed, 7 Mar 2018 14:05:31 +0000 Subject: [PATCH 089/119] Updating CEIPEnabled column The first table incorrectly states that the default value for CEIPEnabled is "False". On Windows 7 machines it's "True". --- mdop/uev-v1/deploying-the-ue-v-agent.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mdop/uev-v1/deploying-the-ue-v-agent.md b/mdop/uev-v1/deploying-the-ue-v-agent.md index df6cebfaaa..8656b04ed5 100644 --- a/mdop/uev-v1/deploying-the-ue-v-agent.md +++ b/mdop/uev-v1/deploying-the-ue-v-agent.md @@ -82,7 +82,8 @@ The Microsoft User Experience Virtualization (UE-V) agent must run on each compu

        CEIPEnabled

        Specifies the setting for participation in the Customer Experience Improvement program. If set to true, then installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to false, then no information is uploaded.

        True | False

        -

        Default: False

        +

        Default: False

        +

        On Windows 7: True

        From 474847d53043dec9d1f605a20673023de61f5aa5 Mon Sep 17 00:00:00 2001 From: Barry Langer Date: Wed, 7 Mar 2018 09:55:40 -0800 Subject: [PATCH 090/119] removing note about Azure AD conditional access --- .../surface-hub/manage-settings-with-mdm-for-surface-hub.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 735c1a071f..238158def7 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub, mobility author: jdeckerms ms.author: jdecker -ms.date: 02/16/2018 +ms.date: 03/07/2018 ms.localizationpriority: medium --- @@ -24,9 +24,6 @@ Surface Hub has been validated with Microsoft’s first-party MDM providers: You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol. ->[!NOTE] ->[Azure Active Directory conditional access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access) is not currently available for Surface Hub devices. - ## Enroll a Surface Hub into MDM You can enroll your Surface Hubs using bulk or manual enrollment. From 03c7e994c5598f35dfbb9cb0e253d12a79d0378f Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 7 Mar 2018 22:45:39 +0000 Subject: [PATCH 091/119] Merged PR 6230: Added video walkthrough about ADMX-backed policies --- .../mdm/enable-admx-backed-policies-in-mdm.md | 12 +++++++++- .../mdm/understanding-admx-backed-policies.md | 23 ++++--------------- 2 files changed, 15 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index beaaf83a87..3cbe681524 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -297,4 +297,14 @@ The \ payload is empty. Here an example to set AppVirtualization/Publishin -``` \ No newline at end of file +``` + +## Video walkthrough + +Here is a video of how to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune. + +> [!VIDEO https://www.microsoft.com/showcase/video.aspx?uuid=bdc9b54b-11b0-4bdb-a022-c339d16e7121] + +Here is a video of how to import a custom ADMX file to a device using Intune. + +> [!VIDEO https://www.microsoft.com/showcase/video.aspx?uuid=a59888b1-429f-4a49-8570-c39a143d9a73] \ No newline at end of file diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 6e079fbf78..16f22e3436 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -15,23 +15,6 @@ Due to increased simplicity and the ease with which devices can be targeted, ent Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support will be expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the Policy configuration service provider (CSP). This expanded access ensures that enterprises do not need to compromise security of their devices in the cloud. -## In this section - -- [Background](#background) -- [ADMX files and the Group Policy Editor](#admx-files-and-the-group-policy-editor) -- [ADMX-backed policy examples](#admx-backed-policy-examples) - - [Enabling a policy](#enabling-a-policy) - - [Disabling a policy](#disabling-a-policy) - - [Setting a policy to not configured](#setting-a-policy-to-not-configured) -- [Sample SyncML for various ADMX elements](#sample-syncml-for-various-admx-elements) - - [Text Element](#text-element) - - [MultiText Element](#multitext-element) - - [List Element (and its variations)](#list-element) - - [No Elements](#no-elements) - - [Enum](#enum) - - [Decimal Element](#decimal-element) - - [Boolean Element](#boolean-element) - ## Background In addition to standard policies, the Policy CSP can now also handle ADMX-backed policies. In an ADMX-backed policy, an administrative template contains the metadata of a Window Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](https://technet.microsoft.com/en-us/library/cc753471(v=ws.10).aspx). @@ -47,13 +30,15 @@ An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policy Windows maps the name and category path of a Group Policy to a MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\\`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX-backed policies supported by MDM, see [Policy CSP - ADMX-backed policies](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider#admx-backed-policies). +## Video walkthrough + Here is a video of how to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune. - +> [!VIDEO https://www.microsoft.com/showcase/video.aspx?uuid=bdc9b54b-11b0-4bdb-a022-c339d16e7121] Here is a video of how to import a custom ADMX file to a device using Intune. - +> [!VIDEO https://www.microsoft.com/showcase/video.aspx?uuid=a59888b1-429f-4a49-8570-c39a143d9a73] ## ADMX files and the Group Policy Editor From 832568758c590eb674a3bc71b79a99c13b401584 Mon Sep 17 00:00:00 2001 From: "Tim Mangan (MVP)" Date: Thu, 8 Mar 2018 14:51:18 -0500 Subject: [PATCH 092/119] Update Applies To --- .../app-v/appv-performance-guidance.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index a9ee4e4cc8..5fe043b48f 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -13,7 +13,10 @@ ms.date: 04/19/2017 # Performance Guidance for Application Virtualization **Applies to** -- Windows 10, version 1607 +- Windows 7 SP1 +- Windows 10 +- Server 2012 R2 +- Server 2016 Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. From 7860d83fb61377c1b6bfc3bb43cc55f3cc94b835 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 8 Mar 2018 11:55:29 -0800 Subject: [PATCH 093/119] capability / feature rename --- ...ows-defender-advanced-threat-protection.md | 4 ++-- ...ows-defender-advanced-threat-protection.md | 18 ++++++++--------- ...ows-defender-advanced-threat-protection.md | 4 ++-- ...ows-defender-advanced-threat-protection.md | 8 ++++---- ...ows-defender-advanced-threat-protection.md | 20 +++++++++---------- ...ows-defender-advanced-threat-protection.md | 6 +++--- ...ows-defender-advanced-threat-protection.md | 4 ++-- 7 files changed, 32 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md index fea04741f7..489d6db5d4 100644 --- a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/09/2017 +ms.date: 03/12/2018 --- # View and organize the Windows Defender Advanced Threat Protection Alerts queue @@ -135,7 +135,7 @@ Select multiple alerts (Ctrl or Shift select) and manage or edit alerts together ## Related topics - [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) -- [View the Windows Defender Advanced Threat Protection Security analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [View the Windows Defender Advanced Threat Protection Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md index 2ff55bdc25..fc7325015e 100644 --- a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: Enable Security Analytics in Windows Defender ATP -description: Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard. -keywords: enable security analytics, baseline, calculation, analytics, score, security analytics dashboard, dashboard +title: Enable Secure score security controls in Windows Defender ATP +description: Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard. +keywords: secure score, baseline, calculation, score, secure score dashboard, dashboard, windows defender antivirus, av, exploit guard, application guard, smartscreen search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,10 +10,10 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/16/2017 +ms.date: 03/12/2018 --- -# Enable Security Analytics security controls +# Enable Secure score security controls **Applies to:** @@ -25,21 +25,21 @@ ms.date: 10/16/2017 -Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations. +Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations. >[!NOTE] >Changes might take up to a few hours to reflect on the dashboard. -1. In the navigation pane, select **Preferences setup** > **Security Analytics**. +1. In the navigation pane, select **Preferences setup** > **Secure score**. - ![Image of Security Analytics controls from Preferences setup menu](images/atp-enable-security-analytics.png) + ![Image of Secure score controls from Preferences setup menu](images/atp-enable-security-analytics.png) 2. Select the security control, then toggle the setting between **On** and **Off**. 3. Click **Save preferences**. ## Related topics -- [View the Security Analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) - [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md) - [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md) - [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md index 4c24bf012f..b25f671461 100644 --- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/23/2017 +ms.date: 03/12/2018 --- # View and organize the Windows Defender ATP Machines list @@ -80,7 +80,7 @@ Filter the list to view specific machines that are well configured or require at - **Well configured** - Machines have the Windows Defender security controls well configured. - **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization. -For more information, see [View the Security Analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md). +For more information, see [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md). **Malware category alerts**
        Filter the list to view specific machines grouped together by the following malware categories: diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md index adef15a6bb..14d4fc1ac4 100644 --- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: DulceMV ms.localizationpriority: high -ms.date: 10/19/2017 +ms.date: 03/12/2018 --- # Windows Defender Advanced Threat Protection portal overview @@ -51,11 +51,11 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- (1) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Machines list**, **Service health**, **Preferences setup**, and **Endpoint management**. -**Dashboards** | Enables you to view the Security operations or the Security analytics dashboard. -**Alerts queue** | Enables you to view separate queues of new, in progress, resolved alerts, alerts assigned to you, and suppression rules. +**Dashboards** | Allows you to access the Security operations or the Secure score dashboard. +**Alerts queue** | Allows you to view separate queues: new, in progress, resolved alerts, alerts assigned to you, and suppression rules. **Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. **Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. -**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Security analytics dashboard. +**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure score dashboard. **Endpoint management** | Provides access to endpoints such as clients and servers. Allows you to download the onboarding configuration package for endpoints. It also provides access to endpoint offboarding. **Community center** | Access the Community center to learn, collaborate, and share experiences about the product. (2) Main portal| Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list. diff --git a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md index a7f177c650..6ea27c4f75 100644 --- a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: View the Security Analytics dashboard in Windows Defender ATP -description: Use the Security Analytics dashboard to assess and improve the security state of your organization by analyzing various security control tiles. -keywords: security analytics, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates +title: View the Secure score dashboard in Windows Defender ATP +description: Use the Secure score dashboard to assess and improve the security state of your organization by analyzing various security control tiles. +keywords: secure score, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -9,10 +9,10 @@ ms.sitesec: library ms.pagetype: security author: mjcaparas localizationpriority: high -ms.date: 11/17/2017 +ms.date: 03/12/2018 --- -# View the Windows Defender Advanced Threat Protection Security analytics dashboard +# View the Windows Defender Advanced Threat Protection Secure score dashboard **Applies to:** @@ -27,18 +27,18 @@ ms.date: 11/17/2017 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-abovefoldlink) -The Security Analytics dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. +The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. >[!IMPORTANT] > This feature is available for machines on Windows 10, version 1703 or later. -The **Security analytics dashboard** displays a snapshot of: +The **Secure score dashboard** displays a snapshot of: - Organizational security score - Security coverage - Improvement opportunities - Security score over time -![Security analytics dashboard](images/atp-dashboard-security-analytics-full.png) +![Secure score dashboard](images/atp-dashboard-security-analytics-full.png) ## Organizational security score The organization security score is reflective of the average score of all the Windows Defender security controls that are configured according to the recommended baseline. You can improve this score by taking the steps in configuring each of the security controls in the optimal settings. @@ -52,7 +52,7 @@ The denominator is reflective of the organizational score potential and calculat In the example image, the total points from the **Improvement opportunities** tile add up to 321 points for the six pillars from the **Security coverage** tile. -You can set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard through the **Preferences settings**. For more information, see [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md). +You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Preferences settings**. For more information, see [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md). ## Security coverage The security coverage tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention. @@ -241,7 +241,7 @@ For more information, see [Windows Defender SmartScreen](../windows-defender-sma >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink) ## Related topics -- [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md) +- [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md) - [View the Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md index 75aed7ba70..9ec694fdde 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 02/13/2018 +ms.date: 03/12/2018 --- # Use the Windows Defender Advanced Threat Protection portal @@ -31,7 +31,7 @@ You can use the Windows Defender ATP portal to carry out an end-to-end security Use the **Security operations** dashboard to gain insight on the various alerts on machines and users in your network. -Use the **Security analytics** dashboard to expand your visibility on the overall security posture of your organization. You'll see machines that require attention and recommendations that can help you reduce the attack surface in your organization. +Use the **Secure score** dashboard to expand your visibility on the overall security posture of your organization. You'll see machines that require attention and recommendations that can help you reduce the attack surface in your organization. ### In this section @@ -40,6 +40,6 @@ Topic | Description :---|:--- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the portal layout and area descriptions. [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP **Security operations dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. -[View the Windows Defender Advanced Threat Protection Security analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | The **Security Analytics dashboard** expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. +[View the Windows Defender Advanced Threat Protection Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | The **Secure score dashboard** expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 42fe8383b5..a82528a68f 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Windows Defender Advanced Threat Protection - Windows Defender description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. -keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, analytics, threat intelligence +keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, score, threat intelligence search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/13/2017 +ms.date: 03/12/2018 --- # Windows Defender Advanced Threat Protection From 5980e1ed82a39eef75574b8b80e0e09e8dfc7b3f Mon Sep 17 00:00:00 2001 From: Raymond Comvalius Date: Thu, 8 Mar 2018 12:10:37 -0800 Subject: [PATCH 094/119] Added configuration of the settingsstoragepath --- .../configuration/ue-v/uev-getting-started.md | 35 +++++++++++++++---- 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md index ef86f5916c..5ec8571305 100644 --- a/windows/configuration/ue-v/uev-getting-started.md +++ b/windows/configuration/ue-v/uev-getting-started.md @@ -6,7 +6,7 @@ ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 03/08/2018 --- # Get Started with UE-V @@ -25,7 +25,7 @@ The standard installation of UE-V synchronizes the default Microsoft Windows and - [Step 2: Deploy the settings storage location](#step-2-deploy-the-settings-storage-location). Explains how to deploy a settings storage location. All UE-V deployments require a location to store settings packages that contain the synchronized setting values. -- [Step 3: Enable the UE-V service](#step-3-enable-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices. To synchronize settings using UE-V, devices must have the UE-V service enabled and running. +- [Step 3: Enable and configure the UE-V service](#step-3-enable-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices and configure the storage path. To synchronize settings using UE-V, devices must have the UE-V service enabled and running. - [Step 4: Test Your UE-V evaluation deployment](#step-4-test-your-ue-v-evaluation-deployment). Run a few tests on two computers with the UE-V service enabled to see how UE-V works and if it meets your organization’s needs. @@ -73,13 +73,34 @@ You’ll need to deploy a settings storage location, a standard network share wh 2. Set the registry key value to *1*. -## Step 3: Enable the UE-V service on user devices +## Step 3: Enable and configure the UE-V service on user devices For evaluation purposes, enable the service on at least two devices that belong to the same user in your test environment. The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. -Before enabling the UE-V service, you'll need to register the UE-V templates for first use. In a PowerShell window, type `register-TemplateName` where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. +Before enabling the UE-V service, you'll need to register the UE-V templates for first use. In a PowerShell window, type `Register-UevTemplate [TemplateName]` where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. For instance, to register all built-in UE-V templates, use the following PowerShell Command: +'Get-childItem c:\programdata\Microsoft\UEV\InboxTemplates\*.xml|% {Register-UevTemplate $_.Fullname}' + +A storage path must be configured on the client-side to tell where the personalized settings are stored. + +**To set the storage path for UE-V with Group Policy** + +1. Open the device’s **Group Policy Editor**. + +2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. + +3. Double click **Settings storage path**. + +4. Select **Enabled**, fill in the **Settings storage path**, and click **OK**. + + - Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder. + +**To set the storage path for UE-V with PowerShell** + +1. In a PowerShell window, type **Set-uevConfiguration -SettingsStoragePath [StoragePath]** where **[StoragePath]** is the path to the location created in step 2 followed by **\%username%**. + + - Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder. With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. @@ -89,9 +110,11 @@ With Windows 10, version 1607 and later, the UE-V service is installed on user d 2. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. -3. Run **Enable UEV**. +3. Double click **Use Users Experience Virtualization (UE-V)**. -4. Restart the device. +4. Select **Enabled** and click **OK**. + +5. Restart the device. **To enable the UE-V service with Windows PowerShell** From 777d6169e62c46f4320b05e0ad8a50c801ecfa30 Mon Sep 17 00:00:00 2001 From: "Tim Mangan (MVP)" Date: Thu, 8 Mar 2018 15:39:02 -0500 Subject: [PATCH 095/119] Update appv-running-locally-installed-applications-inside-a-virtual-environment.md --- ...talled-applications-inside-a-virtual-environment.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index 4dd867d228..c404cdd892 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -6,14 +6,17 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 04/19/2017 +ms.date: 03/08/2018 --- # Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications **Applies to** -- Windows 10, version 1607 +- Windows 7 SP1 +- Windows 10 +- Windows Server 2012 R2 +- Windows Server 2016 You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this if you: @@ -42,6 +45,7 @@ There is no Group Policy setting available to manage this registry key, so you h Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages globally or to the user. + ### Steps to create the subkey 1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. @@ -79,7 +83,7 @@ Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages glo

      • If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.

      • Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.

      • The key under which you create the subkey must match the publishing method you used for the package.

        -

        For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual.

        • +

        For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual. Do not add a key for the same application under both hives.

      From 29921aaa71eb600399a6a22b03fc8270c115ab57 Mon Sep 17 00:00:00 2001 From: Celeste de Guzman Date: Thu, 8 Mar 2018 13:43:27 -0800 Subject: [PATCH 096/119] updated the Microsoft Teams link for IT admins to point to the docs that's on DMC (new) --- education/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/index.md b/education/index.md index 3e75f1c5ee..1f982844d6 100644 --- a/education/index.md +++ b/education/index.md @@ -272,7 +272,7 @@ ms.date: 10/30/2017
    • - +
      @@ -283,7 +283,7 @@ ms.date: 10/30/2017

      Microsoft Teams

      -

      Make the most of Microsoft Teams and find out how to deploy, launch pilot teams, and launch Teams to the rest of your institution.

      +

      Make the most of Microsoft Teams and find out how to deploy, launch pilot teams, and launch Teams to the rest of your organization.

      From 6a35f0ab3c4db6b5808b0cecb5f35ba1065f8812 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 8 Mar 2018 15:16:09 -0800 Subject: [PATCH 097/119] update toc label for secure score --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index e0c3ba2050..d5c63e1673 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -39,7 +39,7 @@ ### [Understand the Windows Defender ATP portal](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) #### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) #### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md) -#### [View the Security analytics dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Secure score dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) #### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-windows-defender-advanced-threat-protection.md) ###Investigate and remediate threats From f7eddd127e4e2c7041165f0d2726a8406535ec74 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 8 Mar 2018 23:42:40 +0000 Subject: [PATCH 098/119] Merged PR 6260: Updated description for the ShellLauncher node in AssignedAccess CSP --- windows/client-management/mdm/assignedaccess-csp.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 554704a16d..b08768dc86 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -101,6 +101,8 @@ Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration > [!Note] > You cannot set both ShellLauncher and Configuration at the same time on the device. +> +> Configuring Shell Launcher using the ShellLauncher node automatically enables the Shell Launcher feature if it is available within the SKU.       **./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration** Added in Windows 10, version 1803. This node accepts a StatusConfiguration xml as input to configure the Kiosk App Health monitoring. There are three possible values for StatusEnabled node inside StatusConfiguration xml: On, OnWithAlerts, and Off. Click [link](#statusconfiguration-xsd) to see the StatusConfiguration schema. From 9349e1eb5776b94282d79afd935a9021b3293032 Mon Sep 17 00:00:00 2001 From: chintanpatel Date: Fri, 9 Mar 2018 09:52:03 -0800 Subject: [PATCH 099/119] Update configure-wd-app-guard.md --- .../configure-wd-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index 07eb24860e..991d95bf12 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -29,7 +29,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Net |Policy name|Supported versions|Description| |-----------|------------------|-----------| |Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| -|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| +|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Notes: 1) Please include a full domain name (www.contoso.com) in the configuration 2) You may use "." as a wildcard character to automatically trust subdomains. Configuring '.constoso.com' will automatically trust 'subdomain1.contoso.com', 'subdomain2.contoso.com etc. | |Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| ### Application-specific settings From e814dbc200e8b73424228ee44837951ff18e5c76 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 9 Mar 2018 11:26:26 -0800 Subject: [PATCH 100/119] typo "manage" instead of "manager" --- browsers/edge/available-policies.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 8f9901dcb2..016f1295f1 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -24,7 +24,7 @@ By using Group Policy and Intune, you can set up a policy setting once, and then > For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924). ## Group Policy settings -Microsoft Edge works with the following Group Policy settings to help you manager your company's web browser configurations. The Group Policy settings are found in the Group Policy Editor in the following location: +Microsoft Edge works with the following Group Policy settings to help you manage your company's web browser configurations. The Group Policy settings are found in the Group Policy Editor in the following location: `Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\` @@ -1007,4 +1007,4 @@ These are additional Windows 10-specific MDM policy settings that work with Mic - **1 (default).** Employees can sync between PCs. ## Related topics -* [Mobile Device Management (MDM) settings]( https://go.microsoft.com/fwlink/p/?LinkId=722885) \ No newline at end of file +* [Mobile Device Management (MDM) settings]( https://go.microsoft.com/fwlink/p/?LinkId=722885) From 3d599f14436c376c0718d20fc5ee5d682d49461f Mon Sep 17 00:00:00 2001 From: jaimeo Date: Fri, 9 Mar 2018 12:06:56 -0800 Subject: [PATCH 101/119] populated some content on the WA landing node to unblock Greg --- windows/deployment/TOC.md | 2 +- .../update/windows-analytics-overview.md | 51 +++++++++++++++++++ 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 windows/deployment/update/windows-analytics-overview.md diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index df889e6bbf..634d132448 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -229,7 +229,7 @@ #### [Olympia Corp enrollment](update/olympia/olympia-enrollment-guidelines.md) ### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md) -## Windows Analytics +## [Windows Analytics](update/windows-analytics-overview.md) ### [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) #### [Upgrade Readiness architecture](upgrade/upgrade-readiness-architecture.md) #### [Upgrade Readiness requirements](upgrade/upgrade-readiness-requirements.md) diff --git a/windows/deployment/update/windows-analytics-overview.md b/windows/deployment/update/windows-analytics-overview.md new file mode 100644 index 0000000000..d500f271dd --- /dev/null +++ b/windows/deployment/update/windows-analytics-overview.md @@ -0,0 +1,51 @@ +--- +title: Windows Analytics +description: Introduction and overview of Windows Analytics +keywords: Device Health, Upgrade Readiness, Update Compliance, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.date: 03/09/2018 +ms.pagetype: deploy +author: jaimeo +--- + +# Windows Analytics overview + +Windows Analytics is a set of solutions for Microsoft Operations Management Suite (OMS) that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: + +## Device Health + +[Device Health](device-health-get-started.md) provides the following: + +- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced +- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes +- Notification of Windows Information Protection misconfigurations that send prompts to end users + + +## Update Compliance + +[Update Compliance](update-compliance-get-started.md) shows you the state of your devices with respect to the Windows updates so that you can ensure that they are on the most current updates as appropriate. In addition, Update Compliance provides the following: + +- Dedicated drill-downs for devices that might need attention +- An inventory of devices, including the version of Windows they are running and their update status +- The ability to track protection and threat status for Windows Defender Antivirus-enabled devices +- An overview of Windows Update for Business deferral configurations (Windows 10, version 1607 and later) +- Powerful built-in log analytics to create useful custom queries +- Cloud-connected access utilizing Windows 10 diagnostic data means no need for new complex, customized infrastructure + +## Upgrade Readiness + +[Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) offers a set of tools to plan and manage the upgrade process end to end, allowing you to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Upgrade Readiness not only supports upgrade management from Windows 7 and Windows 8.1 to Windows 10, but also Windows 10 upgrades in the Windows as a Service model. + +Use Upgrade Readiness to get: + +- A visual workflow that guides you from pilot to production +- Detailed computer and application inventory +- Powerful computer-level search and drill-downs +- Guidance and insights into application and driver compatibility issues, with suggested fixes +- Data-driven application rationalization tools +- Application usage information, allowing targeted validation; workflow to track validation progress and decisions +- Data export to commonly used software deployment tools, including System Center Configuration Manager + +To get started with any of these solutions, visit the links for instructions to add it to OMS. \ No newline at end of file From 049ea1f190f15b747f94e18cf1359db77264bb04 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Fri, 9 Mar 2018 20:23:01 +0000 Subject: [PATCH 102/119] Merged PR 6278: Add troubleshooting info for powerwash --- devices/hololens/hololens-provisioning.md | 3 +++ education/windows/change-history-edu.md | 8 ++++++- .../windows/windows-automatic-redeployment.md | 24 ++++++++++++++++++- 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index 44d24432f7..2c07c79718 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -68,6 +68,9 @@ When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration D 6. On the **Select security details for the provisioning package**, click **Next**. + >[WARNING!] + >If you encrypt the provisioning package, provisioning the HoloLens device will fail. + 7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index ca5709975a..0775c1d4c7 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -8,13 +8,19 @@ ms.sitesec: library ms.pagetype: edu author: CelesteDG ms.author: celested -ms.date: 11/27/2017 +ms.date: 03/08/2018 --- # Change history for Windows 10 for Education This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation. +## March 2018 + +New or changed topic | Description +--- | --- +[Reset devices with Windows Automatic Redeployment](windows-automatic-redeployment.md) | Added section for troubleshooting Windows Automatic Redeployment. + ## November 2017 | New or changed topic | Description | diff --git a/education/windows/windows-automatic-redeployment.md b/education/windows/windows-automatic-redeployment.md index cbeaace1d6..f65d87c10f 100644 --- a/education/windows/windows-automatic-redeployment.md +++ b/education/windows/windows-automatic-redeployment.md @@ -9,7 +9,7 @@ ms.pagetype: edu ms.localizationpriority: high author: CelesteDG ms.author: celested -ms.date: 12/11/2017 +ms.date: 03/08/2018 --- # Reset devices with Windows Automatic Redeployment @@ -25,6 +25,9 @@ To enable Windows Automatic Redeployment in Windows 10, version 1709 (Fall Creat 2. [Trigger a reset for each device](#trigger-windows-automatic-redeployment) ## Enable Windows Automatic Redeployment + +To use Windows Automatic Redeployment, [Windows Recovery Environment (WinRE) must be enabled on the device](#winre). + **DisableAutomaticReDeploymentCredentials** is a policy that enables or disables the visibility of the credentials for Windows Automatic Redeployment. It is a policy node in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, this policy is set to 1 (Disable). This ensures that Windows Automatic Redeployment isn't triggered by accident. You can set the policy using one of these methods: @@ -84,6 +87,25 @@ Windows Automatic Redeployment is a two-step process: trigger it and then authen Once provisioning is complete, the device is again ready for use. + +## Troubleshoot Windows Automatic Redeployment + +Windows Automatic Redeployment will fail when the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is not enabled on the device. You will see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`. + +To check if WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: + +``` +reagent /info +``` + +If WinRE is not enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: + +``` +reagent /enable +``` + +If Windows Automatic Reployment fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance. + ## Related topics [Set up Windows devices for education](set-up-windows-10.md) From e7244ca35ee7750dfa0faf52ac5ce835c1c540ba Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 9 Mar 2018 22:55:01 +0000 Subject: [PATCH 103/119] Merged PR 6285: Add new yaml index to deployment node with cards Add new yaml index to deployment node with cards --- windows/deployment/TOC.md | 2 +- .../change-history-for-deploy-windows-10.md | 2 +- windows/deployment/docfx.json | 3 +- windows/deployment/index.md | 76 ------------- windows/deployment/index.yml | 104 ++++++++++++++++++ .../change-history-for-update-windows-10.md | 2 +- 6 files changed, 109 insertions(+), 80 deletions(-) delete mode 100644 windows/deployment/index.md create mode 100644 windows/deployment/index.yml diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 634d132448..b110f3c3c8 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -1,4 +1,4 @@ -# [Deploy and update Windows 10](index.md) +# [Deploy and update Windows 10](https://docs.microsoft.com/en-us/windows/deployment) ## [What's new in Windows 10 deployment](deploy-whats-new.md) ## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) diff --git a/windows/deployment/change-history-for-deploy-windows-10.md b/windows/deployment/change-history-for-deploy-windows-10.md index bd0da028fe..5f48b4eb49 100644 --- a/windows/deployment/change-history-for-deploy-windows-10.md +++ b/windows/deployment/change-history-for-deploy-windows-10.md @@ -10,7 +10,7 @@ ms.date: 11/08/2017 --- # Change history for Deploy Windows 10 -This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10). +This topic lists new and updated topics in the [Deploy Windows 10](https://docs.microsoft.com/en-us/windows/deployment) documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10). ## November 2017 diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index 0c1117e840..353f473c8c 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -3,7 +3,8 @@ "content": [ { "files": [ - "**/*.md" + "**/*.md", + "**/*.yml" ], "exclude": [ "**/obj/**", diff --git a/windows/deployment/index.md b/windows/deployment/index.md deleted file mode 100644 index f63641d04f..0000000000 --- a/windows/deployment/index.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Deploy and update Windows 10 (Windows 10) -description: Deploying and updating Windows 10 for IT professionals. -ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.localizationpriority: high -ms.date: 12/13/2017 -author: greg-lindsay ---- - -# Deploy and update Windows 10 - -Learn about deployment in Windows 10 for IT professionals. This includes deploying the operating system, upgrading to it from previous versions and updating Windows 10. The following sections and topics are available. - -|Topic |Description | -|------|------------| -|[What's new in Windows 10 deployment](deploy-whats-new.md) |See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization. | -|[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) |To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task. | -|[Windows 10 Subscription Activation](windows-10-enterprise-subscription-activation.md) |Windows 10 Enterprise has traditionally been sold as on premises software, however, with Windows 10 version 1703 (also known as the Creator’s Update), both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as true online services via subscription. You can move from Windows 10 Pro to Windows 10 Enterprise with no keys and no reboots. If you are using a Cloud Service Providers (CSP) see the related topic: [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). | -|[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) |This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. | - - -## Deploy Windows 10 - -Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. - -|Topic |Description | -|------|------------| -|[Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) |Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices. | -|[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. | -|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. | -|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about media available in the Microsoft Volume Licensing Service Center. | -|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | -|[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | -|[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | -|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | -|[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | -|[Windows 10 deployment tools](windows-10-deployment-tools-reference.md) |Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more. | - -## Update Windows 10 - -Information is provided about keeping Windows 10 up-to-date. - -|Topic |Description | -|------|------------| -| [Quick guide to Windows as a service](update/waas-quick-start.md) | Provides a brief summary of the key points for the new servicing model for Windows 10. | -| [Overview of Windows as a service](update/waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | -| [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | -| [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | -| [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider. | -| [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. | -| [Optimize update delivery for Windows 10 updates](update/waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | -| [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. | -| [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | -| [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](update/waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | -| [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | -| [Manage device restarts after updates](update/waas-restart.md) | Explains how to manage update related device restarts. | -| [Manage additional Windows Update settings](update/waas-wu-settings.md) | Provides details about settings available to control and configure Windows Update | -| [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | - -## Additional topics - -|Topic |Description | -|------|------------| -|[Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) |This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. | - -  - -  - - - - - diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml new file mode 100644 index 0000000000..649a715cf9 --- /dev/null +++ b/windows/deployment/index.yml @@ -0,0 +1,104 @@ +### YamlMime:YamlDocument + +documentType: LandingData +title: Deploy and update Windows 10 +metadata: + document_id: + title: Deploy and update Windows 10 + description: Deploying and updating Windows 10 for IT professionals. + keywords: deploy, update, Windows, service, Microsoft365, e5, e3 + ms.localizationpriority: high + author: greg-lindsay + ms.author: greglin + manager: elizapo + ms.date: 02/09/2018 + ms.topic: article + ms.devlang: na + +sections: +- items: + - type: markdown + text: Learn about deployment of Windows 10 for IT professionals. This includes deploying the operating system, upgrading to it from previous versions and updating Windows 10. +- items: + - type: list + style: cards + className: cardsM + columns: 3 + items: + - href: windows-10-deployment-scenarios + html:

      Understand the different ways that Windows 10 can be deployed

      + image: + src: https://docs.microsoft.com/en-us/media/common/i_deploy.svg" + title: Windows 10 deployment scenarios + - href: update + html:

      Update Windows 10 in the enterprise

      + image: + src: https://docs.microsoft.com/media/common/i_upgrade.svg + title: Windows as a service + - href: upgrade/windows-analytics-overview + html:

      Windows Analytics provides deep insights into your Windows 10 environment.

      + image: + src: https://docs.microsoft.com/media/common/i_investigate.svg + title: Windows Analytics +- title: +- items: + - type: markdown + text: " +
      + + + + + +
      [What's new in Windows 10 deployment](deploy-whats-new.md) See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization.
      [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task.
      [Windows 10 Subscription Activation](windows-10-enterprise-subscription-activation.md) Windows 10 Enterprise has traditionally been sold as on premises software, however, with Windows 10 version 1703 (also known as the Creator’s Update), both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as true online services via subscription. You can move from Windows 10 Pro to Windows 10 Enterprise with no keys and no reboots. If you are using a Cloud Service Providers (CSP) see the related topic: [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md).
      [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade.
      + " +- title: Deploy Windows 10 +- items: + - type: markdown + text: " + Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. +
       
      + + + + + + + + + + + +
      TopicDescription
      [Overview of Windows AutoPilot](windows-autopilot/windows-10-autopilot.md) Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices.
      [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) This topic provides information about support for upgrading directly to Windows 10 from a previous operating system.
      [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) This topic provides information about support for upgrading from one edition of Windows 10 to another.
      [Windows 10 volume license media](windows-10-media.md) This topic provides information about media available in the Microsoft Volume Licensing Service Center.
      [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
      [Windows 10 deployment test lab](windows-10-poc.md) This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md).
      [Plan for Windows 10 deployment](planning/index.md) This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning.
      [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT).
      [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or.
      [Windows 10 deployment tools](windows-10-deployment-tools-reference.md) Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more.
      + " +- title: Update Windows 10 +- items: + - type: markdown + text: " + Information is provided about keeping Windows 10 up-to-date. +
       
      + + + + + + + + + + + + + + + +
      TopicDescription
      [Quick guide to Windows as a service](update/waas-quick-start.md) Provides a brief summary of the key points for the new servicing model for Windows 10.
      [Overview of Windows as a service](update/waas-overview.md) Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools.
      [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) Explains the decisions you need to make in your servicing strategy.
      [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates.
      [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md) Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider.
      [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization.
      [Optimize update delivery for Windows 10 updates](update/waas-optimize-windows-10-updates.md) Explains the benefits of using Delivery Optimization or BranchCache for update distribution.
      [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile.
      [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune.
      [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](update/waas-manage-updates-wsus.md) Explains how to use WSUS to manage Windows 10 updates.
      [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) Explains how to use Configuration Manager to manage Windows 10 updates.
      [Manage device restarts after updates](update/waas-restart.md) Explains how to manage update related device restarts.
      [Manage additional Windows Update settings](update/waas-wu-settings.md) Provides details about settings available to control and configure Windows Update.
      [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) Explains how the Windows Insider Program for Business works and how to become an insider.
      + " +- title: Additional topics +- items: + - type: markdown + text: " +
      + [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. + +  " diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md index 6df6256b76..e76b08389c 100644 --- a/windows/deployment/update/change-history-for-update-windows-10.md +++ b/windows/deployment/update/change-history-for-update-windows-10.md @@ -11,7 +11,7 @@ ms.date: 10/17/2017 # Change history for Update Windows 10 -This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Deploy and Update Windows 10](https://docs.microsoft.com/en-us/windows/deployment). >If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history). From 580647e1ce85f09ba910c8a58c4000d384d8093b Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Fri, 9 Mar 2018 23:00:00 +0000 Subject: [PATCH 104/119] Merged PR 6284: "updated policies supported by GP" includes new ADMX-backed policies --- .../mdm/policy-csp-applicationmanagement.md | 7 +- .../mdm/policy-csp-appruntime.md | 77 ++++++ .../mdm/policy-csp-credentialsdelegation.md | 79 ++++++ .../mdm/policy-csp-deliveryoptimization.md | 48 ++-- .../mdm/policy-csp-devicelock.md | 44 +++- .../mdm/policy-csp-fileexplorer.md | 111 ++++++++ .../mdm/policy-csp-internetexplorer.md | 193 ++++++++++++-- .../mdm/policy-csp-mssecurityguide.md | 245 ++++++++++++++++++ .../mdm/policy-csp-msslegacy.md | 175 +++++++++++++ .../client-management/mdm/policy-csp-power.md | 44 +++- .../policy-csp-windowsconnectionmanager.md | 85 ++++++ .../mdm/policy-csp-windowslogon.md | 86 +++++- .../mdm/policy-csp-windowspowershell.md | 82 ++++++ 13 files changed, 1232 insertions(+), 44 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-appruntime.md create mode 100644 windows/client-management/mdm/policy-csp-credentialsdelegation.md create mode 100644 windows/client-management/mdm/policy-csp-fileexplorer.md create mode 100644 windows/client-management/mdm/policy-csp-mssecurityguide.md create mode 100644 windows/client-management/mdm/policy-csp-msslegacy.md create mode 100644 windows/client-management/mdm/policy-csp-windowsconnectionmanager.md create mode 100644 windows/client-management/mdm/policy-csp-windowspowershell.md diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 5822ec21c5..634f53cafc 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - ApplicationManagement @@ -569,6 +569,7 @@ The following list shows the supported values: > [!div class = "checklist"] > * User +> * Device
      @@ -582,9 +583,7 @@ Most restricted value is 1. ADMX Info: -- GP English name: *Only display the private store within the Microsoft Store* -- GP name: *RequirePrivateStoreOnly_1* -- GP path: *Windows Components/Store* +- GP name: *RequirePrivateStoreOnly* - GP ADMX file name: *WindowsStore.admx* diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md new file mode 100644 index 0000000000..941e26cef4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -0,0 +1,77 @@ +--- +title: Policy CSP - AppRuntime +description: Policy CSP - AppRuntime +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - AppRuntime + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## AppRuntime policies + +
      +
      + AppRuntime/AllowMicrosoftAccountsToBeOptional +
      +
      + + +
      + + +**AppRuntime/AllowMicrosoftAccountsToBeOptional** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it. + +If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. + +If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Microsoft accounts to be optional* +- GP name: *AppxRuntimeMicrosoftAccountsOptional* +- GP path: *Windows Components/App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md new file mode 100644 index 0000000000..1e465a7a21 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -0,0 +1,79 @@ +--- +title: Policy CSP - CredentialsDelegation +description: Policy CSP - CredentialsDelegation +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - CredentialsDelegation + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## CredentialsDelegation policies + +
      +
      + CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials +
      +
      + + +
      + + +**CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Remote host allows delegation of non-exportable credentials + +When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. + +If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode. + +If you disable or do not configure this policy setting, Restricted Administration and Remote Credential Guard mode are not supported. User will always need to pass their credentials to the host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote host allows delegation of non-exportable credentials* +- GP name: *AllowProtectedCreds* +- GP path: *System/Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 2dda85153c..849fcb5d99 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - DeliveryOptimization @@ -1217,6 +1217,13 @@ Added in Windows 10, version 1803. Specifies the maximum background download ban Note that downloads from LAN peers will not be throttled even when this policy is set. + +ADMX Info: +- GP name: *PercentageMaxBackgroundBandwidth* +- GP element: *PercentageMaxBackgroundBandwidth* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -1273,6 +1280,13 @@ Added in Windows 10, version 1803. Specifies the maximum foreground download ban Note that downloads from LAN peers will not be throttled even when this policy is set. + +ADMX Info: +- GP name: *PercentageMaxForegroundBandwidth* +- GP element: *PercentageMaxForegroundBandwidth* +- GP ADMX file name: *DeliveryOptimization.admx* + +
      @@ -1377,14 +1391,6 @@ The following list shows the supported values: Added in Windows 10, version 1803. Specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - -This policy allows an IT Admin to define the following: - -- Business hours range (for example 06:00 to 18:00) -- % of throttle for background traffic during business hours -- % of throttle for background traffic outside of business hours - - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1400,6 +1406,14 @@ ADMX Info: - GP ADMX file name: *DeliveryOptimization.admx* + +This policy allows an IT Admin to define the following: + +- Business hours range (for example 06:00 to 18:00) +- % of throttle for background traffic during business hours +- % of throttle for background traffic outside of business hours + +
      @@ -1443,14 +1457,6 @@ ADMX Info: Added in Windows 10, version 1803. Specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - -This policy allows an IT Admin to define the following: - -- Business hours range (for example 06:00 to 18:00) -- % of throttle for foreground traffic during business hours -- % of throttle for foreground traffic outside of business hours - - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1466,6 +1472,14 @@ ADMX Info: - GP ADMX file name: *DeliveryOptimization.admx* + +This policy allows an IT Admin to define the following: + +- Business hours range (for example 06:00 to 18:00) +- % of throttle for foreground traffic during business hours +- % of throttle for foreground traffic outside of business hours + +
      diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index e418951b10..5663570085 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - DeviceLock @@ -66,6 +66,9 @@ ms.date: 03/05/2018
      DeviceLock/MinimumPasswordAge
      +
      + DeviceLock/PreventEnablingLockScreenCamera +
      DeviceLock/PreventLockScreenSlideShow
      @@ -1030,6 +1033,45 @@ GP Info:
      + +**DeviceLock/PreventEnablingLockScreenCamera** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen. + +By default, users can enable invocation of an available camera on the lock screen. + +If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent enabling lock screen camera* +- GP name: *CPL_Personalization_NoLockScreenCamera* +- GP path: *Control Panel/Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + + +
      + **DeviceLock/PreventLockScreenSlideShow** diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md new file mode 100644 index 0000000000..13c169e91b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -0,0 +1,111 @@ +--- +title: Policy CSP - FileExplorer +description: Policy CSP - FileExplorer +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - FileExplorer + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## FileExplorer policies + +
      +
      + FileExplorer/TurnOffDataExecutionPreventionForExplorer +
      +
      + FileExplorer/TurnOffHeapTerminationOnCorruption +
      +
      + + +
      + + +**FileExplorer/TurnOffDataExecutionPreventionForExplorer** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Data Execution Prevention for Explorer* +- GP name: *NoDataExecutionPrevention* +- GP path: *File Explorer* +- GP ADMX file name: *Explorer.admx* + + + + +
      + + +**FileExplorer/TurnOffHeapTerminationOnCorruption** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating Explorer immediately, although Explorer may still terminate unexpectedly later. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off heap termination on corruption* +- GP name: *NoHeapTerminationOnCorruption* +- GP path: *File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 23a0b5a050..ff5dd18eae 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - InternetExplorer @@ -238,6 +238,9 @@ ms.date: 03/05/2018
      InternetExplorer/InternetZoneAllowUserDataPersistence
      +
      + InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer +
      InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls
      @@ -406,6 +409,9 @@ ms.date: 03/05/2018
      InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames
      +
      + InternetExplorer/LockedDownIntranetJavaPermissions +
      InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources
      @@ -637,6 +643,9 @@ ms.date: 03/05/2018
      InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence
      +
      + InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer +
      InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls
      @@ -5530,6 +5539,50 @@ ADMX Info:
      + +**InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
      + + + +This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer. + +If you selected Enable in the drop-down box, VBScript can run without user intervention. + +If you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run. + +If you selected Disable in the drop-down box, VBScript is prevented from running. + +If you do not configure or disable this policy setting, VBScript is prevented from running. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow VBScript to run in Internet Explorer* +- GP name: *IZ_PolicyAllowVBScript_1* +- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* +- GP ADMX file name: *inetres.admx* + + + + +
      + **InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls** @@ -9180,6 +9233,54 @@ ADMX Info:
      + +**InternetExplorer/LockedDownIntranetJavaPermissions** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
      + + + +This policy setting allows you to manage permissions for Java applets. + +If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. + +Low Safety enables applets to perform all operations. + +Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. + +High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. + +If you disable this policy setting, Java applets cannot run. + +If you do not configure this policy setting, Java applets are disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Java permissions* +- GP name: *IZ_PolicyJavaPermissions_4* +- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* +- GP ADMX file name: *inetres.admx* + + + + +
      + **InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources** @@ -12619,11 +12720,13 @@ ADMX Info: -Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). For example, Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. +Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context. -If you enable this policy setting, any zone can be protected from zone elevation for all processes. +If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. -If you disable or do not configure this policy setting, processes other than Internet Explorer or those listed in the Process List receive no such protection. +If you disable this policy setting, no zone receives such protection for Internet Explorer processes. + +If you do not configure this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. > [!TIP] @@ -12635,8 +12738,8 @@ If you disable or do not configure this policy setting, processes other than Int ADMX Info: -- GP English name: *All Processes* -- GP name: *IESF_PolicyAllProcesses_9* +- GP English name: *Internet Explorer Processes* +- GP name: *IESF_PolicyExplorerProcesses_9* - GP path: *Windows Components/Internet Explorer/Security Features/Protection From Zone Elevation* - GP ADMX file name: *inetres.admx* @@ -12747,11 +12850,13 @@ ADMX Info: -This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation. +This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. -If you enable this policy setting, the Web Browser Control will block automatic prompting of ActiveX control installation for all processes. +If you enable this policy setting, prompting for ActiveX control installations will be blocked for Internet Explorer processes. -If you disable or do not configure this policy setting, the Web Browser Control will not block automatic prompting of ActiveX control installation for all processes. +If you disable this policy setting, prompting for ActiveX control installations will not be blocked for Internet Explorer processes. + +If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. > [!TIP] @@ -12763,8 +12868,8 @@ If you disable or do not configure this policy setting, the Web Browser Control ADMX Info: -- GP English name: *All Processes* -- GP name: *IESF_PolicyAllProcesses_11* +- GP English name: *Internet Explorer Processes* +- GP name: *IESF_PolicyExplorerProcesses_11* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict ActiveX Install* - GP ADMX file name: *inetres.admx* @@ -12810,11 +12915,13 @@ ADMX Info: -This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated. +This policy setting enables blocking of file download prompts that are not user initiated. -If you enable this policy setting, the Web Browser Control will block automatic prompting of file downloads that are not user initiated for all processes. +If you enable this policy setting, file download prompts that are not user initiated will be blocked for Internet Explorer processes. -If you disable this policy setting, the Web Browser Control will not block automatic prompting of file downloads that are not user initiated for all processes. +If you disable this policy setting, prompting will occur for file downloads that are not user initiated for Internet Explorer processes. + +If you do not configure this policy setting, the user's preference determines whether to prompt for file downloads that are not user initiated for Internet Explorer processes. > [!TIP] @@ -12826,8 +12933,8 @@ If you disable this policy setting, the Web Browser Control will not block autom ADMX Info: -- GP English name: *All Processes* -- GP name: *IESF_PolicyAllProcesses_12* +- GP English name: *Internet Explorer Processes* +- GP name: *IESF_PolicyExplorerProcesses_12* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict File Download* - GP ADMX file name: *inetres.admx* @@ -14197,6 +14304,50 @@ ADMX Info:
      + +**InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
      + + + +This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer. + +If you selected Enable in the drop-down box, VBScript can run without user intervention. + +If you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run. + +If you selected Disable in the drop-down box, VBScript is prevented from running. + +If you do not configure or disable this policy setting, VBScript is prevented from running. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow VBScript to run in Internet Explorer* +- GP name: *IZ_PolicyAllowVBScript_7* +- GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* +- GP ADMX file name: *inetres.admx* + + + + +
      + **InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls** @@ -15560,9 +15711,11 @@ ADMX Info: Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars. -If you enable this policy setting, scripted windows are restricted for all processes. +If you enable this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes. -If you disable or do not configure this policy setting, scripted windows are not restricted. +If you disable this policy setting, scripts can continue to create popup windows and windows that obfuscate other windows. + +If you do not configure this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes. > [!TIP] @@ -15574,8 +15727,8 @@ If you disable or do not configure this policy setting, scripted windows are not ADMX Info: -- GP English name: *All Processes* -- GP name: *IESF_PolicyAllProcesses_8* +- GP English name: *Internet Explorer Processes* +- GP name: *IESF_PolicyExplorerProcesses_8* - GP path: *Windows Components/Internet Explorer/Security Features/Scripted Window Security Restrictions* - GP ADMX file name: *inetres.admx* diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md new file mode 100644 index 0000000000..8dc3535360 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -0,0 +1,245 @@ +--- +title: Policy CSP - MSSecurityGuide +description: Policy CSP - MSSecurityGuide +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - MSSecurityGuide + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## MSSecurityGuide policies + +
      +
      + MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon +
      +
      + MSSecurityGuide/ConfigureSMBV1ClientDriver +
      +
      + MSSecurityGuide/ConfigureSMBV1Server +
      +
      + MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection +
      +
      + MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications +
      +
      + MSSecurityGuide/WDigestAuthentication +
      +
      + + +
      + + +**MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0201_LATFP* +- GP ADMX file name: *SecGuide.admx* + + + + +
      + + +**MSSecurityGuide/ConfigureSMBV1ClientDriver** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0002_SMBv1_ClientDriver* +- GP ADMX file name: *SecGuide.admx* + + + + +
      + + +**MSSecurityGuide/ConfigureSMBV1Server** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0001_SMBv1_Server* +- GP ADMX file name: *SecGuide.admx* + + + + +
      + + +**MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0102_SEHOP* +- GP ADMX file name: *SecGuide.admx* + + + + +
      + + +**MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0101_WDPUA* +- GP ADMX file name: *SecGuide.admx* + + + + +
      + + +**MSSecurityGuide/WDigestAuthentication** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_SecGuide_0202_WDigestAuthn* +- GP ADMX file name: *SecGuide.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md new file mode 100644 index 0000000000..68078ca276 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -0,0 +1,175 @@ +--- +title: Policy CSP - MSSLegacy +description: Policy CSP - MSSLegacy +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - MSSLegacy + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## MSSLegacy policies + +
      +
      + MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes +
      +
      + MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers +
      +
      + MSSLegacy/IPSourceRoutingProtectionLevel +
      +
      + MSSLegacy/IPv6SourceRoutingProtectionLevel +
      +
      + + +
      + + +**MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_MSS_EnableICMPRedirect* +- GP ADMX file name: *mss-legacy.admx* + + + + +
      + + +**MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_MSS_NoNameReleaseOnDemand* +- GP ADMX file name: *mss-legacy.admx* + + + + +
      + + +**MSSLegacy/IPSourceRoutingProtectionLevel** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_MSS_DisableIPSourceRouting* +- GP ADMX file name: *mss-legacy.admx* + + + + +
      + + +**MSSLegacy/IPv6SourceRoutingProtectionLevel** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP name: *Pol_MSS_DisableIPSourceRoutingIPv6* +- GP ADMX file name: *mss-legacy.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index c69cf5db4a..89d381dddf 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - Power @@ -19,6 +19,9 @@ ms.date: 03/05/2018 ## Power policies
      +
      + Power/AllowStandbyStatesWhenSleepingOnBattery +
      Power/AllowStandbyWhenSleepingPluggedIn
      @@ -49,6 +52,45 @@ ms.date: 03/05/2018
      +
      + + +**Power/AllowStandbyStatesWhenSleepingOnBattery** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state. + +If you enable or do not configure this policy setting, Windows uses standby states to put the computer in a sleep state. + +If you disable this policy setting, standby states (S1-S3) are not allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow standby states (S1-S3) when sleeping (on battery)* +- GP name: *AllowStandbyStatesDC_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +
      diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md new file mode 100644 index 0000000000..87aa32bfbb --- /dev/null +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -0,0 +1,85 @@ +--- +title: Policy CSP - WindowsConnectionManager +description: Policy CSP - WindowsConnectionManager +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - WindowsConnectionManager + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
      + + +## WindowsConnectionManager policies + +
      +
      + WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork +
      +
      + + +
      + + +**WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time. + +If this policy setting is enabled, the computer responds to automatic and manual network connection attempts based on the following circumstances: + +Automatic connection attempts +- When the computer is already connected to a domain based network, all automatic connection attempts to non-domain networks are blocked. +- When the computer is already connected to a non-domain based network, automatic connection attempts to domain based networks are blocked. + +Manual connection attempts +- When the computer is already connected to either a non-domain based network or a domain based network over media other than Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing network connection is disconnected and the manual connection is allowed. +- When the computer is already connected to either a non-domain based network or a domain based network over Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing Ethernet connection is maintained and the manual connection attempt is blocked. + +If this policy setting is not configured or is disabled, computers are allowed to connect simultaneously to both domain and non-domain networks. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit connection to non-domain networks when connected to domain authenticated network* +- GP name: *WCM_BlockNonDomain* +- GP path: *Network/Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
      + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index cc10b25f2c..3847749f8f 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/09/2018 --- # Policy CSP - WindowsLogon @@ -25,9 +25,15 @@ ms.date: 03/05/2018
      WindowsLogon/DontDisplayNetworkSelectionUI
      +
      + WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers +
      WindowsLogon/HideFastUserSwitching
      +
      + WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart +
    • @@ -157,6 +163,45 @@ ADMX Info:
    + +**WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows local users to be enumerated on domain-joined computers. + +If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers. + +If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enumerate local users on domain-joined computers* +- GP name: *EnumerateLocalUsers* +- GP path: *System/Logon* +- GP ADMX file name: *logon.admx* + + + + +
    + **WindowsLogon/HideFastUserSwitching** @@ -219,6 +264,45 @@ To validate on Desktop, do the following: + +
    + + +**WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls whether a device will automatically sign-in the last interactive user after Windows Update restarts the system. + +If you enable or do not configure this policy setting, the device securely saves the user's credentials (including the user name, domain and encrypted password) to configure automatic sign-in after a Windows Update restart. After the Windows Update restart, the user is automatically signed-in and the session is automatically locked with all the lock screen apps configured for that user. + +If you disable this policy setting, the device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sign-in last interactive user automatically after a system-initiated restart* +- GP name: *AutomaticRestartSignOn* +- GP path: *Windows Components/Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + +
    Footnote: diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md new file mode 100644 index 0000000000..4ed6d00d53 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -0,0 +1,82 @@ +--- +title: Policy CSP - WindowsPowerShell +description: Policy CSP - WindowsPowerShell +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nickbrower +ms.date: 03/09/2018 +--- + +# Policy CSP - WindowsPowerShell + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
    + + +## WindowsPowerShell policies + +
    +
    + WindowsPowerShell/TurnOnPowerShellScriptBlockLogging +
    +
    + + +
    + + +**WindowsPowerShell/TurnOnPowerShellScriptBlockLogging** + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting, +Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation. + +If you disable this policy setting, logging of PowerShell script input is disabled. + +If you enable the Script Block Invocation Logging, PowerShell additionally logs events when invocation of a command, script block, function, or script +starts or stops. Enabling Invocation Logging generates a high volume of event logs. + +Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on PowerShell Script Block Logging* +- GP name: *EnableScriptBlockLogging* +- GP path: *Windows Components/Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
    + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. + + + From 5b500aab3a02cb00edb6823c7a0b49b5144da5a1 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Mon, 12 Mar 2018 15:44:06 +0000 Subject: [PATCH 105/119] Merged PR 6295: Fix link in analytics card Fix link in analytics card --- windows/deployment/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 649a715cf9..04a15dea0b 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -35,7 +35,7 @@ sections: image: src: https://docs.microsoft.com/media/common/i_upgrade.svg title: Windows as a service - - href: upgrade/windows-analytics-overview + - href: update/windows-analytics-overview html:

    Windows Analytics provides deep insights into your Windows 10 environment.

    image: src: https://docs.microsoft.com/media/common/i_investigate.svg From 96813d40b337d9cceaafceda3d523d3286e8ff95 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Mon, 12 Mar 2018 16:21:58 +0000 Subject: [PATCH 106/119] Merged PR 6288: Merge nibr-Index_Updates to master --- windows/client-management/mdm/TOC.md | 7 +++ .../policy-configuration-service-provider.md | 56 +++++++++++++++++-- 2 files changed, 58 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index ca5fd03714..c29fa0959d 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -180,6 +180,7 @@ #### [ActiveXControls](policy-csp-activexcontrols.md) #### [ApplicationDefaults](policy-csp-applicationdefaults.md) #### [ApplicationManagement](policy-csp-applicationmanagement.md) +#### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) #### [Authentication](policy-csp-authentication.md) @@ -191,6 +192,7 @@ #### [Cellular](policy-csp-cellular.md) #### [Connectivity](policy-csp-connectivity.md) #### [ControlPolicyConflict](policy-csp-controlpolicyconflict.md) +#### [CredentialsDelegation](policy-csp-credentialsdelegation.md) #### [CredentialProviders](policy-csp-credentialproviders.md) #### [CredentialsUI](policy-csp-credentialsui.md) #### [Cryptography](policy-csp-cryptography.md) @@ -209,6 +211,7 @@ #### [EventLogService](policy-csp-eventlogservice.md) #### [Experience](policy-csp-experience.md) #### [ExploitGuard](policy-csp-exploitguard.md) +#### [FileExplorer](policy-csp-fileexplorer.md) #### [Games](policy-csp-games.md) #### [Handwriting](policy-csp-handwriting.md) #### [InternetExplorer](policy-csp-internetexplorer.md) @@ -220,6 +223,8 @@ #### [LockDown](policy-csp-lockdown.md) #### [Maps](policy-csp-maps.md) #### [Messaging](policy-csp-messaging.md) +#### [MSSecurityGuide](policy-csp-mssecurityguide.md) +#### [MSSLegacy](policy-csp-msslegacy.md) #### [NetworkIsolation](policy-csp-networkisolation.md) #### [Notifications](policy-csp-notifications.md) #### [Power](policy-csp-power.md) @@ -246,9 +251,11 @@ #### [Update](policy-csp-update.md) #### [UserRights](policy-csp-userrights.md) #### [Wifi](policy-csp-wifi.md) +#### [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md) #### [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) #### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md) #### [WindowsLogon](policy-csp-windowslogon.md) +#### [WindowsPowerShell](policy-csp-windowspowershell.md) #### [WirelessDisplay](policy-csp-wirelessdisplay.md) ### [PolicyManager CSP](policymanager-csp.md) ### [Provisioning CSP](provisioning-csp.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 4f14d81f4f..6f733c2214 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -3269,6 +3269,7 @@ The following diagram shows the Policy configuration service provider in tree fo ## ADMX-backed policies - [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) - [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) - [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) - [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) @@ -3311,13 +3312,17 @@ The following diagram shows the Policy configuration service provider in tree fo - [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) - [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) - [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) - [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) - [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) - [DataUsage/SetCost3G](./policy-csp-datausage.md#datausage-setcost3g) - [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) - [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) - [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) - [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) - [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) - [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) @@ -3328,6 +3333,8 @@ The following diagram shows the Policy configuration service provider in tree fo - [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) - [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) - [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) - [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) - [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) - [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) @@ -3401,6 +3408,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) - [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) - [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) - [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) - [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) - [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) @@ -3456,6 +3464,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) - [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) - [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) - [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) - [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) - [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) @@ -3533,6 +3542,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) - [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) - [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) - [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) - [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) - [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) @@ -3575,6 +3585,17 @@ The following diagram shows the Policy configuration service provider in tree fo - [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) - [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) - [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) - [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) - [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) - [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) @@ -3624,13 +3645,19 @@ The following diagram shows the Policy configuration service provider in tree fo - [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) - [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) - [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) - [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) - [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart](./policy-csp-windowslogon.md#windowslogon-signinlastinteractiveuserautomaticallyafterasysteminitiatedrestart) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) + ## Policies supported by GP - [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) - [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) - [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) - [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) - [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) @@ -3726,6 +3753,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) - [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) - [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) - [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) - [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) - [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) @@ -3781,6 +3809,8 @@ The following diagram shows the Policy configuration service provider in tree fo - [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) - [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) - [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) - [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) - [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) @@ -3791,6 +3821,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) - [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) - [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) - [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) - [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) - [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) @@ -3820,6 +3851,8 @@ The following diagram shows the Policy configuration service provider in tree fo - [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) - [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) - [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) - [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) - [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) - [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) @@ -3894,6 +3927,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) - [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) - [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) - [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) - [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) - [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) @@ -3949,6 +3983,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) - [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) - [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) - [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) - [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) - [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) @@ -4026,6 +4061,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) - [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) - [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) - [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) - [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) - [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) @@ -4082,10 +4118,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) - [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) - [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallysignsecurechanneldatawhenpossible) - [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) -- [LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-maximummachineaccountpasswordage) -- [LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-requirestrongsessionkey) - [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) @@ -4094,7 +4127,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) - [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) - [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) - [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) @@ -4107,7 +4139,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) - [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) - [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) - [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) - [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) - [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) @@ -4123,6 +4154,16 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) - [Location/EnableLocation](./policy-csp-location.md#location-enablelocation) - [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) - [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) - [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) - [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) @@ -4133,6 +4174,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) - [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) - [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) - [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) - [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) - [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) @@ -4369,6 +4411,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) - [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) - [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) - [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) - [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) - [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) @@ -4392,7 +4435,10 @@ The following diagram shows the Policy configuration service provider in tree fo - [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) - [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) - [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) - [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart](./policy-csp-windowslogon.md#windowslogon-signinlastinteractiveuserautomaticallyafterasysteminitiatedrestart) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) - [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) - [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) From 956c6fdc4a1b05fafc509d8e981fa1399ae7d10f Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Mon, 12 Mar 2018 17:54:50 +0000 Subject: [PATCH 107/119] Merged PR 6306: Adding 1803 footnote to Policy CSP. "updating policies (id=4934)" --- windows/client-management/mdm/policy-csp-abovelock.md | 3 ++- .../mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md | 3 ++- windows/client-management/mdm/policy-csp-accounts.md | 3 ++- windows/client-management/mdm/policy-csp-activexcontrols.md | 3 ++- .../client-management/mdm/policy-csp-applicationdefaults.md | 3 ++- .../client-management/mdm/policy-csp-applicationmanagement.md | 3 ++- windows/client-management/mdm/policy-csp-appruntime.md | 3 ++- windows/client-management/mdm/policy-csp-appvirtualization.md | 3 ++- windows/client-management/mdm/policy-csp-attachmentmanager.md | 3 ++- windows/client-management/mdm/policy-csp-authentication.md | 3 ++- windows/client-management/mdm/policy-csp-autoplay.md | 3 ++- windows/client-management/mdm/policy-csp-bitlocker.md | 3 ++- windows/client-management/mdm/policy-csp-bluetooth.md | 3 ++- windows/client-management/mdm/policy-csp-browser.md | 3 ++- windows/client-management/mdm/policy-csp-camera.md | 3 ++- windows/client-management/mdm/policy-csp-cellular.md | 3 ++- windows/client-management/mdm/policy-csp-connectivity.md | 3 ++- .../client-management/mdm/policy-csp-controlpolicyconflict.md | 3 ++- .../client-management/mdm/policy-csp-credentialproviders.md | 3 ++- .../client-management/mdm/policy-csp-credentialsdelegation.md | 3 ++- windows/client-management/mdm/policy-csp-credentialsui.md | 3 ++- windows/client-management/mdm/policy-csp-cryptography.md | 3 ++- windows/client-management/mdm/policy-csp-dataprotection.md | 3 ++- windows/client-management/mdm/policy-csp-datausage.md | 3 ++- windows/client-management/mdm/policy-csp-defender.md | 3 ++- .../client-management/mdm/policy-csp-deliveryoptimization.md | 3 ++- windows/client-management/mdm/policy-csp-desktop.md | 3 ++- windows/client-management/mdm/policy-csp-deviceguard.md | 3 ++- windows/client-management/mdm/policy-csp-deviceinstallation.md | 3 ++- windows/client-management/mdm/policy-csp-devicelock.md | 3 ++- windows/client-management/mdm/policy-csp-display.md | 3 ++- windows/client-management/mdm/policy-csp-education.md | 3 ++- .../client-management/mdm/policy-csp-enterprisecloudprint.md | 3 ++- windows/client-management/mdm/policy-csp-errorreporting.md | 3 ++- windows/client-management/mdm/policy-csp-eventlogservice.md | 3 ++- windows/client-management/mdm/policy-csp-experience.md | 3 ++- windows/client-management/mdm/policy-csp-exploitguard.md | 3 ++- windows/client-management/mdm/policy-csp-fileexplorer.md | 3 ++- windows/client-management/mdm/policy-csp-games.md | 3 ++- windows/client-management/mdm/policy-csp-handwriting.md | 3 ++- windows/client-management/mdm/policy-csp-internetexplorer.md | 3 ++- windows/client-management/mdm/policy-csp-kerberos.md | 3 ++- windows/client-management/mdm/policy-csp-kioskbrowser.md | 3 ++- windows/client-management/mdm/policy-csp-licensing.md | 3 ++- .../mdm/policy-csp-localpoliciessecurityoptions.md | 3 ++- windows/client-management/mdm/policy-csp-location.md | 3 ++- windows/client-management/mdm/policy-csp-lockdown.md | 3 ++- windows/client-management/mdm/policy-csp-maps.md | 3 ++- windows/client-management/mdm/policy-csp-messaging.md | 3 ++- windows/client-management/mdm/policy-csp-mssecurityguide.md | 3 ++- windows/client-management/mdm/policy-csp-msslegacy.md | 3 ++- windows/client-management/mdm/policy-csp-networkisolation.md | 3 ++- windows/client-management/mdm/policy-csp-notifications.md | 3 ++- windows/client-management/mdm/policy-csp-power.md | 3 ++- windows/client-management/mdm/policy-csp-printers.md | 3 ++- windows/client-management/mdm/policy-csp-privacy.md | 3 ++- windows/client-management/mdm/policy-csp-remoteassistance.md | 3 ++- .../client-management/mdm/policy-csp-remotedesktopservices.md | 3 ++- windows/client-management/mdm/policy-csp-remotemanagement.md | 3 ++- .../client-management/mdm/policy-csp-remoteprocedurecall.md | 3 ++- windows/client-management/mdm/policy-csp-remoteshell.md | 3 ++- windows/client-management/mdm/policy-csp-search.md | 3 ++- windows/client-management/mdm/policy-csp-security.md | 3 ++- windows/client-management/mdm/policy-csp-settings.md | 3 ++- windows/client-management/mdm/policy-csp-smartscreen.md | 3 ++- windows/client-management/mdm/policy-csp-speech.md | 3 ++- windows/client-management/mdm/policy-csp-start.md | 3 ++- windows/client-management/mdm/policy-csp-storage.md | 3 ++- windows/client-management/mdm/policy-csp-system.md | 3 ++- windows/client-management/mdm/policy-csp-systemservices.md | 3 ++- windows/client-management/mdm/policy-csp-taskscheduler.md | 3 ++- windows/client-management/mdm/policy-csp-textinput.md | 3 ++- .../client-management/mdm/policy-csp-timelanguagesettings.md | 3 ++- windows/client-management/mdm/policy-csp-update.md | 3 ++- windows/client-management/mdm/policy-csp-userrights.md | 3 ++- windows/client-management/mdm/policy-csp-wifi.md | 3 ++- .../mdm/policy-csp-windowsconnectionmanager.md | 3 ++- .../mdm/policy-csp-windowsdefendersecuritycenter.md | 3 ++- .../client-management/mdm/policy-csp-windowsinkworkspace.md | 3 ++- windows/client-management/mdm/policy-csp-windowslogon.md | 3 ++- windows/client-management/mdm/policy-csp-windowspowershell.md | 3 ++- windows/client-management/mdm/policy-csp-wirelessdisplay.md | 3 ++- 82 files changed, 164 insertions(+), 82 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index d0b77e50dc..16115c79c9 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AboveLock @@ -202,6 +202,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md index 2d0549e77b..7cee27e382 100644 --- a/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md +++ b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - AccountPoliciesAccountLockoutPolicy @@ -180,6 +180,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 0fb29f4870..5eb439322d 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Accounts @@ -244,6 +244,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 925504ac0d..2563d21bc2 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ActiveXControls @@ -95,6 +95,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index dba53edc54..5aaf01d6fb 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ApplicationDefaults @@ -139,6 +139,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 634f53cafc..47b9d1e09d 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - ApplicationManagement @@ -722,6 +722,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 941e26cef4..7e6fb10c8d 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - AppRuntime @@ -72,6 +72,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index bbb346e93c..562a5224dc 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AppVirtualization @@ -1836,6 +1836,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index c80e44f614..7b97a87a4b 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AttachmentManager @@ -229,6 +229,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 02a363e078..f83bb3905c 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Authentication @@ -309,6 +309,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 2e2ecaf426..c748e76ae7 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Autoplay @@ -245,6 +245,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 852a915bac..fa358dcb81 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Bitlocker @@ -114,6 +114,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 3a6b797bf3..fb08f30dc0 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Bluetooth @@ -293,6 +293,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 22fc158c08..ccafd7cbed 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Browser @@ -2616,6 +2616,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 02a242ec12..3cbf216e52 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Camera @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 5b9aa0d665..431c59baa4 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Cellular @@ -324,6 +324,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 249cc6cac3..faf33814cc 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Connectivity @@ -898,6 +898,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 229109756e..b606419501 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - ControlPolicyConflict @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 039a57e0fb..f3f12c6f73 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialProviders @@ -219,6 +219,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 1e465a7a21..e347fbd029 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialsDelegation @@ -74,6 +74,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index ec0f9a0c5e..900ad6176a 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialsUI @@ -163,6 +163,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index b2360eb40b..7dadd07af1 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Cryptography @@ -133,6 +133,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 1563402e93..28ad8aaca3 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - DataProtection @@ -136,6 +136,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 2aa9b34cd0..89086b22bb 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DataUsage @@ -170,6 +170,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 74091500ca..76c96ac41d 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Defender @@ -2318,6 +2318,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 849fcb5d99..cf43d37c41 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeliveryOptimization @@ -1488,6 +1488,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 2957bd78f7..36afbf2a08 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Desktop @@ -93,6 +93,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index a516cc7ab4..b541578089 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceGuard @@ -214,6 +214,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index c8b4f6b9d9..38941fd46b 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceInstallation @@ -158,6 +158,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 5663570085..1a791a7b71 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceLock @@ -1192,6 +1192,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 827b347c3e..0cf8a9740d 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Display @@ -355,6 +355,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 8eab86d6e3..e1fb1b9965 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Education @@ -185,6 +185,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 63d4b5f3b2..4b5b961ad9 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - EnterpriseCloudPrint @@ -328,6 +328,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index ed18d1d8d9..d2a31d1077 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ErrorReporting @@ -367,6 +367,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index e0d3529cc9..835be83eb0 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - EventLogService @@ -290,6 +290,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index b741cd983e..3f96460055 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Experience @@ -1304,6 +1304,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index ca51c9a7a7..bdf443d549 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ExploitGuard @@ -112,6 +112,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 13c169e91b..9216df0e67 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - FileExplorer @@ -106,6 +106,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 2a651204e1..d14fd92fed 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Games @@ -81,6 +81,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 438387b1b6..bdbcb764ae 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Handwriting @@ -95,6 +95,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index ff5dd18eae..304792e860 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - InternetExplorer @@ -16786,6 +16786,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 6831acebc5..974db5f350 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Kerberos @@ -360,6 +360,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 933c3fa2e8..27f995e4d9 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - KioskBrowser @@ -314,6 +314,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 0e063d9b5f..eae5cdc5d7 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Licensing @@ -150,6 +150,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 1ffde8a086..27c960d639 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -3529,6 +3529,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md index 18e7a7fd97..8117114323 100644 --- a/windows/client-management/mdm/policy-csp-location.md +++ b/windows/client-management/mdm/policy-csp-location.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Location @@ -99,6 +99,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index be9c02f1d7..228d2f75ec 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - LockDown @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index d60af40683..8b44913146 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Maps @@ -148,6 +148,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index 2ad6d83fe0..f1862d266d 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Messaging @@ -201,6 +201,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 8dc3535360..8759b6d49a 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - MSSecurityGuide @@ -240,6 +240,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 68078ca276..54107559ca 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - MSSLegacy @@ -170,6 +170,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 70db29303b..d5d98f64b1 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - NetworkIsolation @@ -480,6 +480,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index b4363ef967..8dddbe0d18 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Notifications @@ -93,6 +93,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 89d381dddf..5bee576aca 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - Power @@ -667,6 +667,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index fd0939f604..be94af174b 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Printers @@ -251,6 +251,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 3595219241..c084709cd0 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Privacy @@ -4485,6 +4485,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index a26dd4c251..01e2f7e4b7 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteAssistance @@ -339,6 +339,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 3af7f7ca34..0e4be98697 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteDesktopServices @@ -450,6 +450,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 67d82bb4f9..96324dc5cc 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteManagement @@ -1032,6 +1032,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 41fb1d8539..295bf5c56e 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteProcedureCall @@ -174,6 +174,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 20a0ac4151..cbb9717f73 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteShell @@ -487,6 +487,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 85b59673d8..dfdf82afa1 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Search @@ -858,6 +858,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 9d95aab726..b03abc2582 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Security @@ -662,6 +662,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 5031440194..5773e32200 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Settings @@ -847,6 +847,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index be4301165b..3eea69f19b 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - SmartScreen @@ -212,6 +212,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 9a691d7670..33cdd64750 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Speech @@ -89,6 +89,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 50809d5486..d9d149dd3a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Start @@ -1763,6 +1763,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 536aac2ce2..b27f3af35b 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Storage @@ -158,6 +158,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index d943b9d855..6c6ed3c4c9 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - System @@ -1052,6 +1052,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index ffdb12f42a..9dd4ebd067 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - SystemServices @@ -342,6 +342,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 88a19a26c4..7fee0be3b0 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - TaskScheduler @@ -76,6 +76,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index b5cb108686..6b2f4389e8 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - TextInput @@ -1306,6 +1306,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index c926c03e45..f577d940bb 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - TimeLanguageSettings @@ -81,6 +81,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 7a92fffc6a..70198e988d 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Update @@ -3064,6 +3064,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 6e52bc893b..3584468818 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - UserRights @@ -1542,6 +1542,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index f4e3dbae88..358dc3fc01 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Wifi @@ -386,6 +386,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 87aa32bfbb..c5ac238f1d 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsConnectionManager @@ -80,6 +80,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 8329d11f77..c94d1e9dd5 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsDefenderSecurityCenter @@ -1196,6 +1196,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index 3549c95e06..27f04f2813 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsInkWorkspace @@ -152,6 +152,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 3847749f8f..16e39d3e9c 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsLogon @@ -310,6 +310,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 4ed6d00d53..ee96a4746f 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsPowerShell @@ -77,6 +77,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 9e122a3f3f..cafb7be12e 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WirelessDisplay @@ -453,6 +453,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. From 8f0298db30a3563323ff0a00518a09103917545b Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 12 Mar 2018 21:44:24 +0000 Subject: [PATCH 108/119] Merged PR 6314: TimeLanguageSettings/AllowSet24HourClock - updated the default value fixed default value --- .../mdm/policy-csp-timelanguagesettings.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index f577d940bb..731fc2ae63 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -63,14 +63,14 @@ ms.date: 03/12/2018 -Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting. +Allows for the configuration of the default clock setting to be the 24 hour format. If set to 0 (zero), the device uses the default clock as prescribed by the current locale setting. The following list shows the supported values: -- 0 – Locale default setting. -- 1 (default) – Set 24 hour clock. +- 0 (default) – Current locale setting. +- 1 – Set 24 hour clock. From 0292ef2bf3d68859455d386b1c1e3109449aa8cb Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 12 Mar 2018 21:44:51 +0000 Subject: [PATCH 109/119] Merged PR 6313: Updated the Policy DDF topic with the latest version --- .../client-management/mdm/policy-ddf-file.md | 1158 +++++++++++------ 1 file changed, 779 insertions(+), 379 deletions(-) diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 406db3df06..0b6035ae0a 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/26/2018 +ms.date: 03/12/2018 --- # Policy DDF file @@ -95,6 +95,30 @@ The XML below is the DDF for Windows 10, version 1803. + + MSIAlwaysInstallWithElevatedPrivileges + + + + + + + + + + + + + + + + + + + text/plain + + + RequirePrivateStoreOnly @@ -7848,6 +7872,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + EnableEndSessionButton + + + + + + + + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + EnableHomeButton @@ -7966,6 +8014,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DisallowTileNotification + + + + + + + + + + + + + + + + + + + text/plain + + + Printers @@ -8284,6 +8356,34 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + MSIAlwaysInstallWithElevatedPrivileges + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + AlwaysInstallElevated + HighestValueMostSecure + + RequirePrivateStoreOnly @@ -8307,7 +8407,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on WindowsStore.admx WindowsStore~AT~WindowsComponents~WindowsStore - RequirePrivateStoreOnly_1 + RequirePrivateStoreOnly HighestValueMostSecure @@ -15167,7 +15267,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyAllProcesses_9 + IESF_PolicyExplorerProcesses_9 LastWrite @@ -15221,7 +15321,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyAllProcesses_11 + IESF_PolicyExplorerProcesses_11 LastWrite @@ -16382,7 +16482,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyAllProcesses_12 + IESF_PolicyExplorerProcesses_12 LastWrite @@ -16409,7 +16509,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyAllProcesses_8 + IESF_PolicyExplorerProcesses_8 LastWrite @@ -16910,6 +17010,31 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + EnableEndSessionButton + + + + + 0 + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + EnableHomeButton @@ -17032,6 +17157,33 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LowestValueMostSecure + + DisallowTileNotification + + + + + 0 + + + + + + + + + + + + text/plain + + + WPN.admx + WPN~AT~StartMenu~NotificationsCategory + NoTileNotification + LowestValueMostSecure + + Printers @@ -18024,6 +18176,78 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + MSIAllowUserControlOverInstall + + + + + + + + + + + + + + + + + + + text/plain + + + + + MSIAlwaysInstallWithElevatedPrivileges + + + + + + + + + + + + + + + + + + + text/plain + + + + + RequirePrivateStoreOnly + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictAppDataToSystemVolume @@ -30441,6 +30665,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + EnableEndSessionButton + + + + + + + + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + EnableHomeButton @@ -30514,6 +30762,52 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + LanmanWorkstation + + + + + + + + + + + + + + + + + + + + + EnableInsecureGuestLogons + + + + + + + + + + + + + + + + + + + text/plain + + + + Licensing @@ -30994,38 +31288,6 @@ Note: Domain controllers are also domain members and establish secure channels w - - DomainMember_DigitallySignSecureChannelDataWhenPossible - - - - - - - - Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - - - - - - - - - text/plain - - - DomainMember_DisableMachineAccountPasswordChanges @@ -31059,81 +31321,6 @@ This setting should not be used in an attempt to support dual-boot scenarios tha - - DomainMember_MaximumMachineAccountPasswordAge - - - - - - - - Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - - - - - - - - - text/plain - - - - - DomainMember_RequireStrongSessionKey - - - - - - - - Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - - - - - - - - - text/plain - - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -31385,52 +31572,6 @@ On Windows Vista and above: For this setting to work, the Smart Card Removal Pol - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - - - - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees @@ -31880,7 +32021,7 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers @@ -31888,12 +32029,12 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + Network security: Minimum session security for NTLM SSP based (including secure RPC) servers -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: +This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. +Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: @@ -31915,7 +32056,7 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers + NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication @@ -31923,18 +32064,123 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication -This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: +This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. -Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. -Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. +If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. -Default: +If you do not configure this policy setting, no exceptions will be applied. -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. +The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic + + + + + + + + Network security: Restrict NTLM: Audit Incoming NTLM Traffic -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +This policy setting allows you to audit incoming NTLM traffic. + +If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. + +If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. + +If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic + + + + + + + + Network security: Restrict NTLM: Incoming NTLM traffic + +This policy setting allows you to deny or allow incoming NTLM traffic. + +If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. + +If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. + +If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers + + + + + + + + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + +This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. + +If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. + +If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. + +If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -32721,6 +32967,30 @@ The options are: + + TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications + + + + + + + + + + + + + + + + + + + text/plain + + + WDigestAuthentication @@ -43215,6 +43485,89 @@ Because of these factors, users do not usually need this user right. Warning: If LowestValueMostSecure + + MSIAllowUserControlOverInstall + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + EnableUserControl + HighestValueMostSecure + + + + MSIAlwaysInstallWithElevatedPrivileges + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + AlwaysInstallElevated + HighestValueMostSecure + + + + RequirePrivateStoreOnly + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsStore.admx + WindowsStore~AT~WindowsComponents~WindowsStore + RequirePrivateStoreOnly + HighestValueMostSecure + + RestrictAppDataToSystemVolume @@ -55097,7 +55450,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyAllProcesses_9 + IESF_PolicyExplorerProcesses_9 LastWrite @@ -55151,7 +55504,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyAllProcesses_11 + IESF_PolicyExplorerProcesses_11 LastWrite @@ -56312,7 +56665,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyAllProcesses_12 + IESF_PolicyExplorerProcesses_12 LastWrite @@ -56339,7 +56692,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyAllProcesses_8 + IESF_PolicyExplorerProcesses_8 LastWrite @@ -57022,6 +57375,31 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + EnableEndSessionButton + + + + + 0 + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + EnableHomeButton @@ -57098,6 +57476,53 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + LanmanWorkstation + + + + + + + + + + + + + + + + + + + EnableInsecureGuestLogons + + + + + 0 + + + + + + + + + + + + text/plain + + + LanmanWorkstation.admx + LanmanWorkstation~AT~Network~Cat_LanmanWorkstation + Pol_EnableInsecureGuestLogons + LowestValueMostSecure + + + Licensing @@ -57614,41 +58039,6 @@ Note: Domain controllers are also domain members and establish secure channels w LastWrite - - DomainMember_DigitallySignSecureChannelDataWhenPossible - - - - - 1 - Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Digitally sign secure channel data (when possible) - LastWrite - - DomainMember_DisableMachineAccountPasswordChanges @@ -57685,87 +58075,6 @@ This setting should not be used in an attempt to support dual-boot scenarios tha LastWrite - - DomainMember_MaximumMachineAccountPasswordAge - - - - - 30 - Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Maximum machine account password age - LowestValueMostSecure - - - - DomainMember_RequireStrongSessionKey - - - - - 1 - Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Require strong (Windows 2000 or later) session key - LastWrite - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -58039,55 +58348,6 @@ On Windows Vista and above: For this setting to work, the Smart Card Removal Pol LastWrite - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - 0 - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network client: Digitally sign communications (always) - LastWrite - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees @@ -58571,44 +58831,6 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send HighestValueMostSecure - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients - - - - - 0 - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - HighestValueMostSecure - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers @@ -58647,6 +58869,157 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption HighestValueMostSecure + + NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication + + + + + + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + +This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. + +If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. + +If you do not configure this policy setting, no exceptions will be applied. + +The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + LastWrite + + + + NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic + + + + + 0 + Network security: Restrict NTLM: Audit Incoming NTLM Traffic + +This policy setting allows you to audit incoming NTLM traffic. + +If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. + +If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. + +If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Audit Incoming NTLM Traffic + HighestValueMostSecure + + + + NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic + + + + + 0 + Network security: Restrict NTLM: Incoming NTLM traffic + +This policy setting allows you to deny or allow incoming NTLM traffic. + +If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. + +If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. + +If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Incoming NTLM traffic + HighestValueMostSecure + + + + NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers + + + + + 0 + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + +This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. + +If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. + +If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. + +If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + HighestValueMostSecure + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn @@ -59472,6 +59845,33 @@ The options are: LastWrite + + TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0101_WDPUA + LastWrite + + WDigestAuthentication From de920d843565108eb32c34195b2d926f7fc5ca85 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 12 Mar 2018 21:45:48 +0000 Subject: [PATCH 110/119] Merged PR 6315: UEFI CSP not supported in Pro --- .../mdm/configuration-service-provider-reference.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 1f6269d889..3764a9326f 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/02/2018 +ms.date: 03/12/2018 --- # Configuration service provider reference @@ -2136,7 +2136,7 @@ Footnotes: -[Uefi CSP](uefi-csp.md) +[UEFI CSP](uefi-csp.md) @@ -2151,7 +2151,7 @@ Footnotes: - + @@ -2596,6 +2596,7 @@ Footnotes: - [Reporting CSP](reporting-csp.md) - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) +- [UEFI CSP](uefi-csp.md) - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) From d12118140d5d977f5f49d5f4c7275dabeea41d5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Akshatha=20Kommalapati=20=28=F0=9F=90=8D=29?= Date: Mon, 12 Mar 2018 22:03:20 +0000 Subject: [PATCH 111/119] Merged PR 6316: Set up School PCs Technical Reference: Updated the topic's date and removed an entry from the GP table Topic: Set up School PCs Technical Reference Changes: Updated the topic's date and removed the 'allow the system to be shut down without having to log on' line item since we no longer set this policy via the Set up School PCs app. --- .../windows/set-up-school-pcs-technical.md | 621 +++++++++--------- 1 file changed, 309 insertions(+), 312 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 59d779962f..c4c3cbd233 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -1,312 +1,309 @@ ---- -title: Set up School PCs app technical reference -description: Describes the changes that the Set up School PCs app makes to a PC. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: high -author: CelesteDG -ms.author: celested -ms.date: 02/02/2018 ---- - -# Technical reference for the Set up School PCs app -**Applies to:** - -- Windows 10 - - - -The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode. The latest Set up School PCs app is available for Windows 10, version 1703 (Creators Update). Set up School PCs also configures school-specific settings and policies, described in this topic. - -If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up School PCs app will create a setup file that joins the PC to your Azure Active Directory tenant. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. - -Here's a list of what you get when using the Set up School PCs app in your school. - -| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | -| --- | :---: | :---: | :---: | :---: | -| **Fast sign-in**
    Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | -| **Custom Start experience**
    The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | -| **Guest account, no sign-in required**
    This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | -| **School policies**
    Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | -| **Azure AD Join**
    The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | -| **Single sign-on to Office 365**
    By signing on with student IDs, students have fast access to Office 365 web apps or installed Office apps. | | | X | X | -| **Take a Test**
    Configure the Take a Test app and use it for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. | | | | X | -| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
    Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | - - -> [!NOTE] -> If your school uses Active Directory, use [Windows Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the Set up School PCs app to set up PCs that are connected to Azure AD. - -## Automated Azure AD join -One of the most important features in Set up School PCs is the ability to create a provisioning package that performs automated Azure AD join. With this feature, you no longer have to spend minutes going through Windows setup, manually connecting to a network, and manually joining your Azure AD domain. With the automated Azure AD join feature in Set up School School PCs, this process is reduced to zero clicks! You can skip all of the Windows setup experience and the OS automatically joins the PC to your Azure AD domain and enrolls it into MDM if you have a MDM provider activated. - -To make this as seamless as possible, in your Azure AD tenant: -- Allow your teacher and other IT staff to join devices to Azure AD so they can sucessfully request an automated Azure AD join token. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and in **Users may join devices to Azure AD**, click **Selected** and choose the members you want to enable to join devices to Azure AD. - - **Figure 1** - Select the users you want to enable to join devices to Azure AD - - ![Select the users you want to enable to join devices to Azure AD](images/azuread_usersandgroups_devicesettings_usersmayjoin.png) - -- Consider creating a special account that uses a username and password that you provide, and which has the rights to join devices if you don't want to add all teachers and IT staff. - - When teachers or IT staff need to set up PCs, they can use this account in the Set up School PCs app. - - If you use a service to set up PCs for you, you can give them this special account so they can deliver PCs to you that are already Azure AD joined and ready to be given to a student. - -- Turn off multifactor authentication. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Require Multi-Factor Auth to join devices** to **No**. - - **Figure 2** - Turn off multi-factor authentication in Azure AD - - ![Turn off multi-factor authentication in Azure AD](images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png) - -- Set the maximum number of devices a user can add to unlimited. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Maximum number of devices per user** to **Unlimited**. - - **Figure 3** - Set maximum number of devices per user to unlimited - - ![Set maximum number of devices per user to unlimited](images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png) - -- Clear your Azure AD tokens from time to time. Your tenant can only have 500 automated Azure AD tokens active at any one time. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > All users** and look at the list of user names. User names that start with **package_** followed by a string of letters and numbers. These are the user accounts that are created automatically for the tokens and you can safely delete these. - - **Figure 4** - Delete the accounts automatically created for the Azure AD tokens - - ![Delete the accounts automatically created for the Azure AD tokens](images/azuread_usersandgroups_allusers_automaticaccounts.png) - -- Note that automated Azure AD tokens have expiration dates. Set up School PCs creates them with an expiration date of one month. You will see the specific expiration date for the package in the **Review package summary** page in Set up School PCs. - - **Figure 5** - Sample summary page showing the expiration date - - ![Sample summary page showing the expiration date](images/suspc_choosesettings_summary.png) - - - - - -## Information about Windows Update - -Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the Set up School PCs app, shared PC mode sets the power states and Windows Update to: -* Wake nightly -* Check and install updates -* Forcibly reboot if necessary to finish applying updates - -The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. Notfications are also blocked. - -## Guidance for accounts on shared PCs - -* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. -* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** or **Kiosk** will also be deleted automatically at sign out. -* On a Windows PC joined to Azure Active Directory: - * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. - * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts created through **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Guest** or **Kiosk** selection on the sign-in screen, if enabled, will automatically be deleted at sign-out. -* If admin accounts are necessary on the PC - * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or - * Create admin accounts before setting up shared PC mode, or - * Create exempt accounts before signing out. -* The account management service supports accounts that are exempt from deletion. - * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. - * To add the account SID to the registry key using PowerShell: - - ``` - $adminName = "LocalAdmin" - $adminPass = 'Pa$$word123' - iex "net user /add $adminName $adminPass" - $user = New-Object System.Security.Principal.NTAccount($adminName) - $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) - $sid = $sid.Value; - New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force - ``` - -## Custom images -Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the Set up School PCs provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). - -## Provisioning package details - -The Set up School PCs app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). - -### Education customizations set by local MDM policy - -- By default, saving content locally to the PC is blocked, but you can choose to enable it. This prevents data loss by forcing students to save to the cloud. -- A custom Start layout, taskbar layout, and lock screen image are set. -- Prohibits unlocking the PC to developer mode. -- Prohibits untrusted Microsoft Store apps from being installed. -- Prohibits students from removing MDM. -- Prohibits students from adding new provisioning packages. -- Prohibits student from removing existing provisioning packages (including the one set by Set up School PCs). -- Sets Windows Update to update nightly. - - -### Uninstalled apps - -- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) -- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) -- Tips (Microsoft.Getstarted_8wekyb3d8bbwe) -- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) -- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) -- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) -- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) -- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) -- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) - -### Local Group Policies - -> [!IMPORTANT] -> We do not recommend setting additional policies on PCs configured with the Set up School PCs app. The shared PC mode is optimized to be fast and reliable over time with minimal to no manual maintenance required. - -
    cross markcheck mark4cross mark check mark4 check mark4 check mark4
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Policy path

    Policy name

    Value

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Prevent changing lock screen and logon image

    Enabled

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    Select the Power button action (on battery)

    Sleep

    Select the Sleep button action (plugged in)

    Sleep

    Select the lid switch action (plugged in)

    Sleep

    Select the lid switch action (on battery)

    Sleep

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    Require a password when a computer wakes (on battery)

    Enabled

    Specify the system sleep timeout (plugged in)

    5 minutes

    Specify the system sleep timeout (on battery)

    5 minutes

    Turn off hybrid sleep (plugged in)

    Enabled

    Turn off hybrid sleep (on battery)

    Enabled

    Specify the unattended sleep timeout (plugged in)

    5 minutes

    Specify the unattended sleep timeout (on battery)

    5 minutes

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    Admin Templates>System>Power Management>Video and Display Settings

    Turn off the display (plugged in)

    5 minutes

    Turn off the display (on battery)

    5 minutes

    Admin Templates>System>Power Management>Energy Saver Settings

    Energy Saver Battery Threshold (on battery)

    70

    Admin Templates>System>Logon

    Show first sign-in animation

    Disabled

    Hide entry points for Fast User Switching

    Enabled

    Turn on convenience PIN sign-in

    Disabled

    Turn off picture password sign-in

    Enabled

    Turn off app notification on the lock screen

    Enabled

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    Block user from showing account details on sign-in

    Enabled

    Admin Templates>System>User Profiles

    Turn off the advertising ID

    Enabled

    Admin Templates>Windows Components>Biometrics

    Allow the use of biometrics

    Disabled

    Allow users to log on using biometrics

    Disabled

    Allow domain users to log on using biometrics

    Disabled

    Admin Templates>Windows Components>Cloud Content

    Do not show Windows Tips

    Enabled

    Turn off Microsoft consumer experiences

    Enabled

    Admin Templates>Windows Components>Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Disable pre-release features or settings

    Disabled

    Do not show feedback notifications

    Enabled

    Allow Telemetry

    Basic, 0

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    *MaintenanceStartTime*

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Automatic Maintenance WakeUp Policy

    Enabled

    Admin Templates > Windows Components > OneDrive

    Prevent the usage of OneDrive for file storage

    Enabled

    Admin Templates > Windows Components > Windows Hello for Business

    Use phone sign-in

    Disabled

    Use Windows Hello for Business

    Disabled

    Use biometrics

    Disabled

    Windows Settings > Security Settings > Local Policies > Security Options

    Accounts: Block Microsoft accounts

    **Note** Microsoft accounts can still be used in apps.

    Enabled

    Interactive logon: Do not display last user name

    Enabled

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Shutdown: Allow system to be shut down without having to log on

    Enabled

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny


    - -## Use the app -When you're ready to use the app, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). - -## Related topics - -[Set up Windows devices for education](set-up-windows-10.md) - - - - - +--- +title: Set up School PCs app technical reference +description: Describes the changes that the Set up School PCs app makes to a PC. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: high +author: CelesteDG +ms.author: celested +ms.date: 03/12/2018 +--- + +# Technical reference for the Set up School PCs app +**Applies to:** + +- Windows 10 + + + +The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode. The latest Set up School PCs app is available for Windows 10, version 1703 (Creators Update). Set up School PCs also configures school-specific settings and policies, described in this topic. + +If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up School PCs app will create a setup file that joins the PC to your Azure Active Directory tenant. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. + +Here's a list of what you get when using the Set up School PCs app in your school. + +| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | +| --- | :---: | :---: | :---: | :---: | +| **Fast sign-in**
    Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | +| **Custom Start experience**
    The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | +| **Guest account, no sign-in required**
    This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | +| **School policies**
    Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | +| **Azure AD Join**
    The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | +| **Single sign-on to Office 365**
    By signing on with student IDs, students have fast access to Office 365 web apps or installed Office apps. | | | X | X | +| **Take a Test**
    Configure the Take a Test app and use it for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. | | | | X | +| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
    Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | + + +> [!NOTE] +> If your school uses Active Directory, use [Windows Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the Set up School PCs app to set up PCs that are connected to Azure AD. + +## Automated Azure AD join +One of the most important features in Set up School PCs is the ability to create a provisioning package that performs automated Azure AD join. With this feature, you no longer have to spend minutes going through Windows setup, manually connecting to a network, and manually joining your Azure AD domain. With the automated Azure AD join feature in Set up School School PCs, this process is reduced to zero clicks! You can skip all of the Windows setup experience and the OS automatically joins the PC to your Azure AD domain and enrolls it into MDM if you have a MDM provider activated. + +To make this as seamless as possible, in your Azure AD tenant: +- Allow your teacher and other IT staff to join devices to Azure AD so they can sucessfully request an automated Azure AD join token. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and in **Users may join devices to Azure AD**, click **Selected** and choose the members you want to enable to join devices to Azure AD. + + **Figure 1** - Select the users you want to enable to join devices to Azure AD + + ![Select the users you want to enable to join devices to Azure AD](images/azuread_usersandgroups_devicesettings_usersmayjoin.png) + +- Consider creating a special account that uses a username and password that you provide, and which has the rights to join devices if you don't want to add all teachers and IT staff. + - When teachers or IT staff need to set up PCs, they can use this account in the Set up School PCs app. + - If you use a service to set up PCs for you, you can give them this special account so they can deliver PCs to you that are already Azure AD joined and ready to be given to a student. + +- Turn off multifactor authentication. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Require Multi-Factor Auth to join devices** to **No**. + + **Figure 2** - Turn off multi-factor authentication in Azure AD + + ![Turn off multi-factor authentication in Azure AD](images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png) + +- Set the maximum number of devices a user can add to unlimited. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Maximum number of devices per user** to **Unlimited**. + + **Figure 3** - Set maximum number of devices per user to unlimited + + ![Set maximum number of devices per user to unlimited](images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png) + +- Clear your Azure AD tokens from time to time. Your tenant can only have 500 automated Azure AD tokens active at any one time. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > All users** and look at the list of user names. User names that start with **package_** followed by a string of letters and numbers. These are the user accounts that are created automatically for the tokens and you can safely delete these. + + **Figure 4** - Delete the accounts automatically created for the Azure AD tokens + + ![Delete the accounts automatically created for the Azure AD tokens](images/azuread_usersandgroups_allusers_automaticaccounts.png) + +- Note that automated Azure AD tokens have expiration dates. Set up School PCs creates them with an expiration date of one month. You will see the specific expiration date for the package in the **Review package summary** page in Set up School PCs. + + **Figure 5** - Sample summary page showing the expiration date + + ![Sample summary page showing the expiration date](images/suspc_choosesettings_summary.png) + + + + + +## Information about Windows Update + +Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the Set up School PCs app, shared PC mode sets the power states and Windows Update to: +* Wake nightly +* Check and install updates +* Forcibly reboot if necessary to finish applying updates + +The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. Notfications are also blocked. + +## Guidance for accounts on shared PCs + +* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** or **Kiosk** will also be deleted automatically at sign out. +* On a Windows PC joined to Azure Active Directory: + * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. + * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts created through **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Guest** or **Kiosk** selection on the sign-in screen, if enabled, will automatically be deleted at sign-out. +* If admin accounts are necessary on the PC + * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or + * Create admin accounts before setting up shared PC mode, or + * Create exempt accounts before signing out. +* The account management service supports accounts that are exempt from deletion. + * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. + * To add the account SID to the registry key using PowerShell: + + ``` + $adminName = "LocalAdmin" + $adminPass = 'Pa$$word123' + iex "net user /add $adminName $adminPass" + $user = New-Object System.Security.Principal.NTAccount($adminName) + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; + New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force + ``` + +## Custom images +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the Set up School PCs provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). + +## Provisioning package details + +The Set up School PCs app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). + +### Education customizations set by local MDM policy + +- By default, saving content locally to the PC is blocked, but you can choose to enable it. This prevents data loss by forcing students to save to the cloud. +- A custom Start layout, taskbar layout, and lock screen image are set. +- Prohibits unlocking the PC to developer mode. +- Prohibits untrusted Microsoft Store apps from being installed. +- Prohibits students from removing MDM. +- Prohibits students from adding new provisioning packages. +- Prohibits student from removing existing provisioning packages (including the one set by Set up School PCs). +- Sets Windows Update to update nightly. + + +### Uninstalled apps + +- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) +- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) +- Tips (Microsoft.Getstarted_8wekyb3d8bbwe) +- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) +- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) +- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) +- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) +- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) +- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) + +### Local Group Policies + +> [!IMPORTANT] +> We do not recommend setting additional policies on PCs configured with the Set up School PCs app. The shared PC mode is optimized to be fast and reliable over time with minimal to no manual maintenance required. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Policy path

    Policy name

    Value

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Prevent changing lock screen and logon image

    Enabled

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    Select the Power button action (on battery)

    Sleep

    Select the Sleep button action (plugged in)

    Sleep

    Select the lid switch action (plugged in)

    Sleep

    Select the lid switch action (on battery)

    Sleep

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    Require a password when a computer wakes (on battery)

    Enabled

    Specify the system sleep timeout (plugged in)

    5 minutes

    Specify the system sleep timeout (on battery)

    5 minutes

    Turn off hybrid sleep (plugged in)

    Enabled

    Turn off hybrid sleep (on battery)

    Enabled

    Specify the unattended sleep timeout (plugged in)

    5 minutes

    Specify the unattended sleep timeout (on battery)

    5 minutes

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    Admin Templates>System>Power Management>Video and Display Settings

    Turn off the display (plugged in)

    5 minutes

    Turn off the display (on battery)

    5 minutes

    Admin Templates>System>Power Management>Energy Saver Settings

    Energy Saver Battery Threshold (on battery)

    70

    Admin Templates>System>Logon

    Show first sign-in animation

    Disabled

    Hide entry points for Fast User Switching

    Enabled

    Turn on convenience PIN sign-in

    Disabled

    Turn off picture password sign-in

    Enabled

    Turn off app notification on the lock screen

    Enabled

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    Block user from showing account details on sign-in

    Enabled

    Admin Templates>System>User Profiles

    Turn off the advertising ID

    Enabled

    Admin Templates>Windows Components>Biometrics

    Allow the use of biometrics

    Disabled

    Allow users to log on using biometrics

    Disabled

    Allow domain users to log on using biometrics

    Disabled

    Admin Templates>Windows Components>Cloud Content

    Do not show Windows Tips

    Enabled

    Turn off Microsoft consumer experiences

    Enabled

    Admin Templates>Windows Components>Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Disable pre-release features or settings

    Disabled

    Do not show feedback notifications

    Enabled

    Allow Telemetry

    Basic, 0

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    *MaintenanceStartTime*

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Automatic Maintenance WakeUp Policy

    Enabled

    Admin Templates > Windows Components > OneDrive

    Prevent the usage of OneDrive for file storage

    Enabled

    Admin Templates > Windows Components > Windows Hello for Business

    Use phone sign-in

    Disabled

    Use Windows Hello for Business

    Disabled

    Use biometrics

    Disabled

    Windows Settings > Security Settings > Local Policies > Security Options

    Accounts: Block Microsoft accounts

    **Note** Microsoft accounts can still be used in apps.

    Enabled

    Interactive logon: Do not display last user name

    Enabled

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny


    + +## Use the app +When you're ready to use the app, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). + +## Related topics + +[Set up Windows devices for education](set-up-windows-10.md) + + + + + From aaa60d5bb37d4b2c91f4b9e62166463ba8353a93 Mon Sep 17 00:00:00 2001 From: Douglas Plumley Date: Tue, 13 Mar 2018 09:29:31 -0400 Subject: [PATCH 112/119] Corrected spelling error, changed 'Dekstop' on line 53 to 'Desktop' --- ...lock-potentially-unwanted-apps-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index b30883b882..9f225964af 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -50,7 +50,7 @@ PUAs are blocked when a user attempts to download or install the detected file, - The file is being scanned from the browser - The file is in a folder with "**downloads**" in the path - The file is in a folder with "**temp**" in the path -- The file is on the user's Dekstop +- The file is on the user's Desktop - The file does not meet one of these conditions and is not under *%programfiles%*, *%appdata%*, or *%windows%* The file is placed in the quarantine section so it won't run. From 4ffd88ad0328d6c15b8bbb621e854f4dbd23b89d Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 13 Mar 2018 14:44:01 +0000 Subject: [PATCH 113/119] Merged PR 6328: Diagnostic data changes for March update --- ...ndows-diagnostic-events-and-fields-1703.md | 38 ++++++++++++++++--- ...el-windows-diagnostic-events-and-fields.md | 27 ++++++++++++- ...change-history-for-configure-windows-10.md | 10 ++++- 3 files changed, 66 insertions(+), 9 deletions(-) diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md index d6c2534f87..819b8ca97a 100644 --- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -9,7 +9,7 @@ ms.pagetype: security ms.localizationpriority: high author: eross-msft ms.author: lizross -ms.date: 04/05/2017 +ms.date: 03/13/2018 --- @@ -832,13 +832,17 @@ This event represents the basic metadata about a file on the system. The file m The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** The version of the Appraiser file generating the events. +- **AvProductState** If the app is an anti-virus app, this is its display name. +- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. - **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. -- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata. - **CompanyName** The company name of the vendor who developed this file. - **FileId** A hash that uniquely identifies a file. - **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date. +- **IsAv** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **LinkDate** The date and time that this file was linked on. - **LowerCaseLongPath** The full file path to the file that was inventoried on the device. - **Name** The name of the file that was inventoried. @@ -847,6 +851,24 @@ The following fields are available: - **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. - **Size** The size of the file (in hexadecimal bytes). +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents the drivers that an application installs. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **Programids** The unique program identifier the driver is associated with. + + +## Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. + ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove @@ -1628,15 +1650,19 @@ This event sends data about the processor (architecture, speed, number of cores, The following fields are available: -- **ProcessorCores** Retrieves the number of cores in the processor. -- **ProcessorPhysicalCores** Number of physical cores in the processor. +- **KvaShadow** Microcode info of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. - **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture. - **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz. +- **ProcessorCores** Retrieves the number of cores in the processor. +- **ProcessorIdentifier** The processor identifier of a manufacturer. - **ProcessorManufacturer** Retrieves the name of the processor's manufacturer. - **ProcessorModel** Retrieves the name of the processor model. -- **SocketCount** Number of physical CPU sockets of the machine. -- **ProcessorIdentifier** The processor identifier of a manufacturer. +- **ProcessorPhysicalCores** Number of physical cores in the processor. - **ProcessorUpdateRevision** The microcode version. +- **SocketCount** Number of physical CPU sockets of the machine. +- **SpeculationControl** Clock speed of the processor in MHz. ### Census.Speech diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md index eac9fde18a..963fb2a1f9 100644 --- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md +++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md @@ -9,7 +9,7 @@ ms.pagetype: security localizationpriority: high author: eross-msft ms.author: lizross -ms.date: 02/12/2018 +ms.date: 03/13/2018 --- @@ -317,6 +317,8 @@ This event represents the basic metadata about a file on the system. The file m The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** The version of the Appraiser file generating the events. +- **AvProductState** If the app is an anti-virus app, this is its display name. - **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. - **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. @@ -324,6 +326,8 @@ The following fields are available: - **CompanyName** The company name of the vendor who developed this file. - **FileId** A hash that uniquely identifies a file. - **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date. +- **IsAv** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **LinkDate** The date and time that this file was linked on. - **LowerCaseLongPath** The full file path to the file that was inventoried on the device. - **Name** The name of the file that was inventoried. @@ -332,6 +336,23 @@ The following fields are available: - **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. - **Size** The size of the file (in hexadecimal bytes). +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents the drivers that an application installs. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **Programids** The unique program identifier the driver is associated with. + + +## Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd @@ -1593,6 +1614,9 @@ This event sends data about the processor (architecture, speed, number of cores, The following fields are available: +- **KvaShadow** Microcode info of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. - **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture. - **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz. - **ProcessorCores** Retrieves the number of cores in the processor. @@ -1602,6 +1626,7 @@ The following fields are available: - **ProcessorPhysicalCores** Number of physical cores in the processor. - **ProcessorUpdateRevision** The microcode version. - **SocketCount** Number of physical CPU sockets of the machine. +- **SpeculationControl** Clock speed of the processor in MHz. ### Census.Security diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 144f6425e6..02dee783c1 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -8,18 +8,24 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high author: jdeckerms -ms.date: 02/12/2018 +ms.date: 03/13/2018 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## March 2018 + +New or changed topic | Description +--- | --- +[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. + ## February 2018 New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Added events and fields that were added in the February update. +[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the February update. [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune. [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune. From 97f4b6e9820c80c9738df61d9218f51b9846ed0c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 13 Mar 2018 10:17:41 -0700 Subject: [PATCH 114/119] switching to new feedback system --- browsers/edge/docfx.json | 3 +++ browsers/internet-explorer/docfx.json | 3 +++ devices/hololens/docfx.json | 3 +++ devices/surface-hub/docfx.json | 3 +++ devices/surface/docfx.json | 3 +++ education/docfx.json | 13 ++++++++----- gdpr/docfx.json | 5 ++++- mdop/docfx.json | 3 +++ smb/docfx.json | 3 +++ store-for-business/docfx.json | 5 ++++- windows/application-management/docfx.json | 3 +++ windows/client-management/docfx.json | 3 +++ windows/configuration/docfx.json | 3 +++ windows/deployment/docfx.json | 3 +++ windows/hub/docfx.json | 3 +++ windows/security/docfx.json | 3 +++ windows/whats-new/docfx.json | 3 +++ 17 files changed, 58 insertions(+), 7 deletions(-) diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index a699361d13..31eafa6401 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -21,6 +21,9 @@ "ms.topic": "article", "ms.author": "lizross", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.microsoft-edge" diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 056939a089..b7a205ddd2 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -22,6 +22,9 @@ "ms.technology": "internet-explorer", "ms.topic": "article", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.internet-explorer" diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 91c25a934c..7a67485a17 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -35,6 +35,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.itpro-hololens" diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json index d6a3efaf96..dc151c3165 100644 --- a/devices/surface-hub/docfx.json +++ b/devices/surface-hub/docfx.json @@ -24,6 +24,9 @@ "ms.sitesec": "library", "ms.author": "jdecker", "ms.date": "05/23/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.surface-hub" diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json index 502700db32..86d594455f 100644 --- a/devices/surface/docfx.json +++ b/devices/surface/docfx.json @@ -21,6 +21,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "05/09/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.surface" diff --git a/education/docfx.json b/education/docfx.json index 067964f4d7..c01be28758 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -20,11 +20,14 @@ "audience": "windows-education", "ms.topic": "article", "breadcrumb_path": "/education/breadcrumb/toc.json", - "ms.date": "05/09/2017", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.education" - } + "ms.date": "05/09/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.education" + } } }, "externalReference": [ diff --git a/gdpr/docfx.json b/gdpr/docfx.json index dd5fca1462..d426f781dc 100644 --- a/gdpr/docfx.json +++ b/gdpr/docfx.json @@ -31,7 +31,10 @@ "externalReference": [], "globalMetadata": { "author": "eross-msft", - "ms.author": "lizross" + "ms.author": "lizross", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app" }, "fileMetadata": {}, "template": [], diff --git a/mdop/docfx.json b/mdop/docfx.json index a9a41d5222..a6ff6398ef 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -22,6 +22,9 @@ "ms.topic": "article", "ms.author": "jamiet", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.mdop" diff --git a/smb/docfx.json b/smb/docfx.json index 866b2b152c..181bf75fda 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -31,6 +31,9 @@ "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "TechNet.smb" diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index accb0bcea0..d739d26b28 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -37,7 +37,10 @@ "ms.technology": "windows", "ms.topic": "article", "ms.date": "05/09/2017", - "searchScope": ["Store"], + "searchScope": ["Store"], + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.store-for-business" diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 285dcee673..7d3ae2dae2 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "elizapo", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-app-management" diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index f649a5d1af..4fc5382798 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "dongill", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-client-management" diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index e5720e332c..abe019f76c 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-configuration" diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index 353f473c8c..e722db5465 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -38,6 +38,9 @@ "ms.topic": "article", "ms.author": "greglin", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-development" diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json index e33995957d..781df2941e 100644 --- a/windows/hub/docfx.json +++ b/windows/hub/docfx.json @@ -39,6 +39,9 @@ "ms.topic": "article", "ms.author": "brianlic", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.windows-hub" diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 18fe87fb57..394ca15239 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -36,6 +36,9 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "ms.author": "justinha" }, "fileMetadata": {}, diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index 1bbc64ff9e..34346b0e9c 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "trudyha", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-whats-new" From 402dc5b319998426eb1ab5acbe064ac5864f3522 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 13 Mar 2018 10:40:54 -0700 Subject: [PATCH 115/119] added screenshot for cmd --- .../application-management/media/cmd-type.png | Bin 0 -> 25765 bytes .../per-user-services-in-windows.md | 14 +++++++++----- 2 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 windows/application-management/media/cmd-type.png diff --git a/windows/application-management/media/cmd-type.png b/windows/application-management/media/cmd-type.png new file mode 100644 index 0000000000000000000000000000000000000000..a6c13e8c7c0bae4225dad0b0ced0dc0f3b510a60 GIT binary patch literal 25765 zcmd43WmH>HyDo}rkfH&KyA*;$aVTD(Sb<`pXn__l?hs1RqQ%`QT8b6d;%>z$#XSUv zyZH9E?VNkZ*?W)k zP=I&7z3Dyz{vo?)Das;Mj6B@|UZ7dasL3E9Rmb4onxO-)u^p8RT#%6PyB;6NeGbJI zNJtjXm0!r{c$geyXv8rIN4wu}Kac!Tdqix*yEi}bdQdd9+=0GUQZZ}u#-v;Bo=Dm2 z#b#S+|7j<`urMK-452F~e?Ha@Z5IUeAO3FlZ`;hkFtba_sb5S5R50MVqBd)M!Uy0z zFpXNqORc8Ik39t3_>^}ZKV2LDUk~(i_ItRy@XQQbv+fHnVOuJ@x@dbaW~{v3l6ug5 z`0db^xLYwQ^>AAod4Ceqc7I*=ou^}(*8f&B$}}>wS3?;EpM7!KV<)RcT8>A>8(HEk zNC*o4kS=8Z)cMD~@6W%=9>gw^cwN|4EF=Zqf|(j*BxT@Et&I<6%AIm`4yz=pSA+Rm zFaa+bp8*P_o2&eX{k*jG7aWb|8!$?Y)KQ77^&bns73&p)MiUOF^DF3!)LTw{-q>2s zJ)Fv$Q{c@g9!|FgDi-Dk?9$>}lSkGe>lNAa1mU_~IT!s*rBJpq3M!uOmPl}80~!3yWcVqXJkb4v6|xMPn2#4u7*NOK zxQW~i>*=$o~9GUv{26p1>3c1Ml zC0^L4l5^m+T5#l~jCi)wL5m3woWycpOWz@o*Xpgf`zZ$YhT}ni9N()byZG1yVnh1| z&V0`K?L7${3<1^8$7IYwb~1$L0V%c37H}K|B8SEE)wpUI7&DmlTQ6zX>qAdqE%(}0 zuV3z%M9I@9AaHu*H%*v3-k4i@;_1XL&CP#%E2fV8S|I0YSUFifP?yImjjUnB4X(nI zzz$FD^k>{x-!0VU&x?TUlcspU z9dz83u8er|gTP#mM8+#*OpgO>N=>eM1Ob@_dPxD^UO=P2fG5FwGOwVaiY1L+Hr2{ z;C`I5`Sy^*%-X|riioIJVEU;-nT(*&@sZJ7LvcWs@w@M?yc~leH1zO99OA|#GjJ={ z&z?ua(5Ln?-d;SaQ#aTX(~0U*YT_&#)hhikzPFI$g2xph>%wlbKq!rqm0GZS072uA ztaB&J*tauP(iMzfyilHQc)tH-d=9;ZoSXS-+lQ~eI~b&lB{aZ`8oEsN_J<;_faYs+ zR6T`$UtYr*B5<4tpo{hIXz?TJa4;L>)(3o9p5eOhn_eoj!qXpsc+(t9viz4gU?aK&OIz5S-YBIVa`o%8WZ zEFkLlXpyhn(!i#xOnh}`v1JPWEj)u7wq_kRaQt#-xzlch^*#OrcdNhTGi#y`>>pdm z%Bsl=^i8PKq=uecYbMApCU%(c+HXV(r~0NCKtV}FkpE zs3H@`n;N%a8e=M;nIF`Jq)VRf>dzXq9${% zE~BJ+J}Qm7X_A-0R$%nBnT=Rk-1XJ^`xG7gWN9X})%~S3d7~?ckN^#-S>@%RbeLQ?+v@H2SJZw(qX46c&l+zZZVdO1X0ag&K zfXj#D(!$IFN^!LSdy*I9`dHba@+Rsx)V$?JL`NBSlPC1|pR3*KWPUfm8`#Mfcon)j z(EB^Jo%5KMwyGy>q%?M4C+olZ$_H8SRZdJbPV-#_0vuhDIf%o_{ zuOwbsMffqch$&QOVPAR-GsIJ$r~Lo=z+1=r%MF6e_6HzXnWllQCI2IWF}&QXY_mO< zx<^3Po}IpBO~)r#V*R_49FyIAqRIjHZ646<}^?{|$zi9cM8H;MdG-O=W?2Tiww zNkhiXBe^IpDd8;r1$RhRg_JyZRHcK}mkU?)Op7Oi__=p8T&W)GDiLB8eI@H z&X<}^dgjxH92q^;Rf-P_Vi?Twa;w*S-&eI!Lmsce9zy+CI;=i&6jIKX&qB=SE@gLck3QqCt3Ud<-=9!oU@X#CKa0o7!#@u+!NcOw4)}tk zJ@)4V@l=2(@w&hi{_;94csqCdEtf3I^z?M8*Lg2>)Sz&nhg?#b=lN%$CN&R%b1Mhd zWg;eLjNGY2vjERSeum%Z6j-)TxtE;5Fl{Y|=7hs%`KMZHQ}7y;sV~5#e*dn}ch7gK z0*7vXwjMW}E6aa%S-!e>0%cdMa-EoZhC=g7;g!L%DUFiAxeIP2HTqCl9Q~4VU(g_* z@lGolYFTd`h2Aeidn1Px(4vs(a}+A^WPh6FadtuS zKR_p$;d4#Cub+du!q*c00ekOWz{{dyj2br0Yk5 zFb65zTgDTgm&rw$TOApiC7=>Fb`pIXkVaxFJ8>pIwo)Q`2ylraJx-Y}d6Lnruo;q1 zw9cOzP%Y|eZ%r|>FVv$%c>Nc}3y6HuLwD>=$gkhxUgu`V01hT$>Nj_RH@T=@IU~CO zlzyYtmA-6eQ_K&|liktFkmDYIdN>e_x;fOeSWO-V-XJXZT1;NQRN)ppe@CZ|)vlau zb0912fV68&8A~SU!OygFf0DgVVx^@wfCUyY8bxr^zq5A`##N2Q4UyrIC7aH%(|j(r z{OQ>snsv_XU&{=|Ep5OPU!t!*PQ_7>?OXQm(fMQ2m0nov`k=<4>j{x_b$i5maecx1 z(duG&WY}DJ0D^_-Foha5x!spNI_M-va;z*+caH9)@V9hwwV6G5m$@ZitgrVW4$a;s zXgJ~Y18mh3N`t`roT80(kW7c#tFW!^Rv*A(hYgyijbrA(yUxehAp!>23HFe&?5)1{3kh})u&y!%Fuyw(sMx8CcxI2)Gx%P8P9>*1F5V(NtiWB#I? z6iw1!{CjHj@D-$Pq_|w2HA_wW5J|Ge8&*+yO7#^L^#tdj_v=L z7^$NSrr1?9`hBqzp?^%2)MfoYZl&5)xR`cfKfC<9cuNwYGyy| zzqiGe>i5++Fm7FKoTJNYbUUveT6gFr+~%|2y!|w&$>Tq%J0Qs};@Eb*(dTO8&Qv3dfQ%%U~Iy*iJXZ|XAA1~Pj(R%A2eFWM3H_rnpIzd!>CCl6uYcU7Rsl>R*|O8((IvVX0QSY(6&SNp!3ir+|yL21>V)zu$f1c# z!ng zv{0Kg3~XSE7_oF}%y#de+l5t_VS%rND=m|JwFC;2H^sNh!uOF?!OO~xlV!hYs4k5x*Mj~YcLrng3Z*kCvF5%5`(lkyZ0_GJ%(n8BrmZOs ze;X{}cU1nQ3;`d8i&u+^d0FTe){@H*j8Ezu)$x>?T(22T(WnA;Ceb%YwHN%MMM?X# z6q4UY<>I@JuA0Fx{eief<0MeLAX;Cvk-BFXsn!=^Fl2 z91Z8m zYV9TZF4Cg1=$>7-U?`kBr`w#2$z;tn-K}-~F!feSVWUZUA;VX~GTVyqL(Xd|#Psoa zhS4m6-}q@v7s*ougqk#8z0=TWG&m9c6FB!ZiMVD{yrZY>#nv48&5X-Y525L|#${K{ zd}xWtp#0n6_Z%KPbq>SguV|knd1aUc&(os9ZIiavW;Q3jmL+ez#OZ&tPPS!0O$h-V zX3uBXX~?pufY})HXO%NJfiV~@8CE!8%=1?XHy)4qq6AXIkR{%1{4$Zg<B-=Vb?DoG$IDCYo=!Ia7rX+L_F+%EU7tZEWJ`@!lEALBVSCd zC-@$RaNgg4xbPpPq?jIhlT8utiLcaE{XR&xXHa{Yasoq zH!7Wqtamv&;#~c7U9pk1af40Cf%fgLm)=(CQ+1{HRSAboQ+eV5w%nooE0%=Z?~e%1 z3UlAAES+B()e3$(nZdUxcS3+8Dtu}dv z?$6*yB~QGxbzX0TulU^@@O7vr1s>lVwV6|x<6)sjVMx2ss{X+jrS;VwdT2J&7#t^c zx7Ca@aj{eJ#i)`|AE8!)^ry~;&bMmUZzl=d@bxHXFvoRvy%&6w2FyN$6X4%O-e7@f42D~meX0pn|A2%|;_P2@^D{?FE@Kryo1X{xk zQ{ab~*p$T4Q9&(OzAKu1gu(VGXzpB)N6 zZ8pE$S3T!`Y5#*Ld*kp)0?SOXs|p$K=DYEY-jf zD85DC8?SkC)b316!1Bsc3(rQ$qtKiOQmgEMkf1!26vFozzG6D8L7m&P^j~UeejS67A+J(<&O~(P=+1 zdo>{?hklM`Lkpq`WHmmG%nM)lW?m)o3h>u&7OOSi#0Dh~Z~WYhR#%jH9kqs`C;Xr` zmgEbjghSV=?>c0hCF-xQouQT*HR&9g9lsh%A>WM!l0^25wdLh-OT?55s}(@mBcHtnk^sk(su)c(0N z1X?-Q2?)!a>ePG-eYN}h8;8Rrupqne%8d_BCD(~5o}QDGeEE`~EYYdtqGZQG1sWfL z1e5cP>BG6H>$97C|JeupM#_D`?eSi}qO`Sd-+3;K4J07wdCrn0;r1-eWkA6753763 zoBo+XRc33=Tq;Y!K@Pb>&Ac~~pp|g1zW-6~lo5324!JL6x|EBTS{Thgl`of^F>QI8 zO1;kWrhBE*6)&Dr!LKqnAf?TB2Rh@g8@~c&j`MhxcdHG>xORwJ4*N|a)o=AqZkHcIP-F5|!{02b&a_Yd+@`C2KBmwUsOm$GY#km4ji3 z=i~lEV}Go_k||nd56V*bt_QYU6t$CdSZ8QJy`DJwePs|}Nm1715E=6z0`bXxM=si? z0>W{E;QFH!AQEb+fd{h+vdMaR2SzvxPeSQ8dG>n_O&_kw-4kYBgg9hsybQ}M$qVdm zjP#;oVSPf=Nz{*O=YB=o;lsk(&$J7XUsQ7zNFD!!kC7***CCN=_*(+hcAwFFipfv(H0dY z2+6;mFXt3(E;aO6O_U7(%FJcs=ef!!7e!IApD4QnvbbaEf14XO73a_Ti|D9=G#Ejd zT6JmEvJT>d1y3bO-=ZG-Fo?rP61{f02BgW=l*Ida)lZBS?nvO@e^S+d1$~vXaH%Q! z)NG*z6G`7Uvx1!m2WSn7X2I41jaC*|RorntWN6qRA)_W_5@IbrQ-0kv7$9UJEM{>u zEDd3LxT2{slip?T6-W#Ww273V5=5|!SWamm8#KlD>b;fx6;pzw<@J@}u>bChbha`` zfOE9EQht-hZw1Oin>sgD0=aKnj(N{}1)SO+GBAMIBxV zW8urI_|dmTEDI0EL@bAGOhoQV&Ti~Xj<8yw(Vc~{%bLffkQ7j2qU615sbZKx%7Lebr-Orf7a6;f19flB$?Fsra_gYs}=xk(5Xk8x^;^8_SfbGnXA z+w2Sd`I08RZ-9r~t5rvJlXCW8g5v-QK4|9zM@Q2}kFIf2b_qm=wK zu*?@lCgT68_P|-3Ab9Ho6to~dIJ$-f|Bb4}@!6_g`&QaY*D>j;+8^IP-^vkv4VkJM zz&w2|%&wu-yTv1R|8omtX$v^H5V%swRMY$=EfLUmBg*wD9p85y{O;d(m%|1Sc41A{-!3VgYn@L ztVUFj$otDHtu}A57h!SMe;FHM#bar^+dl&v>zF{Xka%j)hkpd3CsxZ;&GY*V zuUI0!1{!-Ap7!Q1fNAnb+9epAE#A|`zrInKp>hb9QB7UkFxUqgCycHN?X5g`a25eK zyJYh^VP}~iCA_W=wnS|)Npw6{m`3j!YbzxX10PnV|8&-Tzkv=BqA|W~$K6(|QC0u0 zYVQ?q-(fdH^AH<5wk;IDJ8-`6dt;nmsNa=70`cmgh-Bv(FRPHZ*hv!I6F$OuNIIo{ za}s61lh0?Ls}E8Q6TSe($CMV!6a9PN~T{%+mWZ)<$qV z;mf;UjkJ)_3M;L$W@fypv*`x$rgs@jk=p7`O4!`KIIP4bTtD`tfRMK z3%&hYMdhAV*vXPK$C#}-#)|rm!3aYfPcbh_#CTuz2CZdjPPxpfXDCgJD@s&WQI)0i zqc_J(a$|uG1071DAfrAB^SSv~7zob`c}oTh?gQ=6leu zZU%)#VW^_X4XCs!kFL>}L3DU&=wSW05}*)=iVUldOnaZBWDwk_h4ZY>0T7n=(pIjt zTZ`uN8he>SH_e!B(d!X`Dc!}k37(rWOoh(bI%bML4cg={5JR6g-zJ!e<7uiwbC=~$ z#2TkF;&%+ly%r%ov7Q617`}*aCf*E5R8e7LN*86UE z7qg0MH_d`E;18WkSgZ85k^z2~{hx){ze)}Yw;D8`hkL-xC5>%>Ij zULe9qJfdgYDyZWuW0oEP8Z7cDCCI+BHe-y)cWkuWIP>&RT)hvtyo%=tK`4}5m3N7b zp@V2V8~M0uf*)3kW50S&qJPACSsPkT@^mj3IzJX#jt?o^$q#2W${<}u8Wdl)k$c3fX4%!=Hq7k~kE#BGbBvU9JVxx0Tz}k-g_=l;l?srdIwSYXgb{KrYjaqXnp8c(e zvpb4V&K6Fs2Voux5KM;oVs}ap+f&k52?es4111ye`pE@ELDu2DbX_El2t?)W|hQt!6?m ztJO5SqkC+2J|Tr-&cl9>K}S~S;G|fA*Dm017|}~kCKy(l)C`M>>N57PN)O)UbCwaa zmiE@SpFV~bndn3bAnvpmeOXrmU>7FAwe)KhbN{t zqwn#MkiSOgTC^xsXyMUqyf+x^6_mkZsD>D;(+NOa4O?!CBKpOQ`WqAs=(@Nbe zHl;V-#`9blF;R>35ly7$O!(IpTk&!2RFR7iIGwjg&FGdGzlhsm42I zob?cP5TlHKe5>$1P++`j#aY0sX|!`_M#Iu7Od&(8V68mbE02r za3B_WHyVjyaOzv-10ZcXmnx!UK~Kk7SlcQ}BDU-bJz*YZ!yu;W|ANf*cYPoIv`wWj zM78NU4+HQAD@acdAF_n`uYJa*$=wV_&*eysb1<(YBO5hbv9!e)EwmKI7x{mc4##+& zH7W)_r5`Ix@!Phnh(s?^cSsQMK6aI%#ky&#>Ojh=RC1UoLY-y9PXLYTi#j&)Z8XXN^W?c2A2!`G(+UAK{h1Gw+{DEv zb!}A_g1{=w#xZkQDAKX-?rEh6E7c2_HX;t&SdGF`#tYSr#GF~swZ{d0L& zh-pvjeB111+tLUYo=!ZY-g6-7F1bm*K9vi+4@QF8yHERfRMqn2Q0mnbzswOAV65vyl1RX>7tw498TPS?&^n z-@bPBVc z`3Jft8N!geL3lxPJtSX}&y)*9N}j5-ie?d3xr#;ybqC*GpDDYF0qK@o@hKDV?bmC5 zlIMBrRSI(ITp-BV3r!O!RK5AB_$+^!WQYFAO}>|cqgG;^@gKl#O#_ zATpDzz~F))P#C_neU<%~4OQW2XOu1N@;OK2sd(C#--~kW4|`UPar#B$NYHK5vZi1W ziVGov>Elsk37Yff`QGiPyiv;{iHh&#ayc;bAq;kZq}UM1{&SKjxKfj>I5=I| zyZWXg^FP_5>NRUjtcLMQ_$Ggn&I*up@<@|P{--ec-xJZtob>;@mshk}zvqu!oVR?` zvst7x)|TnMr>EG(8u#s_=ne4AFnu;4()_ei{~&`g_{Z_{L>Id$+0oX_u>@4{7WwFO zV;i{C(7|dFpcIjG_A7PU|8IMY3Vb95Zt!(Z>}o2Y4LkO35E>^1>UzfZ1hByuTw9Y_ zvk#>7C@K$YL}i)&18@V6+plYKrzzoG*!(4}!0#m+MHjqkB9^(@+tQ9^zPGREtJ!_3 z1KB)nUcY*Ax|A@uBY;f{Tf<1&%ynfAI!!+N)pjVxwlggCHr4s6#R<2DQ36PALAYeQ zz~{MH8uz#ao43I%lH&BQgf&O5;43*N~qL!I9~jO&f&IHEu)B0qqj7odEvw!Opof%Jp^LHJ~IEM zfZ%?|>kyGbbWij27;(lPe+Y*CseZsh3oo+;Nl8gk z$?vGkEEgLJ4*vD~?0WOFHz{qCbb^RL9Sw_&s~O)^w0R<;#YGf-dDT|mJ2(IXxwZ@9 z$88kBSJL156Sa2jb?>vQp^w?FVnZ~tLfhJ(9x`aC;#u-z&e)evp?Wu1NxdkEQkD~; zn`%#C)S0nBT?*%#YI?8#^mTp(`e=-wm7|_MK1OOoovPZe77KibZMOv&6!*_PNFerjm&zzDvd zp1y|nEwD-+q1MDW4!wT_ZE!dP^77vQ6sPN#g2MRIi9zU+6*7 zoBsU>EOlY)5R3PklK-&$I&M?yUdalQ7rwc!W}axlg8h;lrFsdQXWP`wiRfX;Ua?jh z!shPKkHu{kGi=gJle%+Y>k)AOgcp&XUnVT_y#-i~YM7mS53K*+cVfl}$Rjst9O<94dyv#= zXfs5X!^=|V?blR@mO45SEW7r)ITytrCQ6LY4nvH85d@r#6Ee_S)lLXK3khpZOE$~ zja8#|8)7h-TU3myu#*DEcijdDjQUnHn+wJ~=El?*IFwa$tsf()acvtI-RnOn3P&#v zlfkV%ROay@Ln?z*(k&{D_kA6DVZ_5t!sCWXNLV&iI_8z^vU!HXa0PHb(L>X;@^-B? zsSrVj-#oiz&faTq)u>;Vhs!UH9&w&pRJpjMDjUR{0A#IeHf$K+gA}!68go5=b->x` zy)-1ed+b}qjpjv>DeOoQ^f>4_;qH27cf9nywuhUxs8`#}QxcK8_mm9+xWm+5BgR2B z?8AK1weD=gMY_6UaC^8>-~b7W1?xoDx1Y=qP(z*>8TzXjLVmAg&#oG6g^3pQL_)n0 ze4GYZ%ignXClfN9(+TXG88|9L)4aDF9DV@s0 zK7HSYxbEhWWVPDzvA|jf&33e{D32xrc!+=Hua4&N{l5IWk_Z4Ts?K=A|Ae>#K$QdE zX=3BOIhMckxIf70G7Wop>N1!B2KBt$i>e6mm%6K&FmFK|%%^{t_(UB1k-y9~8qe!n;?A^5 z0cLo9KEsxeR$~^o1Xw?{>gHjGPEUEGrs?JqbtvmZ381X_9uG(XrM33JwG`w8*#U-5 zzhgK@3VkyLbH0$YC0%drv!R??{%>~YV&nPPjqj+Zp;z_x2Fq2wG zkE}W!IcK%$2&;9%%^7~z@ucR_55QWDqEn0b>8!&QL+8@?+f~9gb0{b?9IdeiF3|{R z4mnUI$MwH7+93c^jEmyYoO;lcG-NfNKGlMI9I(lR-=}$L2rHIoR@21GbwW|2B;Qba z+pl}~Kn?Ep=M*jvfI2PCn_M}FXPf0&$Vp0b!(*#xgpfR8Ni)$bFI~4!p}&{wGc~4d zwlVQDe4P4W9gM|0w2?-Xot9_O_%u-+!+i3w#CBlV9!g(dIU?*z@3jQwBPbiU2^lLn;G_B$d4+_D{bkya!yR4RN)K_*<=G!3kA1f z2#7V{;`%XDBoUEXyu3I!nOt#|q_@#<;9#fAR($2@AxQyid0x%no&?1=$8{CmnOz$h zr|O4c7#K@s#d-2K7AYa{nzG6O8k>Sg2|(&(&-R-xU68uXsYu-2ycj&dYo>4?WsONm z*NFSPm>A$R!aDY?DESO$ZAWOk>bEq$kO2-{ul;Pt56aXr-DqJk%BozEeMFb({UJF) zts*>wL+q;YXH8Y!?1&2#Fb zrP@qZ?&t0>rc`(WK zluZuU;O<*zLapSOR|aK0sAy;IcwoKx5}Rzs)~JJP3r+2g5v(8mxu7u*xgiO>5zGFm zuh6O&rgdY1vDxQo`FR-)->K|Y<{>iU>>aoj>u1a(x;~vLxr6p!g)k$g*0I>!oCSZ5 zg&7VA;#P7+dxLATGz3zxZX{^XQU}61Tm{-=dW3sJ0*MoLHFG;6nb{zO%m^%UMR#7e zrluaV&pIk4LIopo7t;JCb9X$H7K|2w{j#+hnB{l2_qXp};;CUORL(;{S<#jHnoZhc zg9f&o%!N7{SwzKrGt^~Ox}d0*MN%fOxji~A!4Erlye_-YUuC_MIYCgh7mm=T8t$|e z@hl>jNVoNccMOmxlgPax$;+|I?(jwaAMxPQCCNqx{+YFAgRu5bRg^rVtmd&HpUVSX z%!p-z18TfyUd}5c(|0wlDE9*qf8fO)V6|9-PxUj4xm3^d7j2MAUUNKY&<@v;rS;R7 zCP=Jrr|MmjJi}2dQcWCk&Q6xM5RjNc$NTz8*)7OvF?W`p(rSoAHR-apMUUPO z@<51@cag*Eqk>=UwnpO`@Lx>s7HGsMgIqQOgkFNgP2K6x_Pbg>ptRn3Ugw?bTEw`e z5+ePrS_HuzF>9jSJZv_-9JbgO?r0egwc$XW90!5-vbZ}T_6E26Hqub`MX;E0Htunx zlXDQoScH}yZ8y@g6R^KftB+bROrsQrjQkD}L6dIGd?##Of}hFF#&9v@Y9C2cE{#9a zb6ksp3k+P7nlQGXMXQpw{x!eba_}}V0wLDDvn;iOa!MlOmqR06?j~Qvv^#ny|Bc4L zfMxS`Y`hA#qpt8LFTjAbgQ_%`+#!Dt&H9+(ByJC|z-)so0aW7%D_MTrooo$AdFbC7 z(`@0lRpBx*{sh4$5UbQj!g?0g(d=W$MDpd0ZkZ(+d$o>PQYtC4h`8?Pb5gC5QeR8q zX5Gfp8x^C#c#b_43VoDnw*os&lh6Cn7@0UDr;na;kvJ#w;cC=>q736JNlTr`VoJ|h zN!C-bFm^sBrFj*kAs>W*cDm$L1KMlvzox=fcey&o{b^TqO$S!@(|F8(-zVWXSZ z3lf@5W+K#2Iqr^uGQi$HsM(j|9JP2jmgl~-x5eLMNAcR|u9S2R07xS8af$fv_&km1 z6}8G(?}mh)~q3liWIi5E|~hSx{jis|0e4&#h#J3f1!WC z`KPMrNnEbn4IFS?EFNh_O6^Byl zFOqIt&bPjsa3Jp($ZdLCB>_@X-Z7Cm{&SiJRizReIAcCB+ClvqI zd~WC9WIKi1Vknk=a8Wx%cuOl~4uRI2CiC3;6s9#_B4e4Q*)mqZ2UP2+?UPLIc*b*i z&k!}w|74ztDBosVfnkPIWek9hr8O#ve_7eI^Zt#=H+-dUB_F#65_3_Xm-iBLu+vU2 zi%rNx$0OZ~Uu~%WS z?S!9X^cJORj=CWIo7A|E;|t08uIEvvd#Fp~Q}B(eGH}*g_~S>GQiN(c3KyR2Sz0`I z1PZPSTss?O9|{}qby&w8LVO%`fvq6fTmJrii)L(nu58Bo6@W=WvJDk9=LXZMPhkw%O;F z-;Rz^XcZ=muTFUicF9^QsGrZa<1h#$KhMQO&Oad&a@*3PnG;nh&C zgD0=?!ijN-9qNVyI8B|m5%pElN*J;wsS`LTLiCjFLxt#AQ-G30`6!xmf+b!7`{phB zMvYC%K2S;(cyoXJ(e6M3n!4oAllpupvZOQMzbYhAUy&5_#mUv8cnF7}rm*dOCgS@D zhRN;fewpx9{*YLd^~t2@QBHQ_0U<4*Y9(-y^tHUk z>(7fF)2p7*n-Ny?fO;B4)xU^J6dFtydTUWu`Bi@lfA>FGfRs8hqn0ftg*%m)oD2p6 z;Q6GKO$ktf_(^KQ5T~E5^g4w{S$`Tl&G^)OJ&Lk*WO!L52QFE4=()Z>>6#{}8(cxQ zU-XkapxS-SU4)w&NviN{&~>%wXdf7#m=4TZ<$}z_Me?1?rTfX<**npAN7d@RI{l~? zww}}7xm&a7v6x(v^$HLm)}gZgIlezQgkoNm0OguyU69XvC>O9n^(g$65h$XU@|~v) zLc>0-%DnAJ|E>g)m}yZ6E7vQ?){sT9qTuW`jpD4IkpwD!_=#(PZJ?{_;xOxfcoC)B z{2MK*tlG>0!^F<~E_qm|&^1>NLUV|-tvL}|&@)?F8b7DX(m6+&fkeVbE)pw78R`9Q zCYw@`ltRjuh=>x+TMomDyGuyOi(+~sd2bBYAkRW`G1=p}>rP)!5Hb5Cu9tdKJ^{9# zMrcbk`l2nWZTk|%zey2%jZ{eUhYCs$g`i87y$aEoY2HrXT^aIrASHp%&ZE~}|01!I z*^%C-p6h7)GNy}K(fwX#H0!s~^DrLf@MX&afhk>#hc zf3#~Qzo_n+p$YKfhN-k~SqA;>26g4!K|pPEGa&4Ry*(j&~m3a3@m`pz}5lN6Gt9E%&qJ{%Wj2L4B(^qKziZ(n7@$EoxO^L6x8 z&Oe_iKg2C;k<8R2NWBj!L``Rsn{hXQgI>FGzA zRaGuES@SHE`CIS%s_JFmr=|I!r^%h~Pkqkk22%hJe=L}z1#my=V}UaMb#kSymWo@N z58Y+|%Itl{{osA*Narv;JVplCx2EwN`v0eW|KHH10`T%*6R`f@KhRIa|Mmn^W7Yru zEXx+){0(kAR&$@-p3j;JUeZ2Xo{dV4J60kR{Y^`H6X){5clQ8A$~FHm^bw$Oq4h_|JqN62Ep-@;%=4<{U2Ae3IV^%rb1> zpvC7&eWH%=eW2t1Q#-Qj!39TTjq1`6$cU3Qm%rye%TI9+OWlPu`e`Y6hpWTHP( zbXP2r?i!{UDM%z+GaxpD@;(F>i0rOpKbYTHEa#i8huS$v0%d9^5or94CJ0>)5y7hq zuD`^@Xku#uN5m?-xz&}Lv^XhloT||+$8Or1wB$y8Af{1kng1PLj~1RD$mV7VhGyPG z_J5SY2%-#At>1^&VG3*m4QO9Q$B+Dte{O9rWmEbALK5;+1S_EWD*5U8;BA1s?7!l; z@*eHkxAE$>$e%K$mq~iS=E*pR*@~y5;yNQ17B!M)wj=S zLa$I^uB_C!+=H$KH*Y}Yl(SYw%nsE~EiIfWF#&uomLC(439MLJaJX5Kp)eu=jF1q@ z79p$?SX2e5E4C?6EqTm*4`HwqZHyLPP4o1VNmMN(B-A)XHN`{_>u=N?cLgxi>VI&j zgxAGD{~}ZIdFb$ZL7vA&@s?WikeTskjm7qi!7)^Hqe8ez%i68jX=vYC4x#a>a`H-C#D|nUd%hk#2Apbh@^}_~*|j3YPy@geyGtbP-Ji zlg#D=zAazIt)CBjA*Jjk#sl%c#OeV+Bzn}c7#}C9=LDLZ6KYj~om0*Wcw1~rPp0;J zG#!%C#2(cwtmysAA>9(ShCc`!czQG;l2e#og6*um7~#T87)_CQ=3TFNcF;p4h3=D? zpmN0ag{2?)(coBr%~rC%ipr1qVe>)lLk@M^acv%hv^#o(+=*-r+gR>3{3U`wQST5q zOLc$KbQ?bdQYR-XkhprUKGN)_FMnVrzD{bVI#eC`cZExd9sUy-msPzj=7)1AaxOUM zKM7o*k#w(l4N}D}-AS1IPzh0$K9hWPH%LIuiIG3NSC*%c5FLsXN;JlmUEwN}i-*vq z?C>|~V?KY;#L0FrxM>#?`;TV#;6nV`;jqN++2IFN-V))m+^XrZ-{h~h-|fcGPUh@f{X*S|>j~vi$=dQgh;R<4{lJ_rhIto(Ve|AisulL2 zv?Et?grMJWjWk;FDCxe$ziVDHHvr8`c>MsKKA!;63ODS}UCN%f>FeI7OqHWPwA+8R z{w^A%F4ah3nAm@(t`>!}_JJq!6J)0Q1p#7vn8Lyl(NFL(9iK*&$4N~K5aZ5+S&hp50fbK_^qY91{f zd2cHQJE2R<&hzq^8+k8z)x&wlX04k;(>su(?e2n>L<_<>NtwUu;_q$@Kvu{KMy7BO zNa^1y?MvFSz4+*{#t}oi>X?EhWlUTYVRkyq&(}eHYIb<`RC2g3Pi{jk3I-=}#@PSg5jISWc}?M`<@4 z)bs{Y`R?(?CM+20MY=#lLJIj*?x=_;(G6&X0KHE|5T`SPrun1#=EBmMnxpYLcj~L0 z$oJ7{{&sW^$B*1-=f99t1S$L4cNQhBy59?2Yradz|K;|*crE1Lrsqx+p?mRd^|{YA z#e`{TqvT1@lpRlfJIBspK4Ph@Jm5n?!Lx!H&YK1)j3lX$*&{(nsovI$h%o%??wJDu z+8=idasw|;s+e$=wFa_ypgObg0D{UMq#6_bpU>#sP?HHi5oZOIx$@4Mi7Q4>s`sC> zdjM_ff6?8!sn@$+zo;bv^Hi3)AREWM-Q2TMi{G_<8rcx!0jlw$UC@1hpb_dzUH?3sYAyEK33Jh; z;sRhrvhERPDjoj`E6UrWhej^G8|wsT=u)&kZFW~83|C6Lvs8~bWJv$NCG!>pnmCWY*N*43SlIq)87iECxz9k1?EOP%;*kMnRUm#O9NOu{t?8l0Xk77L9Pti`SME&4G2>>a}LbNq8v8tk-O z0Jzj|fsy&{QpZkYpm2UEC^DC?(#J}oVMV%v?=y`K6`C$Cy6M4z%$g|$Wf zavfPewd>ff(-64VfqI7tW%p;OCb0@euMQq?(hil7!dYsI$TBA?*q#cP$YV@01+NLgS20-S5obR6G?5ob%;8vkX^=1J530`<$Q`;_~6e+TPrTP&7 zsvLNJh)W@m8+6-}Q>=$rzB7_L_QX}YMNtSN_P8;lI@S6 z#UKIuHUh*QTRuBKXP1VNh0kxk`pT3WHb4K8o09Qe;3DU*tzj&cJLKFNma`U79jwo} z0O0pIUO`7)m(Jr;N^|3HU9`2|g5!+Zog!IRgIa>ZznbC082nXMkGigYcA=jfU0&B- z`{0VqIE|MiUTTRUO&lz?+Z+8Y36$0Xbt%4RcpD;j34cf3O)KcH7LU1XS1$o%(N)*3Hx=qU_ zk`Ty9iz(b?GS^)b;v})?uFd+ZQ0cS+L3FSa*hSjR8JsdYk6NGkyCeUbk_d)3<}&Zh{4^3I+VU#C&MF!lGv!GdlF5t` zI_m`m>}ZE^hL1fcKpe0vT?i=JYY3$l>$?^HVgIHb1b=?IL5581hO&AU*asGwhl#>dtDbpk zyMtxcM%+P07kd2~i}1eew@(xJ35u0O0VyQ!y*u$*lKq+Z1b%kNYY(@($B&lk<)%Uv zAK9Aksq%YZr_Gcap8p0^{;@Vc(^e@PS_p9*C5f=1WsYJGBNu!#)FlGBdU2Lc6@1aJ zxeup|)57?2QhZaa^S-qwoN=NZ{KQ-YX#`>hzQeR{`wW&6xr={6ju8FC#VpIXF@FNJ zb~b4P^S!wT1>+c4I2=%BvKEt9HP16KpAEQp4=m({S*l#^Lt)6!DZK;-E)WO>ju3U+ z)XW=xQ-Ia@oISCwH}Dms9%ktQKnJ}%zZWKx3bubx#b_OF%qRq)M}1-qz+`fUTb+as z_T%N@%O}wZq50-YUhrTX9@~M3v&X8$@&T{W7Q~t`C9`MAW9*S=3ewFE(*81<>7d&F z$%@z719&puN%bQ8ScN&&L`bleik{m|!#-1Nc*QS|b9cU|b1SXaz4HzIf7e89wbE7={I2?z^01vF)CL~2jy*tQ2wi8X^US9Tos z(j{|?UxoQ&gdBSsv1BriuZoFXk+Cym8Aj~hr~{J6_LiR0>|-1j z_{rh~yPkcT%SjtyJq<6Xt8l;}NrkVxf)nl_Hb#C_6e4|CyQGC`(&+|2*Wfgv_jOpF>GA zjVrkEZAbRC6&azr5?bI zz4Gyu$y0f>l-b^gZDgRp)RnI^0b`frT(pj6CI3fdZ{>`pe(A!B)>W!(o%x4P1&AOy z?)~3a8g6E5={l1V_N{tIc8Gw`4kpJ*_yUbgQomTf51j9R%MOptDnH?M=1I4uF-Rv`0t zG&AH!dU!#(|!QMUGbHMlRIKpDEc=KW2d`{c6xTLT!Kt!)r~$<@4fW$u<>}L;FM? zaCXSJB9sbt`Y_Jos378|cqQnb!ddOg+P-PT$*7gswv=X+CQpO1Oi7_O&V)h>kuPnM z5}kY7Oy&{3e|tl!!Ae}VSeX&6XJk@_hW^%(eimPweK`CLgcZ9r2{2)S7ZGjlZ^sWQ z3>>j+hE)o_tBER?^9e_k;?YN=Pf5;aU%u`^5YZ85;6N7{1TE|zVvMPr?IB)pg7&)FPJYQLl3_bh}G zVVpLvhz$Krdh{Q44s~_X@gBF ze)dx6s3uxv7y~nX#cqRSWPO?9?PX{6JpeO-=~$nPr{ffB77p)X6llZ=>4DB_QH9D_ zXOE;zDI4Wk&_}bz2RaSRU~Gty`8oG8K_e^^+R&EZ`Ci}1fA?hGOHZ7$Jw_ARFj;V z_pY%~Ex&_{N?Uboe4Y-hQ#JGQ@=lx~s0C`r!ABg1mOKqN<;u`~hrERK1D zY#q!hiYCNfy)WSAEK*z8Ed-*lgV3646rhWQqDWAdep_{s+;r>;*1>76VY2U|S{jFK z$7X)IKXQ>BTb47x1tV|9mnH_4r3p^pd+rILi zXr%aoLJRln@R>sWuahc<2JBk;iLPP4=_n{6D+i6KXe=MkZ2_4v2760akJmi>NO+~F z&jI3%qcrsKuTW_OF9fJ0qW`j|3uR=TA9ADjTy<-BiUzUpIfxmRM6EZ zH$}YioOXC9PNBK6FvYh{r#cGA5pAEB0x>(Qf7k*PykA2h7%=TyTmf<4#@~=V+JzO& zUt%GLjW(Rz@rUS@c^xdMqBbc-w-l`@+Mub9s?G%Ga-n=gY3@;B9taGZ40s)Vz10Id zAAEbng4j!N%i^z;Y0M0^ zE|hBH);_w+L6hI$YXBm$V>$|55bwZM20%P+b%eO#KQPF47}Pq9p>Zw8gJAUY zHQ1c$R2g)cI^@*X%$J+7>8v<~SnW6gyHI;y-Dn_5MtACSnUHIWi$kZ!)_jO|3yE-v z=Ia*kRSkmjVyCk>HLs|0Tj(?!GwUn^L&^A(=x_7CXWmmjt^tSxM{gD2o{3%_UXov2 zT&|0F%;|baQn!8ic}MxFVB;JSQoDQ2h@gyaA!^!jS?iZS_b}r_p|$T$-xd?j3-XWx z?-{C10VT>mrI!Cp=x=iSfA1-()xCWD>fCVYf=z1G={)#zZHO4-9}=Y|4?Zn&ywE%5 zKU|B!y2Qmq%xqU(hg;cM$cfa#9%ak9CN+LO6tX6@?sO0(LK>C~0qsXhqp0)Kw6=uJ zh9ZXS9~$({!zC>1qi-jR4Fd@}Y-d2>SMC$+J$>e+H~`mySrjwxuDgPL;g$^jNNk-= z34gerYK!N819q_JWd6q734`ipD^UY!UTtqaQlSA}q_H#9J*hU!OsnE2KBZ;>B%g+^ z>_8RzXo|l#Bqoec*wc%Yi-I(#rX$83efk!CYOo88wOqsf_io~?X`+XBYBY}{#T=WU znH_sHSidyQ0_S}x^+A?mb_omCYRax9-gBFYhr&I}sHhIY!A(?X{`FxUV8`YqRXLdA zQ^E-N)mfb|O{LzP^+!1YzEZ}W4vqy8akgnO6^bOF7c{ik4e^{T{OhS|?z$3rS{_o& zmKz>-Z^h!C9awAo9E=d~59tg2EfV9jhKD zER}NIPu(_qeG-Em3Wb9~!Q-o75J)A`KBLJASo7WKLYd!8_nqDV61vUg>%568&vq-4!CM(_GchCFlq1DS%bsZbeHMAbgtK$Q zWHUzowMarn5Z=*nS!ruTBfy)bul|>94--j9d$B zR5xa~l-x+qa~n7cCNTDD0>+_Ih$hn;Rn$LYF%vL9VJ>Lvq!_m2`Av*igmMM`z0du( z^7FroR@cwhSUSobi}AzSFAGDUJD=*3qP1B~Rz_u^I<=BwVg9_(t#Wh01)#G16T+48W0>I^FBHgxgoufwY`89DwwiA zP~3v4c&32o6{HI;s2PS%aWw;d`t`KrP;^0S5fe=fnqWnKC?!WB93H~Y2Zm39ljep}kT7h7Hycdsh zwAkp1=bAo@X}fyCege`B8Ed~b?{B!Ges$69;GC6K4$$D)^xext^PtAA`*C(iJem_v zD_bU2Uq*G&MjzF9Ka-KUaqY0ExhFlxxoOHh72ocijnhbJc+lsLWW8ShjUNL!~;W)SywT||LEHHC8~?8kplW<je%!Ye{ zrp~gv&8+;c?7w~D6A^6RxBpRKj+6)L7W)Gl;fo~-Vl12(t3Y~k&n7Vv3+wc-a&?>> zmlXLH3r#-zXarPCpnlJsUfR$IqUz!AllLg^<+8KdLC&E7TDNuFS{>{U>L(XglYccl zP+_Ng7jK@3l*`%ytVR3B#>TXXNWL4;NTnm9E2@KnHgrpfnb?;&sGr-!Js5lkrwe&s zq%Rs!*jQ(FqlSCf%~gu1$^5BP&%$~8in?4|KFqX&Us&?{-^vrXWj435h3a|B$q*&TzV)zg ztYelA7LneU@UXfQcA6~xie|+AX{+y~(fw>ytjQ=DXP+LzGee`i-Vm{`C>}DRp?Nx? zaP=8$cxFS4t$#Z$Lt#kdj1PLkvnkn)KW&B81vJXa+<_OGa^Lja5CZbV8bK?3k-AkO z;EcVk11EpY5YBN&E} z$K4*2i*6!C(jkyvdWppU1HxvG6 zNZn@6CuZml6W_4q8S?tTb1*~Z&);XC(K>R<+jgx%z(%k+j|@HNB+sLx1I22ViO&~9 zI-Uzwx!R9mY&IN5%@yTx+EJhszLU(?;3B5@xPS{7aRa2;ODo~^`epC;Mdi&S9_}Fb z*jBTDj`1-q`biwRV)(l8Z6;C$_6nlMAph^kjSo7Q%$_znSs8G}iQeiQ&+T=r%U0VS zK;|;J-pJce3f1!y94!VZ47Mu7hH&HA_Z}4Qo)R7iNxCixVV`~+u5569Q75}iEB-kI za2ca38drZ40G_@SadYTw@Ig!X;188UhV{o5iXa7@>*3{gCF=zGXu+P zWh4(lAp^7R0pEVKO+`X!03jE1Z5}^sAajEuJEEex3GGMXlTk5KPOhS{`vMS{7uUbJ=oT-0zBcA z*v49^N={mH`7#XvUjTl@{`8F9_0zYdTfAroyh0h3u0!viA|R4^v*iB^n38j#S(4d8 z6@AS&RTq4;6ZCyCe%sdZLYGs%Uh=}**|4XpAh`9LkM`xq2CcR=i?1PBbD;swDPO9g z7W%+|eoDVA6_~Xok&WeEo#T^`r+0hQB`kH<=lV&l0ZwfowvO5A5!ZW6>tr4u+0)NA zCL+Sh@Y}C}TmvrGdShP_3PK8lI1Yk)TSKI529{5;pKPzEO3w{bsprs*+* z18gYZRM7980UETGu}*0Wx$qZ{&in(=Vg+J5nE|0Llde%TV%)>rpg$Ij!&E&tDp`O) zMlYNIsZy~O$acFG!%0&JMwH(f!%0uQt4>)uujT@u+UX}&hz?Bv%mcI>fS zAeFY7sZPCQ9Ov!6+ed}=n5aX(F7W|!gSR@`H>vd!UghJaYc)Y-#Y*$wuDON!T=(O^ zy{y4g*2)1h{3{A+Xs8RcBhPSeI<^q$0+N`4Nyv6#D(!FhB4Gx-AeEuYltqh11Gq~2;Hri0G3NY;&ddu3on@SM@UYD;u`iiD7bDIj3PV~$R`}mAEwulv9ct2F&8l_tPES@~$8oA* zSJx{O(gw70s~oubQdSbFyS~WQ!wr`;POOl>h1s$HK)}p6a}@C1ik0Yl;JyX9o%Lb^ z!@5V^b)fX2|27R!G5Lyp$^(YdEbN$AqrnKgC?n8-dog)f0RLH?WPuC4I-xJJ<*S`} z(Z+KL>BhV0^~ip0QZHE$+f&`wmUo-cUN53)-~&hA{?aXV1dy z;P4UwDirH_2+;VY=Sh5$Fir{{JpDs|*-7eC$kjWdMdF&PI_ZK8)$`Lx02A3fEyDE2 zj{e#X@qq{kU?<`;#L(9B6*?4SgGMmU6+CdQw*fC@@WN=50Z>`!S-#D@%SAb-3#I3k zC}2`^^Bro&l`n)<1B$-+O#{ukZEp8lT2(dNHkSCkpVDg;Pc_$5;TJpCSNz8cZvfY- z{epukOl_XA3O75du?iT_w_m4;CVF0zLV-KZBDKomf1FnX jum9`8ebO&|CA|l4uEW`XD+K(t2!^VnmO`zZW%z#pL^-c` literal 0 HcmV?d00001 diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 69b7933f18..7e6bf874fa 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -67,8 +67,6 @@ In light of these restrictions, you can use the following methods to manage per- You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). See [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings) for more information. -device-security/security-policy-settings/administer-security-policy-settings - For example: ``` @@ -113,8 +111,8 @@ If a per-user service can't be disabled using a the security template, you can d ### Managing Template Services with reg.exe -If you cannot use GPP to manage the per-user services you can edit the registry with reg.exe. -To disable the Template Services change the Startup Type for each service to 4 (disabled). +If you cannot use Group Policy Preferences to manage the per-user services, you can edit the registry with reg.exe. +To disable the Template Services, change the Startup Type for each service to 4 (disabled). For example: ```code @@ -173,4 +171,10 @@ For example, you might see the following per-user services listed in the Service - ContactData_443f50 - Sync Host_443f50 - User Data Access_443f50 -- User Data Storage_443f50 \ No newline at end of file +- User Data Storage_443f50 + +## View per-user services from the command line + +You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. + +![Use sc.exe to view service type](media/cmd-type.png) From ed9db75ed43549f012bdd0c10af2167e2156e03b Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 13 Mar 2018 13:05:23 -0700 Subject: [PATCH 116/119] fixing links --- ...el-windows-diagnostic-events-and-fields.md | 38 +++++++++---------- .../configuration/windows-diagnostic-data.md | 6 +-- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md index 963fb2a1f9..dad1cbe857 100644 --- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md +++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md @@ -30,9 +30,9 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) +- [Windows 10, version 1703 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703) +- [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) @@ -2379,7 +2379,7 @@ The following fields are available: - **enumerator** The bus that enumerated the device - **HWID** A JSON array that provides the value and order of the HWID tree for the device. - **Inf** The INF file name. -- **installState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **installState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version of the inventory file generating the events. - **lowerClassFilters** Lower filter class drivers IDs installed for the device. - **lowerFilters** Lower filter drivers IDs installed for the device @@ -2531,21 +2531,21 @@ There are no fields in this event. This event provides data on the installed Office-related Internet Explorer features. -- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). +- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync diff --git a/windows/configuration/windows-diagnostic-data.md b/windows/configuration/windows-diagnostic-data.md index e3c5fb9fa4..20b60ae7b9 100644 --- a/windows/configuration/windows-diagnostic-data.md +++ b/windows/configuration/windows-diagnostic-data.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.localizationpriority: high author: brianlic-msft ms.author: brianlic -ms.date: 01/30/2018 +ms.date: 03/13/2018 --- # Windows 10, version 1709 diagnostic data for the Full level @@ -16,7 +16,7 @@ ms.date: 01/30/2018 Applies to: - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. @@ -129,7 +129,7 @@ This type of data includes details about the health of the device, operating sys **For Diagnostics:**
    [Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example: -- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/en-us/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. +- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. - Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance. From f5532c9aedb6faf92aa2ffe465d1ea0422ab27a2 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 13 Mar 2018 22:12:10 +0000 Subject: [PATCH 117/119] Merged PR 6340: DeviceStatus CSP - added new node for RS4 --- .../client-management/mdm/devicestatus-csp.md | 11 +++++++- .../client-management/mdm/devicestatus-ddf.md | 25 ++++++++++++++++-- .../images/provisioning-csp-devicestatus.png | Bin 53563 -> 56103 bytes ...ew-in-windows-mdm-enrollment-management.md | 7 +++++ 4 files changed, 40 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index df99bcf53d..25e45dfb80 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/01/2017 +ms.date: 03/12/2018 --- # DeviceStatus CSP @@ -132,6 +132,15 @@ Added in Windows, version 1607. String that specifies the OS edition. Supported operation is Get. +    **DeviceStatus/OS/Mode** +Added in Windows, version 1803. Read only node that specifies the device mode. + +Valid values: +- 0 - the device is in standard configuration +- 1 - the device is in S mode configuration + +Supported operation is Get. + **DeviceStatus/Antivirus** Added in Windows, version 1607. Node for the antivirus query. diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 08187de0a3..7e4a7a5933 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/12/2018 --- # DeviceStatus DDF @@ -17,7 +17,7 @@ This topic shows the OMA DM device description framework (DDF) for the **DeviceS Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, version 1803. ``` syntax @@ -469,6 +469,27 @@ The XML below is for Windows 10, version 1709.     + + Mode + + + + + Not available + + + + + + + + + + + text/plain + + + Antivirus diff --git a/windows/client-management/mdm/images/provisioning-csp-devicestatus.png b/windows/client-management/mdm/images/provisioning-csp-devicestatus.png index 76c746d95f8a51464e9c6afba650054f0fc19cf7..520d58a825c4bf18f01d1841fabb280260a47466 100644 GIT binary patch literal 56103 zcmd?R2UL^Y)-D>mh=L!8sI*T-A}XS^NFt!1VnhN0igausARslg5E~*YAVj($(nY#- z2p}rG_YTq_p@+~ylCuJ~{ok|4*=OH>|6|;7$M`-SiErL_y=%=m*E8pQp5>*EQr@-W zzzzrmvI}|nf(8V#X%_^tb3LtM`)=9Gl0B#DiqfygaG3^x-`+#ZOUJP<`NKn| zLa@$@xmDWGRTw)2@_?fUSyfeKx^3mqwvnB&-Av;GtkKVzY`uY+n7Df7njj#<=RHu3qme!Yg3v&`Doh=vX8_x-NYVop_DelYarUCI3G zl)8n5WzoT&?Q&Yaud`y4P#-66$=M$YYoy6yO$9z zDMGj^Ia<4yUO^4vtkK&Bf$-BBhnkn_)K*W~p0#qFzaIBq*8b?twy-Zf#zur4FO|jl z#mS%N0zI3e-G?o*(3Mls?W)dD?@ET|#H7?je~n=NyHyW!j~PYlpaYR{&TP_Hsg~9G zcJ%XO_b9Dkk;@9DB;pD=Xxd-IonJZN}C7{N?kNkbMGj z5nn!BykrZ#=rVQ?A)1#OE@6V83cQ#Umg}vh8L3dXDpPUca&y$j=WC%GAgRbgDVy9m zUuc#x7@ew=4)OHpW3Bf$O`k@N;-1*J$;aQ~OnN)pTBKuiFb$W8QwwWFu9|~@Ak!3N zVydvb*dz{qD5}h>w43`FJIVAlY4G~RvA*^&51Un zc)Shgyb9D`>yOi{;2svEi~k1qo$E* z6MVdf@%7cKS0k(#;WOS>CMN}-0nU5abI3DnC_$@7qNm6cNty6V3ECi>#B&Gi&wT#c6^KgM9?m-TNjIjnG_+dLVo<1p;})2Dies_afH$gk7{sWHaz6zjmP z;_fTss+4317(H(jva+)?^kWRCJP|Ghf1_Nq+IP5bb$Ga^%r9iNewkDd-c ziGR%>9AXs)_KMZRXCUXY#-hDt#ci?=|+6UUd^5lGkKvHB zI)P;<@Bo*hYQ#3kxvsJ3U9Vqr!s)91r}2N8^G=_*w&brb6jpeHzFoX-kfx_R5j&UN+0Y?xat#(=72oP;z`H#9%#j9P?mNDT(PW8 zfL;nm%uSZhp84v95Q^$5N!TTR!Q6M@YE9^u`kKFXh%&!~WX9KXx6IAjeu-^v-Vy6a zt+{%~VatZQ3e9&jU7$w@nU#+2Zu4Qo{r<}bf#F$}Ohg;unOY7SHz;j1te~u*>6!l8 znYdPD15v$-o==te)E003F-?UFcJERUE;;7=Shg#GDsx?k zEOq^E8S(NC!=vNh>eV)F>hjN0GQ_8KZB3vZ(S z;jTAzbxFqsUh(@%@(b)8dGZ!^!_H}ts*2fi9AV%3tg*~|k94s^vhl6e*hGQtqp#X7 zx#TX|8)y}qYtsFm?YNO{n2ja4m%H*{wJkIi`rlGNpsy4djo>$db+B(NeaDcu5=rP^ zwAloaP=;DgEKGI*;K3t%OtMGjPXliDPg6N8&R`T>;HbX3_}T^C?0UCX3<8l*gl68g zv`jkNS=W+1#ZN8#fL1P09_iT#`TMZFM#9IIkMMnVH{!c46&xmEbPNonr@4VyN8mI7 zzT(T5vK<)Es}oqR0=TMU_1g3k7x8Aqmk?pdBk*JMZ0kP3eWdB*0=K^tP2E%~3fWp99>8jzf3W@h6n)t-k3pKf|e z-{hQ5YafGQoptDK-F1G&?o>JLK4*6|E{HLAJ(5e{fQ~vonqe`u3G(QSz5fMP&`Wxc z6OIJo@ctIO@LwSEojX1z?8Sr@fx!6a2Dk$&WM(`;`M&@t^*zu3 z<`&m(;4|{_bOoibPP;s8hC7c?wr&E^)&GKygGQ!qfx0~3GLCUIdDLT2&HFWHC~O}q zx`F`&M@QfwpD(ctc_)gl@!dk{d}bP~nuMS#`$nFtw-ZY*!0f7mp}*jp zt?YVlsz2dOu-njvozJ zs(B8t$iHf0@VCV+HB!~22SZTC{joP$>ZCT`0~=}Vt^6PFJNEhe=trERU{QodJYH5} zb(}_@R_4gyRLFZUf2}XCc{t`=($2&eY+`-rrj-2!ry_8Nj`(HhOlOI5T9ZZtBU5g6 z88^;#_H-(_+%EiF%6%~+<&cw*f9mIuJ4Z@!)D|>TSivE4QIXtYkWoE>B02v(J-xV7h_@VKZAU z5xAy=tp|If8e05|p2>Kwo7FXRxLTv=cLRk_jO(EX#J5-5N*7n~6+I)yk1D37VhJ2R z(I^e>A{_%ss)wIcnqgYZu!zgNtu^Oh(dQYsc_Jow5>JA4J-8{hjA#Pz4Pp$8nN*9q zopRH5Tw(|sUEt=nEl47bu1*C8=|fRMZUF!CM6~9x_(7LZUJ8&5meDO;cU&z`yKK(2xLdQ zP@!S@&fn?SSN!${b%kMMPOAl}UR3CfRx^i6I%g|w@#5aSw`)1(XMMk~1*o^TShow< zDsDn8wlt6=XPSjdht(s!)G9vV06;=^ripOohGNgAVFqkVh?yW&N5<|%jJGD~fp?X( z&B1&a-_M!tSNV21-ml)<=fK@D;p$A@tW zFZnHmZrdN~maT6}J!>`*eR<~r3tb(k#M(0zDZ3FN%S6l+)x+b#$?}coHh?&NuN}Eb ziLSFM3ByR35&3oYy+)gq==(}Oz76$o&`Z(j^Wl-|-|W@#KASVWV0aV7rT>Ao(UK^J zVLKfWe;F!mRnxa?dS?jpZDFZ&O{qmn<4{Dj_Ut9BcjmB}qNJG?_2Yu{k73#y&!k&3 z<{E1UVOqyBWtj^_$_z@EC9~Ah;NbbI7fQ)bbx+P;tyz&ahCOrW;@rdZLgM%6mg!EJ zs>+=|q=vjH=D0}o$V|CxU3P4rMS4Si1!qa&70Ps%Qf-|NHbp}Aw!1nDnj<3#i|%tZ zMuxTKS(8k0zdM#BGh3ps{1BeXMwsxLzra3IN7`OMWq4Qhwn8pYM_+Q`R8Tq8wsM>rb9%b3?Z zBi>KK9qQ^%#eIorszrStMiGm}+rfaQqiJzQ%zPZBk6p*->_ZqP3J^n|(qAE#!`OC|< zwV#~ahtY<47IYJ$iK$jJsBS3QKfCrhen{@_N$X{r&UAQtPuB-r_3_rJPJ|FseHC_4 zDk(#Y{c90=6KkKm_8f0dTbShL?PJ-DBk@2z&w#2N`PXKPR;J`7 zF%kU$D+FumU;(Lfo7Wx~4U)=^H1=(Wl=Vf>lx%BeN6DP5`+nHk#`|ef_})Zg`Kuyp zTK1+>0{A{Wy#xxg4o2^Re2>5hR}yhIw6#?Z^M+$hEr#l=fbS0XjOGk%g?O``HZ2^Z zoAgm@AW=hbv`?)_%Fzr!u%C{9h!-E7n4J9a>tsIN6ANIs-{I3ucnU!H2yJ-`#-x+z z0eN%^00w3Jke9TvDyD3K?%v*Amtu=75H%ke z9TgRZwC~0XH;CA46cb$>QJAt?Lp>>wcuK4xC^G<}{^n+3nzwraq>%tPqXGFJ`7(DZ zIv^mx!^5K@e)e&MJH@lTUKM1mDRpj6i&F-a=NooEWudGqRR*k(R^#SIANZb|U01-M za4Wb?l^b1Rd{JoH#memsofn~TDp1d3_srRLd#wNH8nh=LopQF3xe||c8JP(ze;hJi zyF8vY{XsWRUedBx5poeku?x_c;YeIyU|?-PA8oe5`jXGLtBZ9-1a~uF79fRp7T>Uk zcWp9mjNrABZiw$JtTT&Vtt~2~Ee55ag0s2L*{sjdy)GokbBF!hYlVj~?&t+xLO1bN zuNGv>#kHpdSVDW2?vB7r8M3zZ_iSNU+5*Ag1VN7#P>(-46v;xFji7SWeCxV^e#=1_ z+xnUY5SQe0?A}9j3JL|gGfniS@eb7b)n*y2mrlAofPE3F!#3^>i%sKXq2TPj=l=RJ zkai>iv(PbJ%aE|mscD;oOuqvWqEXdWR%PNvPc**GJ91xZI);)1u_E!ch%slYs@yg=O|h(=FWj zr%WkU%>I%RR%9PjWC3ms-TjV@pN&OFnbk>U9}hX`1*l7*t92r6nNL@oMQA$3-%eI{ zOpNzPBM=rKz<7Wi5Uc^UF3z+CJuzB9_+YJzuzR>f!P5E;E1a1h1%WiYR6%=)aO7iv z`q-R~Wklip-V@DrpXA>SiD$zCx_;HPo^E{q5O`(thA`BX;bpW*Gx|ira<4V>m~CQB zLpy=UVWr3ZRP#av?&?DN6EB0{eCOpM-(>y#yC8t?;aFSaR%rG#b711#ichA3tC|l$ zpUVem&DZFTlhtnwxpu{lt^cs!jZ2+{?@9Mnp$?UwjhX4ng@UrJBc>DS7Zxm2UdASp z??+gerxDtG41$ZC2b=3gM@Fji+1JK57R?cwqrY6n-F3LEbM-YQ@Ny4FK>a3i_7S$_ z-PxgqjcGA4M<`PpkMgsYBmU{$y?cA*7hQ&KhJ`gyH7%ml**dhl=by>DMz>|if14cj zD~Ru|mGsQs32=}e`}-GQ3cw>kseDohP8e0OzKU7Gbf4>Avkkm73{Ck=WA2q5kjUlZ z$&V?1wJKrto|S@(Mb~O5xB7X_v6m5E@}ooCYAP5?M%@F#6w=bV!0e?>pB*CcfGP_b+QW!YS?WlZl}z8FGD=mfS`j{OG}I2 zY%#jFsKP6TSPja|Gq;z!C%Vf<#5SwjuUU_Ft^>LCvpUvjy#4qzV+iD7a;#EMTFChK zvvy9eTr}MsS6zz`v?})Dbe!hk@#DtyZf7Lq&q%=^os_t#VSNQu z>(lGx6K;SlV&mUiS(j~YW2G?erO9q9%63AKIWN}OpIF#)J-WS?Ykog~-~4_bYes}~ zE+dlpEF!K1jgb90z^jJOQHpl!w~E3A6L;dD zjr@F%)6VQ-@bq8vkI!eyrWp$;l7@)v&3@3AlRabTm} zOBqv>K5fem-I8yKT0AKoUD#@&QmIjk)5$X?Ld_Y$Ilub_VAEcZV=Z51I&GMyM2N;*zp zq~SxB#wciU+n$=M`q1ULS6cKj<2k0R-UI0PETcb6==wiA4<%0+G9Exw&^9+NsTKv! zD|zAX;@u+u%M0V`k-e7Wubqz2@vifn)!mMI>ho9E#ZJlIwt1M z&cXY&0jRpVx-g+L?>DUb$0w376-!Py+`(!*?o&>WL$^&#BrZSRbYKnW06+NWQz8xb zs;H_*-uL-e9B+T^dSZ4VD6!2X%5x&lQ?R9}sLmz1`VY5=-U;mnCFV@X4naJjvvnxq zKGZ|oDOJ9!%XF%e{}1P^d>9#F2fWc~3)WxorF;)bI9>SGQ^h}hTY~?%)%^abS=+IO zPGR|GA}(uDAUFtf#p{><)2uxeG!*V&7Z)6Ou1;2~`M519_!_?8Z;w`$vkH|`om1ko z*GOOBI{nKeez;4OIb#LQJZSrXTiV{g>G${n0=`6ljekdU7;aL?lKd)ka&@6PAGl#g z+Q4(NRR`yZsNHI6<8Z&`oGQ8>jTR zFh+Z!LRk9ONDkoN_FotbdK{<`6AfRtJXZka^ zZdBj-GX_KUZ2B3hAtmchBMoOeclxLO{X3UdrLx**`I~bxva(FvJO9`_{);cv)P(#` z_(F6is4%9>8~U86Zrk%+<-W|XB?|qF>SXn2TuuS3%9yKpv6C4CN}L{n-4kq6SulI9 z3+sV8v>x>_23gnqKrBEe1t*xeIGr9;k4)P2%c4YpfeVrL8!dL-PKS?=Y@jL@iync; zQ-53MSoA|s>hCApFvgTEf=Ex&&#Q)W<-1SDRMCsS%+x+piYp8)!WFZ}dlWB3iHDkC zn?u(M3k?DJ_P@hmkt;24Wxpo#dU12@>QK2Sb8u2)=yNOnPMlYvWnQs38;;#&nN^b& z?Nt&D=h8JY>P)cwxX?)DF;|(7V$4OOcJ#?4luVdfVu>m*Tir`1d<#1G|Jcg3iwa}i zOFxAcF?z5s_`C8R66@JSK0J%Q#MajuMfn2Xa$Qd_u@!ABZ|_oyu;k8o+jrdMUO_4q zwIk3ooU1c?rs=8aktwzN={>(4p;OIwoNNV!S{p3S`%YHRc(QNnV`5mt=0@R+L4u1Y znO{oK5l6^5bH3JTc`Z)Z|tBO2S+Y`bFsAL-rMCe{U9~_2Go*h z%Z@9)q}WHI0+ctl;}5Wz#Eoy36tp_*@Hc_bxwm_Az@``3+C(=?$3^y$!sB(Ws|*es zZ-F+=T)!*%D{^#>p#9}v^s)+y#C=UBhwkd_OY0-4E-_4L*Ejz*4NDj3xFmnYs3fro zIO`x0&b?F8qI^pr!HIl7H1)eC`~)t)!9S`!7RNgH4EppO1kJt>b(H%XK< z^%HAHYZ4=ix>vqDr7sp8EH=*+U2JQ;rltiuKp0aP64z>)LyImaTuv|k_B+(DfGElI zDqVYvCW3-HEX455R`J`US3P$BGW?K>r$#U=!^KbXwcvYC^@)8T1*Oz0Xb*MvJ68*O)?KadYy3kmb`b131s_z7Hb>stE z$(5y7yRg?7&kz;55m_~@MJoNs)nmG@rm)}mWHPR7-XR-@%Le&VnWM?lSC6ODOnF=5 zS7Ad+cPx~fems%V7~x1QyE>@yESxKR#pG~U=Lg*UWGCEYAZvH0rFFIcH*25JXDIX4 z$kq6i`e_O`IZ&(-Bhh!AD$or566ABZ2LyK+64+Y_&&wYv`Ha$F^FfNg5lqci8ZK6KZ+=3Bh zk{%&HmRf%K&&E1|(W z!-N9e8o2JSXqEBllZ1>cd@WP#jf@}UhZ`F3E~svk^L1BLvv7h zcJIrI$Q~~SwOqzfr2Q$=VV#$m^480RVPcj^B`vl9Q2oe!L%UI=k?{Imu&yp%0~E9Y zd4H`Z4i;Er^4fH_Z*KFw+CE|Nwo%v8s+FS5VL*E*j4ycR-mI(8eXjLLR%cXiXhdro zI;z5|EP13TuZW?Y9YiA=y(l!$>sYC^AN}n?b%J@xzmszU|MJW%zJQf$G@?gO%TDQ1edux)w z4AgxwH08#0^t1FE2A~Q1Go8=+5$hJQi$aIXvXVn*MsqAiwVK=GZqAQ6#(Q40Osw9K zw43BV6Kl?S+fj4MQ8=IsU%qPG?s?fnZ|Tk>!NATHMd4Qcw*s? z5Ow1!;oNSW=rFHYJ=f72|K98qIl5kD3{0)sPD5BZulVcvFP&8-(}rKoTeaI*h^rv4 zcNaDyd}Ydk{Cfo>;qmNc>;mKo)R~BVuD`&rG(0|?TegI!Mx+$b8GcocNb_SVwyjk0 zL!vf+T>3BP%AoOQy0sSrI$R)OUm!4Ga5mNTNCaYou8z+BFn+-By}J(`W!wD^5a<8L z`PD$pkLtqSy~e-hJoBBSMqTs7Q!3SXBrfaXjdB;z+%-EcZ=b&zF>&U0BFY?{op1j8 za{e_k38SZQ6Qx!&9{+ue)#N4Zi*r?ho)=jUeLNAkJlYjpFU&$4b}Mf=zoGWGkzAY* zo)&(YTi#NXl7;$Wi}_?qoWReWu6o)6=yOj-w~9vyWwvrA4H7y&7Cd8qD8g9a>od|- z%p*G7hYr&6(;CpR<3V>)tYsQ=JZkuU+0$f)Qd>)1dtU*@0HCRKS`Q~D6qSMn{Sv=Z;&GSL(QN3L0Bis0YoB#2FEIH@I? zcBrw*^@Mh!-@ zIj_4#&Fu6Q-7#Tn%?1jxf6`OLMq95tW*)zXB5;{u8=2oWV{e@(@KF9|_WA{TR;G*+fE~JEz*mzYr>Dy@Oi_j8=rZi1-VKQg> zT)H?k!`0+)zqoM5C(2I%{fyW?gd%-Os~a2hl2IPvM)7a>g-x8#LocFiE~bmpB5;p( zuURGd%5p_o6wbDNEoFVfYtJ?4^3$vjijN7GQh(05qG3JqHTm~*)baKv-+KV%qXg{Z z%yDcKt{!xR|H3~b-ux$l=HF$N{ZqzDB%s%W7UvOr0xP5A*Z>Iy;K#NHNxHmR?5VwN zD@~l^9V@NNv)o!4Gxu=3v`n(ayoG4G&VQSN1LnxR0o#iLUd-hoyE?(;6;>rP&yGdn zOj(#Bs=G74`pSQw=Yj}>*#V>#przp5R!1N7n)FkWXv$pcc3VtS-zw8&(>6oWK($KW zzOiPx12maTIjp_-y+Wo4qkSDNw`S#R{$SX>!E zb78gG1-3w(z(t=XS#S1AX>>_SqxTnIj%U4Xo`s7|!OpxYBwXUia}EP#yw0vb7*&+*Y}A^~+V1p^~-pI4i+>ixsy zihEQEOQhf7hQcrb7tU^fQV!yX$zztDFL<@3WZ`F-XS2{ZFMG7 zQ-s=lKL)3t)g0@n;gsILZ-=FGIs#eK@mOBIeivi|AZ_eKnB8@o0R_K{KAC(zygRmO zZQdOBb~9STsX1_(f6VJd_c!Osf^c7j+*`lt5C`^=u&n+w>nChm5@f!Nf5$5~K;J#F zLoINnn}Bvoz#h551rOp%ARlZv*;LJVpJCq_R-+)Hr0fO6!#`DVEY<+!JPQXlz!%xzRaUd<Uu;#I_WE=Rx#2Ve#g%reiK%oi9+kGoKi0 zS{EPpe~TX~2<$o3di;_M&t&vU^2(s)SqkbUCZIIsqWJ8M?HDn!T7~d-d7Io{jGdhd z1TDdn^rbNvXvOY=>TV^cQ;ILfjCtW!F3c(VA|u0Xio}{@trnUGMD-@a}WiMOnDak&i*X}SI6l0u1oU1NoY5!Bg} z+||qtOl9Ak_ABhs@#_HmolXj^0lX4kUf!B~c9vFv#i;`B4_YC9cP5{6AKN7D?%W*Y zr21a(n-HzqJNuhUGJ5OL?OT{$=ZingYE%$huu^2<^uMf!>)p4eBxj{qccpOUe_fDK z!tYsD)Flf`r=@T)bmtSA+t{$)e06<=bki7HCW{h*-mu1Z+KE8!KOo=)9MJFZNn9Dr zO*j=+J`;hc0dUG5Ak3VdmnY5{4ZWxuvSR6B8oyseiL5ba0jo_Tx$Y{HHXd}S%s|Ab zNgJM(k#V>88sw2D;2Tj;8l@+_S?aEf90gYmM<(r3u(mh_?TwIYpt^W+P5d!nJB&8P z&h9Qkd4bL_dPp4Pb1#G;F96wMC=%yJdgy91)6F7juy__1eafz8*MKHHBTSNc_LQ4n zl_liOGn9Y10aO%pkhSAdcD_{sbn8seAxbDf7@c8g^^TTVGwE4a>}XLDg>bma4yJ%$ z$WdcI$Rg@tfKWJy+b^H93&H}gvXjxDC%dvuO--%c&PoD#)1q^KdCrQ@q^q?QpzLUd z@L#ij`H4t;090z{KpP~oW<2_kGnK_Mz!#K?f7}YuVYLyWGXN*^&0075$}7PC4Eb;V z(xQpg!8jQ~3(ns5=q#&DtD&2WFtf3lt;|#b&+tJu+nJ|EP>!hoUqyern8VR`qMQxK>@2tYv@h2{p1=o0B~{+e0&SIRW0L;W+{HVddMg zv{4|w(mYV8o^+$emF<1b`c+_a61Nh2H=(dcc11!q6g*p3aB_4bzdDP>4PL3kv9YqU zvZUCqj=z^nc3xsRlu4xtsp=;O!+6e}U+dAB0jdt^`wB~v#gTWB5I#$#&f4CM2#p?I z4hGr~z+xD|Y*D|ke!u;W{_w<)Pc4QX=Cd_PO4E!n^kUEgXz&DhTSuF-M$M94Tul1d<9}nLUiXzFot(Kw^@Mz;&mxRR)dVXo!8WHU#*?k@v zwH&{x;gvpP{GF{U)M2&N%*CWUAuTvv6-MkIcnfRjmv&8(1(30We&P-eJxhJ8pME%yszxt{?t#!HiO8K*EP7xeI zor>bOuUamhztgCkqMxwaq06vu&()(}{IiH6G?j&XDZuv>T@t(H)0wl3naQoHqQ`JyTcg#B+Pm+i+h7YPW{p z)=whsFT&MRp2_b^o?5Ydo6+rRb=2ld%KcEJ_|6oQ)(1CpoB>IDotW%U|M~N|p>z3c zn&QEoaW4{2rs9XH{!;apl+GoxXSU{aQuMGPd2>Nb8T(<^s!U~SFX_la zNZgV~m=p_y&Cb3C5pkVB)O;RjyL^4!C2bQO&MxHcXHkKs()d0Io*dDMJ*!w{ai@0n zri!ARmQhjfU1U`fw~EPaqtn6dRw^%K+bBS{NuiJs8{P-6nL5YH_pb>oE+&}G*>;|R z7PZw9X=avAlY;i$8|k>qJ*~5MuWOw;A1`bf*Rk;R`W|jM63--k-n#5$ce5#%YQdqYx9AhXqbV_IhQ#>w2ZW)uy4fx@8^+8kO@@ z&aGQnTd1oGn&%FqtRI%e94Rm&c5&;3H?baKc$6S;Kp+Q0%X035l&>{(9pYkQVmcz1 zW+N;BZ)9TWbuPgU(C_w-zFCjp!Z}$$z(tjG1a0$B8sv={Yv5e^K(qHB=nemIS3reb zUUsImDXH&S{cGRQ_VqsWCsH&Ru3b!%U(uDSAs3DU<_eG^R`cz&m-|uwY)69k@8ZM+ zh*lHb=9KNZY{5pkPLRS$f%?<$Qt`j~NdxnfsQwYDYd9Z)dn3L+2UQNx$)DuJwH|SV zbU|x;3co^F7t+NOpl>t%eVrBIv+d%hnjm*CTrU(QspGZsdnBd#%-E@8OEuoMrhsoS zUUO;VW$gy1+`+sYg3pT+Re)B)%VgRY_~i2lvuWf@$x&GmcaDht82*{Nc#HWaul0 z1EQV$h6BN-;~5|2j+^CTx`bR+nGzvwa^5!FVTcHih%AcWoZ-<0uQ1SY`#Ia#bmk@m zTF^xcDj?T2j+#?zxu7AkokI?8K?=${#Kxt+a79-TxnH{B#kJ#0Xlf`RAD&iezDeWG z8#57$!#x7ULqOtvnDoA_hct+Z?Lr+TYiJ);P0UADfzl*#c4ddlJ!_=8thWj&?tL?( z?f8{~+o?Evu6iI~V3FT=3UIfpVgm*IHnX`LHFKsU9r1Q|aT0L#>Uh#=ixHq_21kAp zN#2O(z&~?ap90-tM11&};`X3k`^B3<*;+o$uHc6sa9;rZoKPCLLu__o6gBx&)w^kF zz6KN+mlfA3MYqu!6N=MU^u@xjZgoBqZ4EQ(ZAY3DwIq(ak`p}g>PYNV%>zNrS>KKJ zCmPwm+KJzs@qFDrbEkw$L2IX+cYVm~%9j7Pp8%*Hy%M)LKXrSDq-QS{k5cqmpGsD_ z(!cI)>p;t90QmYWXVr1w!fwlU z`r21~@rT=peMJHJVwd|^!qrdy3VQ%tBP&Kq;(GCaiO=s~UM;tx>2nKKPdvtYjv2^ok~U4g@9C)Gh?lJ)dZv zhZj}1oJPdi&o>9sv}+Coj$yJ+e$X*e%%K25!mj};toC@4Oi$pJ$=HP1ss%o=!&9^N+f%d%v_*v-@9FT$Lu@J(tp3i z`3_pbcqLz*6r{{J=uynE8k=Zed`ckh2o}JHO?)ec32Y& zpBQ%NaS5Xa{Z~YfW-|L9r5kTP+)`}dyyfv`T^#<4ih zwzQyNu@7QhX{1rzCdCz0Ek=eLSKLTB3GG#Us#( zW*4_m9NRf29+&kEab)lEF_}AmJgNto#;(+HOQQVvK}`PgTssABcq}BKfZC$iV@mZ{ z5%pFv*PBV%scY)Hng;87d|Bi78wQe5x8MB^H=r#C1eibV@8A6dIEMCsUZFO9GWL|+ z7`<&=_>X-PaF=!V)XvR)a(?pie@(W`rmkC!7h;?UT<&7X*S~?53`9W5ULF)+dJ6KP|7Na3`eNi0L}a($D~4E=NT*-nx~o((S+E z{Ur>wR+vA7C zd^N$Fu_&0w z@x4v?uSBc)U6>AVHrXH0AaSkmV`XKvw`8rFV*H-GPPzP_r4?L<&Z1RzcopeA`QcE2 zpY^S;Sgdyj{m}0xvQ5PS7C(!Sr5VgpnE-G30l)!g-|V;V{M({`7o%f4QFydDQXGXMyG}`0r<+2OkdMqo;MX`@m5}1^Ix=RlTr4eI0h(o|L6? z(2XqxYc%O4EAShdG2M)H>96les1=-EShxO~whML809w+{#$8ehnMr$PGjUx5PKkh_8aIf^W^_%3lpQ`X?WvBy31L0#LH$T6h?`=$Dd@{54^qITbzd z$B^wcW`Aw@h*;t4Ua8bFy>xc+D=H8u5p zZxE|Z1x{`82X6_~d3Ex%2lws24}4w*4I^0HgwHC^RdATjLT+0NO+x)7D5{+}c`|fy zCuBD$+k#@Mn3!0ArwU7*1IluFtm2?mI8YkXLB%kj!p}U@yjKBoZXaIQ4^#z*M!dmI zg@ouPLr$!;ePU@5r0ppi+la3q5P(JeUZL_FF(gpr{Y!SMWNt9%S6zGTO6D{QUgTQW zO*=y|Kb4(EBFa%39;kSa>+2<#= zmD+r}iO)z{L~RHg2jXy{eG@QiF$j?8i2f?_#p|y(*n`(p)YWk__~_Ua``1|7)}LLc z4;l=hMZDmX877&hJH^@nr>qiD$0jDmyQmG`oPSjHL2VYa{(t~1Uo=Wh#5?FP`_tLl z#bB}xomQ>L6z$bHntt}CWma~bdvYFM;tg#1RPfT~E&oR|z#uF(v&jNU{6 zvdMSvG+cKtG?1+_ldye;$oTjjm`R7ulr!Qa?l6ut4odDoa<+2L_RS> zcMYK$1ESPaLpoA%pbeh71+>B2oBQ+l*7UkyF*vY3`Tehb!XF?i;2l8EV>qz+xT(E- zJdV=oDkp@s{raO#2DHXf2wDY@a>{~ti=I{cdNV#+@?u|$+@2i=nof$s<6G*W9`Fj+ zo?VEFzQRm=`6v#K04h=-p=Bu(e@LH6^V1>oVX-pQ<{AGIA?}kVw_f4*(9~LP!z-R? zS=Pie_QH|gnXV>JS#9pQkzGZmT#!Rxe!)p%F%PlX!tc)bKQGeT2>A;Dk{`9{x!jF( z0sRR4JUA!I^U}8JupN*YkX3@JbR}>0UetmR(BIi1xDewZU-f`b7=ijX;>RVu$jWU( z1{m5Zc?_&%$x0&444^nUiA&0A0ylRzw{!MhzvZJSSV!W0x{zp}ctFe}JzAk`_q z1{EbeL}-Z?*)eL?PGkb!*TRz49g7BKx*w7{`Xg5uU64QS z32I?$!B&<6y8wZ)PA=r+f0VTr-_6!#PepF0=d#WAi+q)xXOOj%4I~sELOR!^j4=V= z^n;^>9*|B0B9o!~@?khzIS^H^iKf?tDSzv+5U7UkI;Zl{gZ2A@sss?}ZTz&Z3BCwj zljW7K*XY5YcNco}!3kE-Pp6DPl^UEnwI&L_2&Doc@J*xaSgg@kc$hrcsx$Ni^9-Jd zSF$3}+v0Ha-7(>x56m5pMr?CA5NJIj_0HEUUB;#Kt7UYSfw{&StY%a6 z-na-{=YfLE8v4smJxm`^O1ZnH<+^gb4j*0j>UB^7x1_ODUU* z_Fgz^mQD5zje9UNYzhdcZ^T##QZ$L_{@@a(tdn4AeKkDqp@^++l@C|M!GEEsnK596Xz2lrhN&W;+XY69$h^V9KlBOOPCin8gZxgo&m6?~_Hsdm+ zU74!IOMRXzCQsw6GnkoOF2jGfCGv1NBAm)QYn@~>gd^^!10m#(8E<9GjWTWOc=DYD zt=^$EsvBVT!Haoi7EhLTG+16U((!fATfVGL7wxyyt^0)dDwHnlWFWb~9@D90&6T~k zlUZN;EWELi0dp5KPqeoEVwGUlO&Q~&zGO4f?fSKT@EAM5fMSL_%I5G~q1c3* z`(T9Rs`C;!fo8v?mma&^k@Wv(&?~q7wWe|Q*PtbYBrjENY(xQmMkY!1UMKRjo+K_O zv!3A@F6eSag=TH#>cyS-u3=f&^N&Zrf>-ES!5(L$9zdN--m5)+20uJYk?Y5N2=MH+ zJ$jy$AkFEslHNSlW}cO~2j5H@#VLX|`qXp4Ln_!MW&{7ZRPmbc(EiCG#;ac)abI)M z&5LFHUzG6Igy<(|r>3nXo$?%Fzlrl%+)Fr{7{s2bg_D!=4K8#>@bnk$RfIZB*CWBna4fqVdkg54M+e(djmAfeod@eBYmtCy6J1cqRL@w zd@|9^{_S{{tb4L;gp|}7cwy>i*^&WGoz)2-c4jOM8ZqXAvLAHJ4ZIRZsj7yQL0Hvo z0MGznDk&*$z{<%l&@njDkzlKEA%@9qrfa}l`4S6oGS%-N3+51#Ct_#|3iKug%zT3~ z!F|QdVUajV@5VyF3j=jG{E+7jF-qZAbi-m_}IPthcfdM(Z9#c9{K;0kfdoo$! zrgddL=vr!cQ_iLSY}E-uNM=@)sdCJLv#>dJpOLN_dqbB--NiVvKQVm{SZ#017+)$z%rFMBgcLA_Q{F4Tz{mdd$C*1;wR zQgll69<+uedG!WYyvMPyL+p0&x*};Ao8{2u^BcYZn^;{M^tCJfD-u8zIyofFFDh!r ztQWcBIH?$>05m zrRG~L@|7d@KrZd}0x@qE-5I(f`JE91!z=gNjSFwLnH#D|!Ax3=aI75+u-{!iUh2%J zN$)RMa7xW`{E-xb{i)@kA&{;iIDHHX;g-Dye;0GBowXUM-fy?O%jv-{Dd}~aO{fvoEXaXV?%}oO0 z2lX9FkOz#D{?f<}H!i12!zn)Wa@pq}1DTFW_aGGd3Sv{3mh3>}K~?xRQvo+-x-Bn| zdzXsxRIvTNTV9kQ2ig1GSt%Y7?k_$c_wvgkDZhj_`Wv!*dG2{vVxEI*%GWC>c4RpU zwI1jekoy)C_DP@Kvly1m&Gst*y^(JU_<~+St-F0?nbE3_q=aOP(UO%8SI!AAk%`v! zNOZAu1y|Kv_Y0ChGd-6bRQQHE%z{fQwB459NWvRBcLQu@>A%7M5ueX4ca#}}JI3{2JX40fU z^>5yk8zjd~U{-d7YAvMN+DI7yScP0c{l-sumSkHRaN;As#{c~#DinZKaJF!wk@Zt% z2oK2;G`@o3sEfNP(F$1t9L7T;f!cif z$3ZxDDD01?6s7rE*uzE9mam;yK>I-y{p-;l*sy_d!+I$86x(cRR}qg^Q&kdmI!*i| zHR$IjzgeM}v|iOLzPUM|{3((aT_Z`~!1Dcja1Qa>{YyL0GtX=4C2Z2TxJPbjHCE*{ zhXSW|Eeh>T#~FFnH}rGVw42#J(`{yQO2bpre~OK!8ZInmIeX$GQ;p7xft4qrP1PM< z>C!K-XE&a{e*<<0zRybVy);94M-={4`TSOWsy6}=ewHQvFWrMu(wVeX34D18>MfW&=@8Hgu02hE|2nD;N7rv+`$T7M zJL^x?J}UfrDMLxPS`($Zyd_uAZTy{b!l&GM`2^IA_zAvCrPnxj;dcZ|F1RS3J8?;F zhWCwC*~In`bJpxngrqCzeIpVBTEU3{%}+hjjaG9DkUd^v{ zIfxqVyBR~$7(>XV(V>@ElFp_!Dv|ncD+LpRitvM=bDzSqUgukw?kRD z8NOm0KlOnG{pxQcb)UwnPdp37DoPHc!f!KB$yOgVyY@LLJjG~c$nJn+Ue$-sEjkT$ zegzd$1B99C=7t*`++?4WSS2Ci67K#qXXlnISGS^kGr86&`TBPZwO2uGvdRqpcaKXFhZ=g5zWhTxhDpnr*l*%vhW<1YR^kLcgpeW=dVVz z0@oQ%PHDVoGw+WZkRm5mF}Lra26rSY70=ugdrpPAnk#*$@LsF)S1j3nggvH&K7}_dc+L12wGSWi`)7@tF@)^*qjlore$#uZ zF+{Zyrq~CJ9{J---=ul?n9KE9-lHpZ6F+;f(XLn@YXC|U| zR?<{Xf$nhkgIQS?HKv*24f z46)`Bh$bZQdL7Xo?kwg*_?{SXOWyNg&aT&)CukQ6Cxr%&I%nl2p9p!M>h-5)!JI*! z2>;n3xp#Rl3DmZ{4vIT9vCZPnS*sUDv7>whIytvq3}3y;PZ)P$!iTgyGRYE`QG;8oEU%~ge0#Aa&Go#T(@7^8Rayu8klWw%xa#HJCB68N zKYL;HkzT+pMhih>+Ju`DVb>!tAtSZ zuMV(||9QBNCE)mz>m9OACyg}Qx5)AvCLf@R?Zl|*p7DLR8XNsE>yVq5Ezgb8&RM!Z z&+&%zXp-uxuhaL|xTH4?^QmD~knSQU2_hbxA zOY4mitu1|kQsZ3AO%OHKwya@MN=av_OYc<4bR@tQ zSlz>6#Jku_{jvo!{>PN};#onfeGyU;?af-C#X5sF+c?=aSMFXvb2l|#Tssk|F9@%n z3%}i>!fzEsZiaQ!s62kAQQtRq)#w&LX-2~r1jvQQO=;qWWlwqX9Zo3m^78)rzis_E z7_F(w9113~Cj~Uor^e@X1a6nFCN$?0$4{jMdbqFJshx2veIbl2{JnSWDluH3KfPZ- zv$tLABWI&KFYDyE=Rm(7hLKF=+LZPH+wAhzc4qbAn|C+vq4r*&7Tve1g#cP$;?%5A zi}eb#kF|ejUtRqBw@aeS{(;y9-`cRZ;fmc{J2S41*v))I$!)E8Mjf0z(Z?{(m=NDL zD*fGh52Orf)QEj>_JyQm~}}?;z?0OBkJFefy$iq zPBUUD8c7$pMCCD8pz63dFpwzj4@9Et*#=?mrZRc#1;mxctm=tBEqf6+9|fII8*CowY2tTHkX`y>oj%>qS&>txQ_|)h3q|Mg=C&<>R1Ca)`jahQG^xw+A7SDnkEDDxS)s;3nDQ= zXix(3>KYnnEm$k>A9MFbPPX)?vl>!03B~50o3olfy>Rt$ zqkeHS;t<5~V4!MiJKH61xRit%-Etb7$L34}m$-ePhd@Iv{!a-n=z?(Bfn|~U&Sg~z zt?bJoY*7Ix>ZOQA6I(g2H4m~n3(xs@%n1@%mjoN33a8MAKPSS!_&tPf4l!FrqTQVj zK+3Xz+Gn%u{v2HHv&XfM1DR||`pIRA^cj8x2~lN@p{R*;{~wEU`Au@qT)Eg@$|DYn z3h8(o>#>@Kj@~<(WBp$Wm{@Yo8MZ6Gj=gWc_d2{v$Qo2sRLW_0xtmt7EddSQ#wR=u zshDIOxGF(jLy*i3cFP&9_No<$)gRC&M|!kxon~Io4irAhY8DrdiSJ!R9^XOckaHGX z&!16ZT}WAe3@p&PD}9hVQMNmFdvFjj&yno+ z;~#`x9=G0>Gw@c9zDP?}n4p|PJRsVl{9&($MxdYq7@c0|E=6&>GQ4{V>2OlK5x+qcwdKHibDKLLjgW9hZXyRn|)y~n*wmR3TO zMl&JFTXDGgWJGz&EzmD(;4M$aHrhILtM+qb;$2(#+t&wcP_q2M_`HnM>N~Di6G5yz zAD9alPs`q{RHVR71xfHPM^=Cm)O32JKzER{ry?>9)L}fv#AFBzD)Qf#iPq* zA*x{f7%68FvgBxo*nZA!qJ2skG;~6Fl)UmM)sS$yrDq4%)?1YO1fNWBgkO8XWZ485 zv#;f7Ttd`fjJ}qQ0oH%}KXwUJo(6r*VOu==EGNrNzkWIGm&_0_nRDln2Ud|QSa_OS zV#Ovl{LFMsA0%?*Loq51=sD}< z0MeeXt;W9K#H0|5ln_oNdP18dR~xI9!tb|jwu#Cz>j6b>Jr!L({yeLOIRc-S`62R# zgCDcd9$bv z(x-vZiMC3<^LefLw^d7z=ec}RQZEVy9nBYJ=Xk}~SHc$}$ftX(jJsQf*lvPgzm#~W zTs4$S)ltsz!{%JJiZeoZZmy(1m!~m=Uh2T<9U@?gontrZG}m;qjOq0NISx}MRphM> zv)luN$SRW7!GmvcGnaRGV87kcvad!EO@IZhss12)F-lS1#2%+M?`cd3A6D2He2wMM zD`{CECG?DP2-Z(r37u%hti`1oc4R4Z8M zdfF#Oai@G4;J)>&ee>}&oC!RX__5AgHc4GcE3t-H;zRm3w9y)C2TXn zv_aojRE5Kzf($}Ig)(I%ucOX{2tu(DFk2QtaBl)19sbp5&yihZIEC^P;;1uNR2){w zWnluoWzO5eMc>G%_|)dhl&aI(tO8DLS`!8^AD;Y$u1H_8Y{Sw6ZsL1ilcR0pwKu-E z+lDzChrq^Q-YLoKXaLV5RDAPha-ya|o`JOZ&*$-Jc$>cOK{4TO8ogBkT$*!ZZKeIs z@BU6+2|s5$mJ<(Mtdjf&7y&vCELiSEg*kNjtLi97f7jpik^G|4C=(S~E*QMcDrx1D zC#?l2)RJL7^t_Nv2iJG^RZ>yWmFd%WxBfB;ImcT)Z99(xa&?xx4j&wksL)+1I5s6m z>XA#Q0OnJJw~y?nEKWF`A;^%v3(dLemeU*oL#;@9yp@@O{1ib_vvt$gJ(R%%*l$32 zZm>07APef*VK4d@|0e=r47Ctu37mamn^*-Wdjj)kdZ?{Y@g?HP)rkd*+3vKdWHw!N zisj8Kt~u!}3xBp!9SQg=DBx|GXu^NN0(RR|@To`G%|Dd>^_;$(Y&7~(Djh$w_>umT zK5kdHIqde@(2@;pc_<4WF-(h0_f@;5Rn7gz4Zifd*~Z&d83IHM z^bArx8Bf#fb4>VZo-uumLbR7+Yr$r_*gDN8S0S-2_*&(k+qXz(F*>nxunJK6<;gD@ z=4~bcUQxb9?JtBfZwxHuC*{s4c6W-*L1L7UpnG%MgM#Bu_Z+3PPQEIiFkh0JSRLk? z2&iQ?GcF~*X#RL0|CsYqr)#nfj{{SYQ|uq6{b^s@JeCfTUy~we;O&?XD=``%j#}qJ zF{o{i(xB$CxQK8_zKyY>neK-aPPPtjnZE1(C#_EdhPJ76)SItK8GmhSJCT4I?oEE7 z;C^W|I$ri&NFh$6@lG{!bLk3|iM>fuEZ$*?Q|^7Tic-et{@@RGSn9m6`Ysh_vi|+2a>egUU zMF;%k98iu_eWzDH9L8(~7O?o4mMP|2DeO-P=daSpeI$B0US5&oV*6e;p%m{-t+_iX zJX6G_Af0QrfaqSU->2icKQA98XnTyOYG!{brDzQq_F}N-aMX!MJ-9Xujpq&5SM$4v z3TeXg^s2>Q^xiuWlA`u>mTt(DH9l#9QS3%STju2^2N?Q6*TD(b)MPq2qTDrF5A^YC zG2!&{c!gs;dzx@x+hiykcqK+#C?N7%cj!r1Q?~7J$LdN)NYd$xGY3awS>EMohIvf0KB28+nWzmA zXj1kj@OJX)%~wxknD##?U`=zA)|?BExiTl8WN^+vYN6=ke0)FqEPVnsI&rI}ultp} zm)J`o15wHYQSrq#is#J9(CmRY8%32GDO5C9)Mlj@X*W3^(e~T10 zHtHPcB5E0C=WF$rcYPd#J7_vL&bovBK9<98FfiZGimeKBwh9wliBb1%z@&o9uK#6| zh;MJdezYLn(dd0?KgI4s8vOAwR9#I}BN;4eTwma7G5Zuxt^0GtF5qYKI<)ep23cCd zrIo6MOHA=YRS()fHji4O9IKR;4&v+y<#H^}S@|0D86qj{Pih+Bdb)Mf3dO|*+WFB3 z@*&gpL1zZ>J%--ygR%nN4FVCFPjuvKFz0OEGhZ`u{GefwrPGnmX?_fUj+b}(>v3O~ zZpMz+&-K8#i0r>AHJp`!Ch`<4St1!iMN=ndmoWR)!%Q+lcQr<$zD~)bw$ZnJUkLFR z^zO%<531d|=F1bcyK5TEc6nTlhT3q0i>!lmON*@Bd2H(*5w#a>6j$b)sy)4I4nC?s zM?2Wt*YPdL`l=iDky!X=R#zX*hyaH5K@1%cDrv2|`Ctfj?;}2{Seng!q<2>Owsg+y z=#Mm9pj4sKrI^UivN-INf;1E;D2_QytXa5MWkJ9&lH^+SYQ(hjoOrylPT zW*>;~IQX9H!z%XbM>B%kAChw%ixe%|ANbFiVaoU()93&=T$cz*u4T&#X?hB}`HRQ) z7`>5L^=-p+E)|O6dq>67n=scX72&wHoa0^g_h3iDq(Xsnm`lkL%k-;^?>byWK8Km~;9O;T^2RR& zU7NJzPT+e|O^xA!+V~wO!yB|OPA75eJuQApTV?$w0Q~lWLet zwG_SfAuGYEw6iA0dI?b$+vO_lWwO(%FrC`dV~dP5qVn#38d~Gg6S!$|T)O%0Sl6t~ z`6Ibe@1|KyPcp1N;j`jYH+|^LmMe8DE+0^g=4o--T7lpRjm|oKotQWZD)!%Z&H7)E z9R7p7yQ=zZs;8!=T3cIZDT$ai9{>pu+o}^Z_$>BsIs#<)7sJ?W!Fgk2%O0E60nRU+ ztJ9XfP>+6<7#!&9Gd9d5tjfTAm`N8(>lTcg5TEE5Iam!H9p;0Hxumhibb%9f(x zkeckIwSU!T}+Gk_)|-;Q?= zoit^!2@)x<@bv*#{bEqbQd|@U$pC}O$R{)UGNeE^OlxEmS*jU482Pj;Jg0MqV2H(N zmW|tW2SY=ooeyFV0=N`#LP(!FWEwqN#)8^-hsAk0`~&O+MD_`rxW+kuw)G1R?1Zj(y z9M{lJ_Ziz4n$8KQ2j5f_`(&6`qSRxiSVE;8$+N|F|^ zt|}|ggiep!pv*GDr4~U4{lkWIaH>_N^>%L=`+F9vkd_M@*KJs+CW2{T)|Mk|2>AdVo(7ca z)jaNH7sV)z5!?mZCJce=VHoKH-hgL3TN&!aee~A!-+{2RG*crNBD|^kZwV*g?7(yX z$!_{_lLiTV?M%0nHLrAiZ|({FKG&1^xa{#%sSdZ%JF)R|^jD_8aVFhvO6f&7I$~t8 zC+HTXj4cgX7~5v|L|^S#=+=Islw3U{;|t&C^=cmc@@Bq8u*nL=21x209W1NYDeAat z_EBzdc|_#A-QrN1qp89vPg)kYt|usDH*(#?g$yno>7qP69oe=h*Z!*3y5}|-flj#6 z`BEzS3yZspkw*b`OB#r~!QcZ52wA7q$P}T@fRgT!MzolaRa0)#$#=1_v5?W-SKh2~ znZkCM4tFKBD1|D1n@8}cu7ZBcl)Btx1A@q@bxl&CSUS8BxFAo)*h6B;t{WmJ4 ztpN~`TvTIj0tnbf8ctlMX_IMPUdZU~-!5?;$68Z@LoFKqb^&RoFeZcnH?Yk{c^rg8WyhYK(Mm1XyYS zZwu1SKBsm;VPb-4pxeZ7$=4~7@<)DdN>UGwH=whv5b(?6;s>x2Ap-)tk>)^eWCvJV zAR`I5GX@Y@+<0S0u47$mMJjUK6mJS!njc34!G_EfLlEcY9xTV*N5Y(dm;r9qCnkRi zN-e%<(!%m`ZWirpayb~xMJ{zhB;EG}6?WQwQ!OQv2hi*~oQE(ONomS*1$FT; zyw*@!4q#j$d`-w`FUiQt0v$uVM$Wv08oS69PuSI z5>fz6RJm)2aSb_u-}BI|rdgn*^8>6`p%ca`RE;J>P-Jxx(uM|Le_NNSZxl901%3W$ zw56HDWDz~|qck7eq)0xwjA5oj>ueX}0odjdFH$jnCz!vB_e?*nEX@P@p@3z-c%G8Z z-xeO!GFCJ5h8_py5A=g<{64a?QNSGFXWTgls5)|q^GI@REW0(!bI>#ZrDN?+es>lo zI=M8{UkR^!rvR}xvLqe1@N(}%ia`f3HxA1JMmrHGbL0>OXnBnl$~>KsPx>ywznr#YW!F)JQ( zj7##HEw^z1kI3FZh%kEnRlhSKj4#aLx#=aDnk zREX6L+=+DUVpOr-?}iU;9ZMMturq=&5lZbf!#h_dv64Z(_0$}xpF2`kXPT9;Ty^!z zjPcB(y#;z7%8F@-rV?|xlh+sm<6^!f2BZN*-u&(9PT}Q8+WdekJHj3TYfFD@linIA zL{1uVkfb4Wcv@O}Wid*Fsy6Y)V6sq2cJ6+mN8Jq`S#b>lG<$aJ&dK-~W9gUunKtQ& zN38>ovU8V@6oHwOaU=^pxm4pqAd+r(EvDNQE1))3*BVY%AJSVf(k(BX3Jk3ICC_6! zbIfeq)$S=)Joey!Uvyb<;9+rjaJ_JBzLsp7axNWKC6jf`v32WGjR~qLsIjQ~9S$}& z7RR1FVr4W49S(qGKpt0hJBXHFB8JJ%T61AbnQ;}UZQa_s(;18-HkJLPx zj=TT$!)CUlr*cnH2MC`J-zS{xJSO{*6a{sv8-Z{AabnqOjJ^2tohnqd zyqCD*A7LFd23eDmN3bdUhW=jRdelJGmCrPuIoD$C>`6C=%GT&2snsYZ+Zwgn?hR}| zLgu5_UetCI!_42aPy8yTu6N~uDyz{pQ9|EUk>B(abRq3KTPl4ZPvqrslK{J6PcSL) z4wN!7v~aa>90?Q1mHJ3J7k{7tO&p%0A2M!CHa}#KkFp%3sV2W^xTj(BGu>A_Y>kSB zj=ps+HbzXShqt7eRnl9D?y#@%FW)8@5Hhp|%GeML5P=SNw4OM$Q2 z)%7N83&l04_M+f8>j|pvY#cyxu`|6uqvC6<~~O*QmLpSj#?xE+x3AY5 z$O#>Q_7t>>ob(_hXfhiO5?Klfnp}dQJX0tEtTCUFOz`K0S8WiEnWnD$kFv^G56Pfs zK*~M~$M$8E?eiblV1%$5C*zzE)jH~gcO6RcQ^QkiOtpKEAJXG*?%rSavDN~BCUkiUsYnxnM4p% zuRU|}tX@}|Q1a`a!$H=-uQ&KFUkF0LT`#GqHU%cS+kEpXsBYo9LG4D8>Rtx#<$vdMXo|HB~8*In^jq;@e(pFGAo7f3iJfwUNU2hv@ z+d)}%r1j6QC;>E|#ZmA-A+vU~2BJ&|8qE0RnB(1ZH(m{r7VE>Lm*l+T{^SEj!{#+= zZ#%-Ki0(XtJ>F}t^+*-TZDrh9h*#47va%6qR$H!Q&AS7M1x_%4c_2yhyA9^DOni-CZ zoHt@I6)>jce_8AK-(EU2rLI0#$hU7lWru-k=)F!UN$%{?chD1y+T5Z0X3a?~#yffTRhAc}vkWO)rR1U}WOJqcbzhRlp7|ctv7s%}7YN!Z~lUW*e(44Dq zXj=Lsbc+(Fs&ANL8GWwQh)IY*&hBf8vbqA}-0QRgH`J(zn|RwT>vjkGnU*|=s77#zg1*kXIga|>o^zk& zl3#n~HYA7&gzAQzL*_GUfa^>PHjhR>Ljvw96S~c>V<${SYZz{pz>~H(xE%;RQ zQD$@0QD4`yKKpxXBL?b9F}Li>LPp3^Nam;6Ztuhc<0+7b8sLBP8fR7Fa1uTfE;l8C zRtO(_(nPi5yyO094K0Qpb|-2v+1^NyboINAS=aK=ygvA`g8pEgd-4gZp{CZj+WwYA zifYV{jh0EpPU&Ak`OMD{?Pg5ehy#;hV-{a_GKh9si;#$uOMm2M>uSuZ&a?1o#+_ob zfqeT(;boKWi=mt}s$h6Cwwap3KtsA7CnoBgqP6b|&lSX5T3mU%GtozoLF}{l`cnIZ zRWvVmB@%P+3)gVFW7JXV;oKa}p<^uCIy(I0oa@}0COf}*RC{s8YBrsFS6SV;LDm)d zg}~qU8IT6QE=0$%1Pkn6r{Tj#6%$k{Xq0!@&&pOVPYBTUR$=^e!M|*svC#*NjY-cI z4u3CO70fqy$~p|p{S_T=Y$@~NP8CLqpmEK!1q3<8NJm5fpgM%K59QeS^J1<(qHJ+K zLKp?l7GHChJNY8nN%ptDkjhr_q-07XFU>7x6e}N{rS)#lwk^$dyiiJc76?fnGzI{S zH4S|3z4vBeanFkI8@KuP4`59eJyrR+*Yy4K^WG1Caxs)elEUyx9m%N;2g+P8{NJ$a zAqD(*Is8yzovHGc`>w0LMd#l+&M(FI6vG)46dv8)Km9nG_Jc zu7A2ig|iA~9TCKXL&Q2+u-fK?S33v{jaq(})RXsk>t>f@(ArM;$_iEmsGI ziQE`_$me)crFm9BcYgeaIVFo;8Tm{DG!(~i)KEx$-!mQJ>p1Yn9lqPlcS=+Rr5>1Z zDaLZS`Lz8k@$Jz|g*WC^7WQEk0~b2?e}2v|{>VhGRUx)s-|&IxJj%@-dN*{0%ZhZ= zmtP%Z)!r`K@~0yTVVLd%xbwCIkqvezzI#g9DL3nj_2fngVy#`n& zfpJd)yzD=g>Kk(1T?5))(d9TiwDA+tKrb59oWJF_+c@r++saG6NY#wgufyIR zZ0&Q|>9}QAl}ky{f%W;jm+UBQ*^Kk-dudlKr;0T{RpG>G&-6~lwRK>ea)(Xb=+q8X zjkqYfpd4E!D`o~tUgP2u9OGb-Y@LfllP|x8}~k$ zn+_Q(sD;(p0}j$AzUgU(E6{pqr|yfqm5F?{B>G$*y*%Z|1Z#~R^G_?eWF$lAf1Y>( z*&=**Vc8FdvDtf$f1-a-eHo7O9O<1a4!-@qoMW@aN;7VDs`2YPbi|xu{fXML9~iFN zP^ASojx7XXLPIT9WYHg0rxq96GPgrkO*rPEj-06#C!{?{#vvaVE?4dP1J9Wv7ob-4 zWB(KNi*gBqd*%LA8&>sIiT^(3cZG+x_i=D^8!;jZtJodwr{1L5p~;-nPm|>L0ZkKE zH112vh8UZ{E?)EP0zQiNbK$)vAr8sim2;gUgAoH~v_*fknIYA2HFQM2#7AQN76QGO z`Wtn|t4Mucqhh9Uez-y*BiCA)bi7b{z(2wJ#P04Ua20oW6pcC zLfqHJpN;cNbUdTYw{1M?7S+kZ7fnLx!-i5HjH<=k@x@ZN(qn~8b!Vhz`Sk2kif@-W zWm;jR5m`Z=h{Jt?UqwqZu6~=q${9A(rQh=O27+ws%N=tAGjz{P)>)IyjfY-`+V90Z zV7EhE@vRCY-fPb3H9jxrw;;dro1B>=PPR@>m`>-o9S@Crj-A+o^rhj9G{aR#4FlR) zDGBkn4|PwuR5*nxx>p5HbW44hT~Mu+2Ai(+qN&%apn1=OZ&AytYixE(y8xR9P!Csp zDD?&hINRT4!>@-~+752g;-K9P5kxS60e{J9|95hpSi|;T%Dglo)9!KUNhIN?Bhj55 z1xzZ>I_~t4+f5@mzhWtb(myO7JQN6=*fH0!3$wg*l$d2uy&Zw1fJ^@x#~*IYw1SQ} zX`=Sy$yWJGv_)w88_1i2L~9=b_oiQah^Z5wcIJMHJgs|gG#%+UA!ab9)}izx*WMha zyonOJLSFs*Z@F``ikBof;~bavPXDCBH%?=OQ1@l1u^%7aKc+U6#Kb`}oP77%$%s)0 zxw&x%V7y3V+(_n+aZFn1!ObpAg)=y@aT!(U9XPsv14VgbMnxb(Vc3UMV_z64=pBp6 zSG1Y^k?(eoxW!wOaD}-}j-aD}en0N`bkzHDfrq!wc3a9!18;P?Y1Pb4k{%KZOXjp( zzk4~UJ5=rI+%Iw4WZ)4qj_oIj{c)Sgk*RkX7WFI5pPnQcUJmy(pnL~NKl7%4ydvWu zf~pLOU>{3W?)`64%-4~nN{pG}o=(>u)Ym;wbRFDl7VumnSdDWqq>wIN**FF_GTJE2 z(A+5VOHKa7Wc75<$iz5k`emM9O0$> zCEyw(o)BcTY9kh4x(t$)f0*LG5e9-rE0MUx!UM}E^34FO2r1Oj*autft0CnA0!VX? zC=fc0GcsJ}zY`w>shbiOjIH=2Ho}{sBUwmGg=@ad&$wf7XIXv%2p_=#Me`AOYJQrj8WfP|xD_w1|Y!+od?96&W>rA=?&Vm~-#!NrXWSdeB@oh}!WrdS>?@NZP zwQ73v3p6x&Jx&NWYXjEm)>xUcB5@1jm-+9`O<=`h!iwiFr#591* z=S~-=hhb`OHgKcMD91=nR6Z{E>WI9Haq0~XfPG5l zVXL?G@zg4zJ6V6ho2=Tr$%X;{0#=4F3;stS+dw2^I6!>H4b+P~v`1ua|9tbl!#}1#~P~=T9TCJfg-Ap-NlRG581#PCw!Sfkd4C2UlePUl0JK zfSF~Og#k&*{sw=EtKs!5SFVj{5ZlY!hHhzpB~phb7O|Lz2BW!DfH$WS#kVE}D&+rt~M zp-?=BlFcY%n;_`SeYLYq+ErgeH<~*DCqv~)pkK^&rEP5GM>-Z~Yijcrpv=}%p- z6kz8p*MzXWwHj}vzYZgasRqrN>yr9nqnl06$SLC@v5Ju&ReO`b$8s&(2O|Jk+smzv z%N|nEc73z+N%OgFbp^X$Kf>Mp4df3>O6Bx zVY{2zW==fMCU$QAaFlYlX0B!&i2eg=zlo$GKOx!g)Xbu8U)1v62(v$C6t$xb+P|D5 z^kCWgDo2A|E@$EFY0oGR|N39q5Z7+ZvU z5_Mf^Q8fH>Kdy4e+H0x92(HYVmkF^iFGfu`1U4GkFc0Q%JUbBRasR1#1hzV)OdmBl z-d1^Rr$<6{U9KDFs(ocfvqqyRxrJz*Hk)!#NaLxF*%e{jpVeQpJzZ>vjgF822u?lJ}v!B<=J`Ej;)X!LORPLk9 zZ0O?K+Z|%PM9e1AZ#^yBr|HZ+s}nylys1)XZD?Q&RW}#}HSwXxrYv_sbA?#y46&?q z(Poq}Qm3s+bD&(e=+gOgddsJZf}$_k(`PtLR%aK~R{scZlQ3DsBx*5;6*_nXEbJN)pRe7~Az(b#-#XD4WzzKM(WAP$YttUTv9IkPwy6EzKjQb#jyAjf*ka8B z##?KOeh!zL*!K%jKVFZ*fJD3X@&*zBtY$DZLc9~89DND(+n)Eh{Fj7+)ujRf zO{#2aaw!(Mz*3C7Zpn*Ibcnkxx;n`n5`LgKyIs`%1fH{}igL%NKAcD%%@B^y)NQs1E zlLKVaT@v9k@0mppLW4*{Xfw8^rr$5b{tq54tN6(DL3a zUn38fi0B-1hd)QKfrZk0b>2S$f=+ix#PE`EGY5ucSI@Swa8{IPVL&E(by z{r%5&A6cq_E~-=IySCvCk`8d7R=0u+F=i!x?OUOZ!M>7yoK4d?ojp4fQ|dV0&;547 zg7D3+B+{cUe%KV~p^-YM!Ohe3L$TqOen|L6_P&Z$${Z`sWL|&Ewd|BcW$g}QD4opK zhl7ZkAws0MhS|b|_*XAXA zkoDsPlo+VPZ1>>o zDG+|Zlb+T3^}V z3_4Jbl4A_eae-;v)Bx*EzbP@E0$w*;C*bN`P@-&}z>uO~%=&YC0!s$}3%Cpvljdd( zcgG&6Q8jtCxRi|rA@!WHK$mHxw&U@LP&FJUxq?wc(NA}GK)exr_HR_5A3uI1&2!8p zLw`gmR4f~X)~C5MFNkSJ#tRMW#IsDTWo>_fjmv7~&n;^%<`1M(JVPEK3NY6JWmi5v zr!olf>-};ophyPnpYMND6pAiGuc`fW2UN4o}Z}t}^1G5QCD%T4q z_X;a!_Dn9&_)D3UkLgEtG~>EyQL#<$aPc))iJui`2QH>+%$OfF`a+t7li?TjXZXC^ zUO}OB-qi}8H_}slj5eUS>_bO|#F8c>kJ(l8T3{!hzFZG23?0M<15rDG(4cF&lf)H* zo~32oKatJ&^GuJ;SCG6st7~0Avu)8uaUivE4io9IcSpFm$?f>uinXw7W7yykX|p&q zQ~p43l?^B4I;2{YOLvv9x4M9zeJW=Y15e%~#n{f&cEJ!h?hYI{yHI!`c_U1u6z&#D zD;THc)-y`9k&QK1bgni{MwQ08UE}VL2_#Z^EIh~rp)e&l9f{h!48g!bHx>aPzO7aF z$j7nx%_(;&%rZiLgOeGcduTu8xAr^GDT@QA1V&6ZfF0UemY+WfAud>)uGb*I9cyT4 zs3;cel*SW{-k;9<(ok5P!byM26UdpauGp})9w$GB(N z$}&e_UC0|FH@C1$AH^ww1Qdc53v-?9u&!Uqbu`b-|JJl|)c&6t0R7_<1%&!g+69hw z$OJtkhijn*ct8SG7om~h`Xvt)S3$WNd3jXjG?bkT{E6T~a$)t|>U(am46=^yG$EL{ z{b*g^NP!tg2@5F50OA&jgas7dgfX~9B4Gig_z%WMl(68Z%_I^}tY7$7VZr(*|AnxC z!u|kP$iEK@C^}WHe=jUp8~+L<=r#NSxFwS_Lt%-Vk$fwovRf^Fz*q&=W2&_>tK3g|ZRw6~MHpesF6 z(e*>VPIyq$*B#H$Yt({vjbA3aK4VdEnD>pX!GbzR&*t2G!&R3V^$s+S zT3{pm>%n)<&Uolc!RTBEZXX!5MoQj6t^7r~o`c5cwsT|)x{zro>cLLy;bHNZ`;tKS z+8)>wVCM-f)@n1OCe=xAL9`YpDK|KZmKWIVWNSF9&f1V|4GPN~7u)8aAqCUHWtk1D z2ea~ucIG7@(#+jU--#kFMmfa~v{DDNpEphe7gHWT6Z-^WmFi6V?d;_;C26yh=-}o(;UyT zYUeUi{SpijHwX4FOH9T@U|Uer+Ovup;)+qEO@n6)b)qzCC=D(0^F1G;dvqL zcCR&`I|w1Wy1FK<9T!$G^?YY@?!|k)m*kYTLk~XkZfO3FbZ=mDTHX#Ujq#e+WbHcJ zX*ii7RiC7?N?rqK;81F3v1c46Nn7AUKM&hz3qa5i5(=$52^%(rjhJshME4CHol}xx z3LS`v%(h)~tU##e`5TxNm=)>=CXR_Tju!amh~s>9L!yjUV<+Xz-AvjQHjuJ*45=;y zoJKzab6*g&Cx;4bX2qxNHbcKGGWrEP3FWxDsev9eQ)j$lIf8GDqOY(X1v7mFY0Da5 zH8eAmWipoo%Z|^AI(@LT%W0ljX3@YAiO>PS)p{`?AYi*B61L>t$(;gsm!ek%E3-Z6 z0^BPN9=(F(R|gx!qiTfz08D{g>kYm{8qNh22O%LLjLadYikCkrtO$&_S#xBI#PGrz z0f9z$czP!o3?RRBi%ux^`nqEwSMbu^|D40b0PDZ)V*#}z*eKZkj7EI#!})*05w_PS ztY?{=Z;tGQNVwr`Qh5G(m#O8G5P~Q=ew}3*rvzExR;}XEfkg85poP}dCu^aRec~4k z`rlzn{Pz@#Z$>~YOGrXb7$JUzG7=j_1^9`SS4|PKvsvHL?45}NUDf6mi0s3Njk*a$M}}vJE{d79;L;jgYUwltg6%-NFG+9d>v`Jo z8dLSV%o|j6v>H2kUT)M-*b^GKUEb$IyE~b25x2;)!6ccIm4D7JO;he@{1Rc;_an$E z3*S@bBUKj{9RNqa>RdTBp&1h)caa(1UCGx(tB2#FNR{2=OAF z=#yvHsRWbOI=mb*Z!lX4%5<@XME+N1PXZ8?z%&LdZz><;mTUpzNNnyG*3F<>A|$#7Z+Jo zz=cN~e0zD^)qxsAwS#O)O`$C%3dbsQh=S?!1{R#75K;d*#5{rf0)g;#6QkF2FNmo34e+yN?;v_49+ki}>q~AS|cFy-yh>#;9u?{@~2Ug+|WWa}x~KRdZH_#=Q&{yyUcGvQ*Af>0HvP+Z||gE9Ee7Ox(jBUe{7+UhVumrVkn1B`!QI1sn2U$Fl- zqD^@v`*@TOvp-L}@h;aKu-M9Lx}H^_VSxEiSX`GoSzhU|GftB8B5E;7M-z3<4Yf_! zXk2DQ`W+vHHH%4I30m$~-0yRJ9=}lomXcD!9Ri~DbF({=b&WZPS>1!minUSDNd-Oi z^?2XzBU>oypAL-s?64`NN&B+72|yn|p4S`9M6?M>1pla{Djz63d&iEo8Z(!SZuHTK zX{RAsH5V{7YdDnZ(AAD<^xojf&^cqSYT7LtJ@<~li*eR-KiZd=WqH8KKT32L(9&55 zs!v>{JUTL>lG6Nb{qn!lz%cTrzH$DI5e?teB-7IQ+CHS*_0_MDnyGnMpGnwMpC#gx z{p`17s;LvJ9A$28l}c|sO$b)w<_3-*dW}5ik2zgMQvE$*n(x)d(f)oxoQJn7aNeYGM~}B?BXZp<^09j z`VShWuj2NaV(r7?cb@M_?iXRGpOml=Nr@%4RmORuvT$AVtSRiS0)3aItC>CWgNV_? z9gPby1`DpHkvQ^CD!}aF7K3NKoVE8VMXMG~ghm43+jCoo z`iMn49%3ECWa1d|1?$BpoevJOj_-d^bJbhUcz!8B7R9%8HpKfWwyQz<(kaTq@d0q* zoQ`O%K3g^SqaaVxS#6u@8ki{{9tBk!D`oN6D5}c#^vI{7yw1|D7#g)>fWPZ2Mm!n* z!$W5M6M?eJMTC!K;%-5JK7lcL7)Y?e7inEx2vRzzvr^P|RnUVLDms7rr_N8FU{0?$ zwrPs8S0XUSiBDL>vIm@q_`&gDY|Gl8peIU>ueTV*aCtg9B3@{)h+Y>gwR7OjkaZ|X zCl18co}v$mqu7kmwmzf|9D&~%?5>nQhH7SY_I+`tu7#6&rWQ$N#zsqiKf$`@@!c8H?6 zramPoCZ*1YO#Q=pDFf48kwnYkbuYK`dCKiUmQOT_aVgwpYVp(-w?ZgvcB_-V6Za&GfU34 z;9rD}!}v6KUl!oh0fN`_Yf}S)0OMpZ))UD>Y@(uBD=7v-WROc^FpBqPxeM$S$Nlco ztUo+_xRNw&eW0D>fwNYrP($PJN3_8mo7W5pq~fmP)5saHx$M))Gi$zOpQg$f;&8`w zKWZ5Yr5S0~4D#?k1uOc?dm(!V|BRO^RYHiX;iswMCQ*HQ@qpjM$stDfif;-MR}pOHknl6^(jVjFU<9Q>+ z7v)FXepkCL%cWi3{HA{EiQ~(o1GYok=-wZ2Htpnc#w+BQ@;%RMbt?jo7Orc~{*{~( zLhO%2Ca@BA#rZAY0)x_~@u9_7CnBgw$t(8)1LgH)jFAfFtlpI^$~p5~3Ao+Idbre< z>atjGjmQzbEnoA64jfvt6_r0gI79(|U|m>1^7p;fc}Qtd^iB zHr12{5U{{OrUS}Tr{BX{^U+q*W8@$>^px(BaUekWH}9!3_g(E!xv0gijeW}{ z-&u`zwA#))a5^e68p-kzxVFZ{vJunOnPo*+-V|b((7wmyjO#IG?m^VT9a%r&zS>Ew z-VXFn8W$pI{12diivJ+0X8H^3u1(G49ppdXRSvdVa4`X#9Kpe3Xg2XPA#R=csNL5$ zOo!WZ&MOAx>bd>cbiD>P0dk|I|JU1f1~t`nYnmWM6c7PvN()7bR0RSeMMDc60VyI? znluT7q9|QN2ptIup$jNgx=2xa?}XkVbb_>S56Js|?>BSj&i&@j+#eYdlC$?d&t7}2 z^{jpNTDzymvO|Gm*#Id3GAsfQVd4$BoysINA`U1D>UK8oXH}K(lFyP*os~_xXMLtb zP75mWmL?=HxRNjG{e2Ocs$vh2t`0bJdXPC<<|GTaCkAA0Kss5rX24UmI*k?? z5=7STiWG@d!m&^9biQVtP8M0Pvr?>vTJgA0FnmX#%BCQ^FfBN2XR#ZI3Y}W>6tI?Xr|*x5+0sEu$^pHdlMGD0(Z;Qu=iiKUQfRkfPaRTX zkc^8??$P12>p4_FPi@Ik9_lGF$mz}RZy5+LDeoHz+uXw+@2Wz=o)qJ#_Mlo2iBhwhcdKS zu|nH*h8C5b1wyrXHgmuGamcoL$~^d~tEe7)K_0>6n6*{3wJ2AMAcCFxl9(36uw z`?pcEkO=0Qvc9G8NytF>W0mGMF^O2iIJMHnRT8Mbj9Vr8>Cbn-GiF0iU*3KR+`c%R z+E#CaBg?|q7gxT3EF!`CdL~c`iPX}h%O9mlb^UJxs8dOYh;qWH`-uMiq z3M9~H>@aFuWuT$Xj*gB<_6NUxo?oGp&IU$-;;BQJ-G~NlCQaTDfN3#?EJF1426Z^u zEmZfL8!3@QyLE^glBZwHK_XaXYupz^bek?RnAUi2SRay5ek7A7O+B5cM@S+(A?-=X z73Q;M@t$*^Uss2~o74bsbp!DC2jPGJLr93H;sQc`Oi131dJ34KNN}3dp z61bW3QR6WI!w#kdu-xFlyA%E2bdV4a!mO|FnPFi^zrXqf;Zf3^Up#~5&<#2H=IOD! zJi@9s7+dfeVbHo9q%T`FP`A2swO<= zX=QBep4FU;3#X%O43@xm7n3ht{~0SG=uva9%y(ErAbRC|%7T%_wY7e8^>&D(2F&U} z9fC07lbE?{HhjavPHNDE4=0X|6?nruZBd961%{kE=rmMz?c=L+ycBj&z)DFuIaFZf zvX!H9dFpL>M~z_wQ92mS=+26C=BHyBXGOHD4j^>KkIj;u76a$crGUB{k?$~e&@JfH za$jnV2x(!2DtUXC#@KNhxg%JM@y0cl`gq_c6918nhYC=`(uL7Ve3Vn8oyaDVaU@Nkz)3)h&Dp=R92>+QOWt&oFN zes?Ymq|_sHrNen$v<+-8eHf_sOH zyih)kG}(vAYP*K2bC+~5c6^-Lp6am?EV|Q>ah|Wm`&T>H^<17&PnlNBrJYZvXFE(w zzPA%`Kje1Avzd|o zpDmMEm%XVq&}E#kmw<7N_*6=r@g$^!epc@w>bDI+gOai^pO(|)7t{;Se{gh+3~6(+`p%KW zs$0s?si^Tm_@Tm4v+C`u+o+Vst7FH#;D6y$_izk-aFkvqDVN7=M*!^!N_a#cLW&em z*95OS?ascTgUAtrA(AL{b@Dp|_L@a=H8=5!(2KK%~XXcLO8IzCh{8!cHE z_s>gEwetW+V(qZZaGUzs;2SVXH%(cl&GjoOVFw{qC>FC5skm z#p=V_^Q?um@TlH2e}<-HYm@S7FL%u5%ug)(g3a}__3p1(?seRB#7J|z82*+=_7Ky= z#abbUunhzmOYY`5C0AHn_CEN)Yte;6SYtgNT|g406;@Uru949ApcI-S*OP0H>-txu zRsEGjXppG(j|Gfx(Fk!-xZuL38bFGTi2it8Bo3od3Ig@Kc2jFl*M0!a4t88FS?wbEdN-g9nK6IsCNRrZetsv2 z&NW}y?s8I`lpufJ$xeGmgs*4OQi9*ifN4tY@#T~2z=o6cHK!~I#X0ol0sVq}^r3l@ z(^z1ALo^sdXRaTws7py!d~3ln^G9O7dVIZ%HmO1p%llpKB|&u*Ic>2`0}v0bD2gv8@*@Qg8QmT-Fy7#xr!)20?Z;xV)t$B9N}Y3;_A|o{HiztL zE18QW1Xd(u^_)V@Jv;_$pm;&SOI}etZ88u8%BylLvB|vgtsfReV(y7b^$SJs=nsi3 z%VsMN#o?|v>j)Q3)E1*<)fco*`cE_$Ry79{_avfo)xRiA(5}1&;p=Q~%^kKN1WqDZ zbuJ0@s`evXEFZ;rYWJbTh=#we>U6E0HN1jv5D|q7wU|~(^{7$Q1iKDX)~5r7poY`6 zn>E~fPFS)j!1;?E-2R;Y$wWaVfQ8NhUf1hH!8|*70l96dr7PkAD+VuGm}dDuP3SO~ z3sz_kq?sXjUWhwOPH5T97cwuukhtfjEL4#Ao)n$I>|y^q1v(rgsa(T!qzX zRy8~dXGI%L+hnO{t`4X2;5-A8s$q)gP!PTX5tP7&NE;{PXhW=wcxFV6B+?*}CjCeS z_+8EOVGl^YZ~&huPrLl1`2KYNpS-66+xq#{l5{!N?9VeE?p|R$vk(C2xe+)c&mJSj zlcy06COfQ?)@%G6_FE)xV%{EXpZsjE#ID>FKhr@3S@RNuth`XI6FcCSGf;_?+Ap81 z*ip%vez<=9SI1t#mykM)+k^$%vcq1F+B&PR^>WHWM?uHgid!GXckk=gPH3?3}JTUZ}{5xDb9NQH-=Cm}%;e0L6H)1M)dul_(e2i0xV z6sgezFkF`odH<*m5%|3#7)(~p-WU=9JiFhh(wyKH&l06&#uc!=*rXjd_OSdl6V8pr z$`LNG8p}e0=}57{`^VLCc5k+cK~!4zP=<@+F(WtI8j^les8gy|eh~d2ePICcDkd;w_bbGNf**x%~3-+t12kz1(#V8sD14eTHS0J2cghE*$s=lh| zD(t}k&+6K{U4r3|qt8)2MdPGt@`Xv?h|#y_7Bx?LG5}vkqumV*X;t2vO7Kn-k8e+3 zqu1qH=1o&~$tc>JoxIT+pD($ABEP(z$(NrO?6@hiaolXQ`q6}OtmiPf{bT(df6%1| zub3H@E(%de-q1*{9|qHk>LAe?hpN%E(5EY#c}y_y?%MkfLE#`GPeM!a9QU! zejh$+S8BhsNRz!I)*>bB8A5CEAtLb z*lImHw6v|BVpLW{NW!x;^f!~TqO_fJc=Pk&s3a6D*x|8Jw~5UN_(8Mm(G}J=wCx#! zLJq}*IGfJg1SZe9-E=P!Sq$ue1ko3{VwTHo+;c<6@QT+K?ay5*N6@GW#ew)>LE$ zivkW(ETr}3H#fqBI~20yP7=7u|7)>Ec^%wm-(Ej6ShZ&v|{9VkFEl4B2Zd*Y0WGlK;!t z<(g;Zkr8Oz=d1E__;IX#@JN-XLfq#S45&JvV@WsSdD=3{8R@n;ttcf`3{a(yiP?T@ z8Pm7q`tKXy6m2O~obunr8U+iy$~Uo!cs52+r*ojetunX4G5q9_Il80OgL~~I*zQ_M za+t)&OfmlawlEnkFW8ra!Y!x36)96!mZU;HvWZ)?o|XPa3;D+5Z$3i1QsK*k&j`H~ z-IWD1B~l!;+A{WRO(S4wIl_)m$+ncrI??Zd=}5Q$74BE*KioMP%fzILQm#NU1S+sU zlvmZ#NkYMW^hgdV3YAqGq)rWfl12SN(yJ;X>!(ikUi542itGHlsO#H9(Z=0o$Y|`I zRqO7i(T;DQ;iz3RT0_OjVI_$@5VqHXZc3zkFcf56aSWv)brV&@o=rFDtMt!cMwiw zz506qm!QJB{Lilzh|Vh)@LLtmbEc2z-0{)7_{u@zWRfp0*>TIBHjf+vrRjYnEAf3{Z-H5wbxgrIXm-O(GiTXjqdaF7X&+~QklwSp zu=lgpU9y?hvX^+T=p$!2Kd!_&&PpnHl)mC4x|E*NDf(os?=q68o#1rkD@lhGOO9xw za@C|@)Ww8<)VL~mswgEJh%CH#3Fx@jph(*Xepjw}&q~e#0UUszzI?X9ao-$Z9#*f; zzNez*gHel;|H}q^G?;|o^*8LI8a?uBi;LACN~PhBW*}WRPOtUdYu0Z;m>ky=!lenS zO`I4%qO%GJ{$V&>_altwAcCefP7(NKTxZni+$;D`%<})yq&qov;?{^?mZsK_tq#iD zpOJDR4K)Sm^xkAtY|zAO@-qOr@WwfNTo}*%~a#NF$v3h>ObmnA2Jmj4k^hKvWIM#ALzHt4o4(oBHH+h@c(R zQz-k*aD-EJbfWrO=wkk9qeQWM`DwD3u6HAjE;VeR+URzfzfBBBGfy{cbCidUoIFYq z@!ZR7g6mh6B|04}`iT=?`b$=KSYX_DhsaX`I^ztFTc_9 zap#2RdKxvk@3jDo^v{Y*UWfMR<|$A$*rjX3RrrRjZyVT?95=8XzHCD9Zwu99J1N@K zka=t}E1FcDB9EU6KQ5i+;$bmo9MmhOOMKBuC=C@Jy}~N~AKDgQFV-zMImxw>+V65&`z65x$9n`q!=nwR-sBHYaMGMQoUEjMozy-!O*IY(*|A>XrHkYVza; zm{c;&nJi=|2ZD@pSddbp>4q<8q&BN=ZV>8!sZKO5e&zp@e?0X^g#{dTIhiwf!P9-d zdsN713(K|U>3DM;2Pp6Zz@)@>g(%f_HSTfrkE99mj)OjKg6<9K)UHBX^1)T4kg;(WLiDhGnH4PGC`D?0 zLTU8Q^S}BPnS*4EWZzE@jn&UT>ke&bvz%oY7cjc*aEII271d_7D=uNlLt0qu0_RKr-cBBBh3 zE^*$wTEzxk9vvRIUl5&$b&FnMrHH;<%o`YX=}qqFV4+d%Gv}zB2SSP%1_sl z6#cj6V@!;Is(4AU_p~qU8fdyXRPK|Q+Fo!+Sm!QAeb^Db9d23w`ciOSOY$#&K*#+< zrMLW>N=LB)ev@F%r1IQsxdh)gSzKN(B%eE})WWI!RpYw4FYbrWwTY%De=l({C|lmU z7jaXp3##CMsp2;Eou@Z9FXlP_rAQ_r7FMaUOXM;x4nTPLk1)WfPf5d{jiy3!y&1zZ9&*D%3{%l^(PS*IKi6{NmfXx2}e?!ep?M>c4(@`NS zr|~_FBC4K_EZGwPJs_&`hYB&IfWTfm4?TN2I^KbagYo}jP(aKVDKbR(^5LnKJ5}Q? z@zSTI4zn|ng(P^Jr>@2+k}=LOt<2uLFIFD`VXU8j{Xcc~EM^*0olZWL?QEI8H~Y~; z+~&i*j1os0YBU1KBoN6#f5wCJwooF;)gW|`wF`!jQIiv%oAqu? z^7L-v8tkWY)PHQWSy>|N47Ppp1RvrL%;%}uz7&NKnHC-$WFBGOsl#km;Tmc+$T*@VQ}&V@?UA{vkdk#cyXZ(t&`U@N}kO zTE~k$CU+iZ%ZJ;l1YM?^f<#)cv6eYDYl})Z`+_N2fnBVzu@48Pa0(&uKOTbi@7{>q z)#3JZ$B}8-qGrDe)JioY@~ZEqZ8U_9rmE97#ETOOqQt(yHt=|d{Xt(SQ9WG;gx$mOfzI_c>)z*2dgo?U}y*1jHCBxXu zvmFuD`gthAPh5g9q=J3`|T))$nFWPCcf* z6BfU{eyKXsJ^2ME(^}f%Hl0u;h%}E!SsaxC@j}2tXXfsx+Jdj#Zrha!N+hQ zbo(Qp?5IBCn~3gVbNk1iWS%Xg@9D}kjG;MRudR6HVLia{2q4+FFlu|DbCm0JQw(1< zI>UD@wp{TU;RuD+s0I(sMLONSB3nh{J&H7YSU&g>TEXKYQ6qCAuC8rb86Z&ema%z! zPcxMBE50K_ujODMyk06+pSwyD+U_BXtE!HGboG4lKpwxz!;&Ywfb7zwe?>+s4O$)M z-OV>^y_pVG?)z?UsNd&~dLB(7xPxN5d2vJp(G^JbSic0s;K5VTmU9dvo=Mf`!J?u9 zh&MTg@AT&A{6v(NmYTq(E~G#B8Npf$+e~%15Kj!F{;ptK1>(Fv=@}KtBGC}-ZGhf= zv#inYH29!~QcJpu&I>XPM#^(^Cs9FjqJz@8BAG(n=VHj%Axr}6kS$?Xq)uUeH5L^i zL|^@(ijb2$0NsM+Ny~he19GoK11Pady-;Q70iN=1b;1Q1;6VxEx!X55j9>O<<$Nah z9*Bwtss|ix3lw}{3~`o^s#vSk{G$Adu)N3%Hm>4=CSX-I+_AHzuDf#AI+dAsJS(d8 z)(Et@V#I!oLf!Q7LSJeqU5h*4xOF$9Xi+mfYU>lQ=gKVWdo((M!vb06C*bQ~VBeJ( z5J0Y$Rd^4P`G^KDusKdB6R*vwt#cSg_#jFmYsw^YS&L6zZ@lpwJzg4dS9=h}&oo<#2Y`o2# zD{~-n!p48@$H#N$+`m=hdYqo_et(2vcYzh^PkbgoCIw}ex*Sh+;vnJoHb52Q;o)8V fpZ+*M-#EF`^cuB2B4MgH)+eQ4tXs2uKZx^e!OM zi73*0uR){}Aan?X@a=$z_q%iNotZoT@BchA&XXZIXPZXPb1ajyb?Y}$9(Fq0+NJ9fc=7!1>oryI~E7p;a(Y3VdyzuJ08be;!vC!lm!=zd5 z1ny++#7S}9^qO0GikZ-^$^iXTbETi2+@aqq-wg0Y&)iB`eqZ|T6jA23pI(#y zMSQ`^Xns=YJT3cDt(5VDtbWGLhfCcgud?ogR}abHPoJz`S6AYikc)2Qyf=ywdN6|z z0PDN6AGaI)%lgN^n(oLh0)cmVcJy^%;89Y1QE{ROl%;9+|R6p>tYsF6)b?)&r1$}C%V%y*35y2fPH8}5Q#(9H72GGV4)k8kNl||2 zmCk;T*#2{Vf%M4LRR`A>o^^T2XhMO5lB6L7@p{c3)t&@kB@ED${;*{GGPhFyB z6yF!=G_x15P)AxFANN9eOOJ=uCoe3{FtTgTv@Hwbgm`Lu-8EpsR+5EsO0D%#vE;E3 z%<*c&1wlFpL`xZGyEN6C!;5DZ<%06NHpf!FyiYr^?$w|eSkXcL)QuQAm+}H>fF8f5 zJ~fhBJkwr7TEG+FR(=4FUDg(a_dzRbq!gtZvyg-Q!(t z7F_>Jlp{ynd2;wp>Vu-8BS^YzLozP$v{OsfSPH`>Oi|$Zz?`DlU2}fOq&%MW4|mo2 zs*&MI=d{MNsuAh)!u!(a855J7$4l?v!tAf$*{@j<2V~a+ z*vq%RRlO2beT7@73Y||jRIb~XeA9O39{Nouv34>4gOth9iCewjdyaIbi1nYlDx}Y0 zOeWqGBeP@_vb{rPWMNyD>C*8*F#Z5@=u9yy1j05j zY}3?l4%gvZQKMgdAbtZ#3bCc7su+LFOOcDz*V zjyEz%LaM;1rM)d}0*TV4lTY@kk_mHNs%XhGp|jy~PP}(%{MYp_dSZ;5#$!5e%eWcH zP@h4BsIJxM{J;We8uq!^Y>tX99d6J&@|F{~kXkDu+vkdkpc=%HIWNM1`<9|%Se-4? zdL7soTnwxd`=jr&CnhLKGj7%Qisf~191@c#nwOm&V>U;b-BwtXoc0e=w{sln7t?d-cHDMs4A>-uCggrP~FGxRm$`kg(3n!e$)qFfrsmcuih}CF!=3;Tpy8zR}SF(%dIDWzgjDb~%KYXYB8bVI|Jnb{ zeJnIGg0hCeI8Fo^uM1`tua@(ukc=h#YoEOQL<@Yts2Uz;;9@}FJIe49ys^RNVU`g~ zvBjU+&F45mhUTXkT318Dpddg_MC`={=-`V#P1rTXGPczSfS~3@GpDCr|Mb5xpT(X` zKd`fFrIZ}DEv>3zz$_kuG@P()LYiAxT<$647Z7$aF_@;AjHE&JHC%h2xGlepo559^ zHTOKdj7Je5VxD@By}tv{3!QR z7Rn;dflzTpz%fu|Cxp`nY1-x;HkYnL(e)F&+RQaKXVW*w-6p0AfpES+npSmnb#;G> zKRaR+mpt6zyzcDiSSj`p{OuX|TgPBU7FztUD8Hb#5Lls&o$VtVn`SX%2;`GD(sY7Q z+It>M~Yy z*kl*vy@f4Gzg;renMz?i7e5#yXXk%Z#7%gJZZ8k(RdF~mrg#ixV(6B>o}J@yD^~W< zCCkvB6v4R(O{KSrKEd$^Ax}RyBD}rd8uhG6Lt1fBZ9S50#;K35jq9N%FWuIMI@;I` z3ZRR2K>VekLLZBY#Qke!kY)5p@49{2UYNiOly_QJV=}+3#7(EAz(WIt>|@iRsxN(t z3~>eO=(si&LLm>wJu-3j9WRg76`Qy_7lMJ$K3$wQhprJrWYe)sA?u4xJ(6te=^#3w zl!;DnOpCyBNwsa4NcIa?Uxd zDlMsi(_Y<3MKtj~Lz-Z#*cCy0Bar>54oAkW$lFYfhk=wOhzEK1Q@k7}TaoEZS zijJzI?aSSldsgkfvvGF~@jLL}i{s-7R^dnRe-5dW&29C0lv4>);%s zB;hB$+N=F?lc}eq`;oKh2Rd;_%#XqLy6#9!!iI8xW~-~Ob92^nY7w*8G`W(_KC!YJZeLGlL%;V=## zPL+=#3%TFqTNJ6$qtcg^hMp@oeT(GX0pavQn%=Us|JhgP2DMf*$~TRWSZl2rZJnI7 zmvSzC}A`2QT;4E(Ri-$Zi%<3qiK9$Oy8Bq?QxEpi>|o zwG(3Hf$WNEZEX!P%kwigx?*$QJByU4#K6LQ@~g(`Nwdfqy3KSVlYHP4D4cLJx9?p9%H}Qtx#W6QSo}~PrKn` z(_czlp~W@xH4O;JU+=LmK461$qp*MqW9{a&QTC&t7f(aa;2DP4UJT8*;fD{H$rVDylkU<-OX5aai6 zyFK`5>S_$_L0GgR=8O6JPJ^3kdm)*U%+jH)x1JU4T5=cpI^m_z=48W{9XIQyW}jPF zlruuPu7)2u8gOf}_Z6%X6ISEop5l3qpExO0(yxkf7ZNeEMz@A>3I1B4EmRx7rV)k> zTfb0Q4^7Ox3w0x=^5XYaSv-_gc(mrnr7dV`r~sAKJ8PLkZ9gwTNz~GOBcXRe&om|7 zZcjp)$nnlg^OrkBRME#S$)!EZ7X5wQY{~j1rSqK#YQXL9>E5Hxs?@+U=!`|@dr=jy zZT;;uF1Y2W*4`b9s3Ob5EIoYtNP+>qfK*Q(qL9 z2>*J20aKh=4SS8(-Tb*Dtf8&>D3tS>4+zF_(zqio?%6vpTx*F-hjMK_K>kOp3iEEZ z_dlf_o{oFo&pv#gBqXC6nxNx38Pm}#2S-dcTv~yDV$Wz?X=o>uy14h(O5p}cd5Z)+ zU;NrHOKQcnV^tWI(PuQ)RYOJGn1dGxyIIh-^kn6WuO19dA8tMM7&oXm*_#xam~!AH za`bSR21(xczKME3XVc2wZ($mAf8z+|NSnBlpOedRyWp2mCc)vJW3T>EW4!?L^kn^I zShh^eBEMeHDCc=g08I7)SLA9%R99C^hj@Vi0sQ3VJLFCXa8~ZbjZ*M^jyWjmj9DP1 z(byNalCYqndibxn>3`|ycJHym!ou%@g3!Ef*Z9S&Z0l>Zs)y#t0IykEScJqgK>h-& zsWO2&j{NY;=#QHCuFgmK`7#GH3oxHizOkE|WgozDAexC|*&=X}yvMv~nO`Le`@*^f zK|nZM3Rz7%fa>bmx`A~FJ&4YfXLgyOGX8;gV*$s@QRuR##G z^%?u-`_I4(he#0DD>{P^jaw1A{sQESJd{4r99pYYO)H2i9NQO8X>f~cjVDuKmZ6<- zot1|qFCFCYOi@@5FIX8aa$c&zGCmN4op2!sST)77BPc0ATk^f znb^fcJ-+adFcHxZ<31-nbL&#EbO5*!DZAkp^SltQ&Hci&0)~ce=#R%k=Iv2Wa-xnW z*(e)>=uLwf@yE7aDu984o&DgUZw=ZOxZm}(TEC~;x{{lLJuCbu#l$GAqLjc@iDalf zbV#7nv41kMM~l)RRscE8j^k88;Z!ah*(+##cBG5VJ3sg;&O7Bm89q~w;4An{5BhQ; zyDKx3gXhs#dQ_1#2{OB@Q=i9F5d^n!UiX#r>urt&SkqIQM2VxFC+$ zI>pwdgX}jkzC#PCFN|s(u0nw#^rXT`GX zow}FB0$_q;z-sKqW)1#~J z(NgEJnSnMU*emCyDO|yd(V$F0mM5o_;fEkpP3fR4Gj32s{-ffDcI@-VuHuPp3GyZ) zfo`@dX6N+34R`K=%z$jX>?)}1}k$5d@Phzq4d;58LDpzv6V z#YuaAOtPc%ZI1X(i%EU69>hwsY{>`L>1^~H=hJ4PCW&$Y*RL9-4b^1rhx`PI8ibFC zi6_G$)bg|O-8diJT}e`uM1vboiuz797ABad%vJO$#7e6|$94*KFR#zsA3!q9UdZnb zEmy;1xeI0;bXM;sp_9nhP3r>#{Ra99DY{;l$0yVw&JwP*U{K8S?$H_~l6vQ8nFBX9p-t@6p@)kJKkS)M<$x6CD#6 zJGsE8fIQ&bY8IgaidjyzOxz%V3zU9`LvqL>h5N&a%FeGcNwi=W&kXrN3wDKAF~N3g ze8F;c1%2=smE1U%UL+!5wZs=03T1-ak%Q6?eZY!|u&@B@cXJx%IBTpI2Oj~*ZMF&S z8ZyHJpxhOuGmtM*;EM@Zv6oU0F9o?eFSmg9SI2FRDe4plmFir+B%>DR5aCMnq=mIx zi$#o*`5D>Sh7n?$v8e#r1l&Ijb45e|CMF;t5Kwe2SQI<%NSw_pXRH^W8-8TqdeWFP zY$hTgqtb6^Xoyw-UV&V{3`{Q#UimpAy^=Fz+6x9cAcLP9|>YOO?$ z?`TJ3hSzd|g&Mxw0TI{$W|u)~xqcpoxByG!0@An1I+z-QMS>T+S*zG7D1p_1SNTS zYvcoIk>g>fW+MDL$z!dpsw7c?`eP9O&D&j@jM2*&#l1@R(V~8fWx;@W55W2=&EPPE z$j(&9#Z+ja@gU2Ho0awGQIcprwd7Rx?$=<~Wue)n+R&jO$zp%kdiX(kWW9nz9oYRR zLhwOxvtjbC2IA%|az|q(CnwEF_2Gq-D$qgTvKBDPcPt#Kc5X|f;cL#P5#VjpE+-3h z^qUVWiIl4=0X7rsup*HwijKGqDFVn0JTT%XE&uW%Nwonv^3LLE}{dUF}iai6lY zg~E&c7rhX)iaBV7Teq)1J>Zq^i=3HV6`H!Cb)iCwMb8uS1TGJV`-V(RFD`xt@Ob{z z=6k2NZyFyTuZ;SH5kP2P;MV18(&Y&I>~ypCM@AsZ?KE+n^j^oLk0&^kr}-+HG4j5q zreHnq(+KI!XDmVH&-Ab2VUbfJy^FZftfY$7E}p1IQ^CnHpurkQRM@<;;vDhWt{e%S ztJ^=7acEld;SCSIXJMmLbY)I*eOYBtD=f3I{ms1U2W$G51PPvW6?D-ap4OriM(EhW zVp@}EedK!o0^@KEAH&uH49sVWsh(T{eU6h06?wwi`j}bRa@YM6T4x!w4Khhb6>0-P z>j$^CSUR6Tmfg`{1FT@4zWdU9`uc+|6yojMeqPe>VCj)~jLUerpN&O+S+T7OIp4+b zW~%32<$0Zw7Ojvp^7lNBnmXsc3r`6f9y0k3G$O?@R1ffjq_W~$2AE0p#=-@O`=jF7 zp^@!rc>;!WU%Msq@|L51Z?s8HPoB*PW020jfbsA)9TU+&ycZKGZ8^71gfX{O?~XSmr^BSHjv#Lm0Z5J`fU*j z7tEy~wi`>}OJQCdsGCo()9%L<4&%=lUwiJjZuV}+X&lY_Ij;d|I(l&PuOG0G`Moq3 zphtoV)oIs8VHyttTG2DwLY^zzGCd`1)QBY)Vf5G08}|eC?(X*@8?n>s4RU7#>wkAy zkS;+pt@G}jd>aIsd5)Epb(rN)!bY$vNsNJkwyjR3&Kt^t+be_>$SceH%M$?n-MlsS zT@>~X$JUz8UzUbONo*}v;r=V6l$4t|ppF#3g!R{<7i&A$~9g1Eg( zKzwOkSuJ0A9_U`KRwzVOFs{Ajtp3&GkBez3cq6$Fa?o2ei)eGF_S9?Q2Gc|Oh?pXW zAH|&!NQOUetflY?`_AWJ597&-$cc~YH|2*@kti1I>@N4AgH_VdJ%28lH!cag(o$gF zrfE*N#TWLKr*$D_obvCLP4Hh-P@=#*qx#yxbTz zPpF+=<+_!>>yYQ43t5RAk!-{3ThtNMjr;OuEeA`_+nd_@uT=QapAM9#rZysHtH{_9P-5rcZBcK*d$gRQ;{=hq^$S|>P#sF>xr=r?~}ewL|xbnStzhHPegSCBEk3HYX^Ew0=7)!0O)+c{s1T* zB#b~djvc3}d}tU*_u6}gO+y2)5z?W(Wmx}TyT>11N5iX2y>hjY{X0)NPXBmDez_}Y z)5$<-%6-gBJu~Pm<_GQ}Q+P>Dh*Z=AxBjQxTg&|K?ElZ_23?&P!~b%lQO|7*5<5#@|{&XXz z@JFMdeau3*uGFL0SfGhBXe*t#Q}M@(MLpO5?wzl96?d@rendyuxIGqZJ$CqW+ zeYgbHpG-LW*@PuTVZ#q?#)tW_@=FjzGpS&0rD=AdJ2G3anInCz|ECr37>ktLe%GAA z?PvHohoDDB@0T+AX_HLLn*Ft-0UIY#NhlorMv1i!|x&OX2@Q0oMkzD}nDl3!QVPymw zFhaZXHX8I=5nL@dHbTSijM3%rv--fmqe2zX$=F{0{~~f! zWjXwCGl8*cgrtoho=mw!Dm2WzjmAWD^wH9mD~HpGrBvp>WNXJ8aDT0DFbzi3!P-_o=6Ra}3>1 zJDYRmKMwk3-5|LyRJ9%@v6%N|yxe7s&K6u>X_H^aOAb=UmNDMp-T77%SMTbESvGJz zw7!vw$E4Kve8(rgEO_x*9X%Q7pz1bSwRcEpT&+kV4f|C$tk(3DG5HB4=Sb>6%44xb zOXVxSBWO!~AN3C((`51CfR*eH{Hy&!e|l>|;YZ#Zf$el*2iZ00wIgQux_4iWb(XbA zQ4{V%l&mypOO+ohcD73I7@(j0y!y-GR_67OJ&hS#>UDE9A+Jo|Vqsmbf?*sl;%;6PcObrxM5gc$TLPu1D|S zA1QCjzxZU7bNW5XlYD_7QEj^Y|H7~Rap!KwdfayP3sg9}?TnLZ z(8P!ffl#4`8Nlt`qqAX&Gi8bjJK^+e3Af45N=Eno0U=FAV2Nm0j~v0%h1Oc^_&!jG zO(`InWMMx@j)UN@e!IEz!7ixsf;K0ZGi)J@5jX-TL*gJN-|u5>Hag3xd0Yt7!nRC? zu4?bzUWi>Gw&keLGVug;hPh@VYGaK?m(RP%=a0xcO1TG4tDyMIqctSEcW6UyQnw z@<_Z&QAkl-zh65gqx`>(6G|M_Yt1w3Cq;8)5^$ARhc30v9N7$2Iu73YQUY%-itp z56baa6}gUh1v{n%rEeuHrcxt68ni<@F0G6bwCD9ki%s=>1hpVWDgOH`{vzBHm+2}0 z_*`6t)R*G9*8hZgJaAfsl^Qqy0$$nmzOa56bE~a%?XPim$09bhUt#y}!U0^KEtj=k zvd~O?SqHP}DDTY3kMqKF%~6!Se+wD+*w@P?7T7Ci-bJEdd*>pPGDNbPPFXDbl;rdbDkbJ| zNcEmeU&&}^`(5iK&EaC|(-+B_IK9>nFtfeH)Mm#~^OKlEmPUfAdl#jH;#Xd3WGoMb|eBC5HR2*(5~-XPM-&Qog@~SB6bXhb;&xb+naq#Dmfk z&pn??en#%Ub5=%J%~yxuD>9^MM!FH?ogI?>Efko_PdLKcF1^d)fbhrkGeQf>Z&uH! zxUxK!XYYLoW=mTopnW1X*fQAaf!*46a<=vV5ru6~-m3iQ*|{g-EerZ|_px8-*M?TL4<&Sj?_;@yfnpn=TgY(gWyyp29l6AreIZVS%+JAh_D z0uu23BrgR%*9hrj?L6JMO-iv5d}1E!65iaIq$#@{Xt>g_Qyj!*FSpmZ3bFPelIB~R z6Wm_;E)#t(31xpfFLJwg`*m8w6T_UPgtXiqT*;3>e%M}n%xo%kh+|GID9?=CVUg+L~|u=o^tmu46(;+T0KCvh!p~vA)PJ?F!76h*K$~|9@=0@m0Et~8drq66`W%$U?&Kwa$aoh0hKqo(PiZOqGQjba z@Lmqu3M-6*SF$dQQeBm;9(w+6Y51>_Iq_E%#7ph`i@c+Wh(Od`<<2;P@#1Xw#o_7u zW1P;0Iq^)tqcB$vR!Y3T{8rxO7N;VO3o;Z7CK4yfjQF?tgn$`Ax=lP4)q6?{GFK z_d{ptz3rFTh$s*rzbr~z<2!rN{=Y15{~LhC)q(idne0J#NB}rZl~&Ae!vjTmeO1*h zb}J)CM@KLkrF`C@`U}ZCfbRIhyU|hnry64ale7Q*J{xxl@+axtmy1+O`YlIC;Y#~T z47C_BbS%GmUEoXk{zacir9l7~g5nAI)&IJewlKIkw)IL;Sl#y1vB{WXGUXfUVlW_k z_#I@z0eVLFWyV(Ck{xiL(4GxITDY4H#g#)`%yo<-ISRL60u1<_{ z?%QZ4mn5=}#Z0-yBiO?164-(*sU{NuwEyY{C9+R)uAhD5h&5Zj=@=HgFs@f`+lC+1 z2N($u+iG3UsXt1Y@TLii=9;tOr$nRY$rrKBFmF zb`rlKS_`JQAO=(36<(BHS8OxXTj5zdrh+G_Ssq@Ou~dI9iX)zG=IW>`U8t_=C>$Wyx?<*ePyt658;pd zzY$b9FLA>^aqtGn4AqX?q9&q*?QS-n%a}6kiBWIeakwj9{IN$@&ly?Y7?e>|L2$Z0 zek~YX-lb`1nl{n0Wgb%8w#_5CYxgpEZlI4b?7@VU!Yfz1U@=w8jM|;45>K*^+a#m{ zYFDJvo3+J(Vm8c38J?NFm< zT2zDu6_q1ynYM_v90QYMOp;L_*D`FlJAH2QUb&j+k7*G-SJKw5+cKe|=5Q@9^>rKX zG9xe0F(bou0P|?mWp3_)Rfbh?r9BenlC)*Ivr%oFIXcRTfl(qrms@3{G67%md@R1b zHe03vr!C{8eYtF5`^lf+u7(#mJ^67O^j4y3WMRLGo10#MNhbEAW_ETK44%jqzdC#W zE>74M*+hj7W@2W>v+Tvp+#IbSQUk_B^ML0IsJ&1KjU;v)_X?OPMY+lG8rAu}J%m|qJjiEU+q@S-Ytw^CZXtH6CcEdsa19=}R!37cU|sGI#^J@wyf9H}N;TXZ6t-eRH^JgR57B`cEbkKhst9penT+zMKw zB;ixiQQ{8y*h7r$l+iYiZFWM;!omXJZG-Wd;DExQic?d7_lPSw!_$^zAGQ_DcU;1oIjrKYHgQH9VnA@=0Rf^3bVBIewR zGatHB&srR?CeKBG8_wCiL7ZvA1yoQ5NNI9)*|iGfc~a!6+1_Vl*b!;KJnP^Xsyvi_ z$x+`jm4MeUVUW(bebrV4s^Moar8i|s;rnRg=c`k^^L-OIx2 zaeP=|y=%tZ-gydHchGG6uO z{=lRR*Xx{TU8uYQ z&bPSMf9Ha3HNP1}mgn5_yGxlTzjEMZ->I-C%BDl77?sq=OYxZ~LZIDJ2T~xcb>B%l zmN~a~N$;wJXXvy#<3n#kRm<;u)bI}b$^O9-`n^qcqL4Zj1;kNdyC4^U4}zYpe2#>e z*pn-?dqoLM%LU0BdPnX_lAZ5Rx1 z!7OC2T@YgIAQ&fL&-UE}L>^b|xid)sqF)HC{o1GRPNr6-YthLAZL4ui)>v+b7+4}a~yApNRHN0*!lD?Kw&e0 zR|*P=%=AQ3MXkpTn*{nK$$^{WlL#c_DVQ*E&(LUp?2%O)17GNaxYZHBj48Z%|9)lI z$R_J0@CnqhP$l0@e-R9*C4o=)3Gz2*(`Z3yK8GH2(L+oD3bbxSboCZE2u7>xVwM^} zq(lw|gpZTs2iAo$&$kX_PXONbqboK>!}opaId@#A@eUktgPjC|j)q2ME%NQ#w^}vf zOUN>l$Q<5CXHYT-qJ8Ar;%(D>wAfFu6$5^OmfX&#v=L{xy}t$Mm%~rQ_bz)R6MTu# zc*(2P7t8l>LLM;zf?7E&QA7*B7P2$|19L=;y^xBH0q(z((eig`GPZFv;@&Ko0f?5{M#JrlVQUMTY>T92@(!WuVQVf==evw@YeHkVNlO zmgAOOLW~bR1-vF2!=}fsDc(WdqnsB%kL**9Uz~u?7{-N_JNxM5P2&qkh*P=}LiHR^ zbv9-**`;@(y;@q=Bwc=vHS2oQ(hxg|e6nI5lUeG~3OP)J?=kOkM>+ZYfiOwL&*lpD zov7$ML*nk6n;XSBgIt-P8VBk-KV?2_8YrUszx7_P-E*&tEOSeR$!+tXjXkP~Ul^Gg;2AR(myaAcV`q%Vb8^ZvTkiwT5&s z9qqK&H?@V3C1e^#`SPHd*nEY?!3y)*53*AO5Y^C@%h|D^>YJF}VC$4kemSKvi#m@- zfz+mxzJf^YBg?X(>v@)n_IXW-UhVAfVl7Qo`nEyydsGIvWlo1_O@J1EFc{hrm-N~j zw8%yWlJy%!^5%!a%~@IOY)7x=Um9$`=e-~KnAj}fa*KY{V)G3!O~kNr6t5@GNxlg; zgA2GeC+XW>Rwd{vvxK}`Im=>K1GlAWn(VsWwrDDdaWx!x;2|VobR;LTi&)f@kC}K~ zoQOi2=9H9Cs~#x+&9K!BCIX7B;W@{-iJhaOo42rquK8j`iuk&Kt|@VYmEUf!SH)%U z^+F-)I~64aTP}1LVr(PvVq>@6>>Y?3Fqre@=;5r7twg4I0BScZdc$Waf$!Tw@F>iNUvR1 zy^6N;?Y$mo#lIvl1Nhp$d0+HXGjizBx+a;q3vDmC1Y3O{DcR+;a_1eY*^gcy9R5i| z9~Q_x;JpNv+_EllgSs+r9LFOo&9Emrk0%oC5J-M`&Ub!rYL! znGDnE-5YMl1qjDMK|!zN`PTcJyb9(V`oe2zEg=I%CmMh9r#KvlQY+u;EJW}TEO!lV zvU&icsSO8r0Mt`C7Z$-0IzeNU`1(xwZ318L65ekik(HEpM+qT3AP!GXPCmkP`ryW` zYTMe|_g`FEu_A0THsaqcX$2ead3uxPWdA?Wfxy@aY=CjPl9Gb2fVd#Gd4M8xJZ9f! zThf0V&>f%H8H^em<7?+@C^J=I$;n!eWWZ1#sAjCTdm14TAz1132E@(7o6XrqghCJa z#PW}P0y0S2NcJqxLQ7s^JgCR>e_g#5XS+dpNT0Q%4R{|sx{bHvW^E7laqx%z05qW_ zbvedNbpEizpxY=XsMbLc-5u|ggsswDsvSA^u)h~pq$1(~!-yj$g;A2+o^e@=C)b_x zB6Xv%PvtfnMXgxek%K;f*uZT|qpz#oG=%jbs5jDTNU14_Zl~=A$O@u2$rHFoE; z_0Q)V=sV)_P)_wG*)^YR72Q%?*`1npY}NZppzhGpYKnNm=*9GQQo3sD-E#Ayg=5rX zH7Adv^52bezUSTCjxi)H`7g=BZJa2Ju{F+q%&A0ABIkk~mqtqU&8Q#Kt7Sd1cB+HC z*_Ln2k9DH(^1}{FcAYKexQ41b-GS%@j^tt2UN9xG-E4Tb@a>go{F7iLLv%{&x^SGw z@Ojsr=*+Uh)}x+`tK#V$VWx3!wXYENI^DH6;iQyWb`qU3;8{F&43mI63EG69qKs9N zGTL#oE2B};8UMgjOUVhHtC32_3)dz=+mQ=Xai7 zJk=%V3O}Eel6ds_6c}OrGJvFVcx4)gV9BZms3Jr@7yd>6`E3Ev$bF4eN)m6qeDwYR zNB!C?U6?6yfgJ|;LruSi3q`#MA@vnfDY;kwWJUeyg=|%oY;@8TCz_%nz`EM)%%d8q zs+Lrsl75kN121^osrfSaal`J-mlKDpQc?@ zy3(+)c{A{b9bcyYU$rg&pa;@cWMN@gUdypZy8Z%SZP4${2YL#cKW&BpF6WE0bR!`u z^`JAMrk>aEx@C)PNK>M18RDic?H~JOa2`(ic-4h76QzU;a{@h^EeA&R{$>dWJ+EXu z@aprtW_;#j@3AM)#9hUhlys+9*S`UN;B$16seb$Rn`%|YsZjIL5*!FFQrlQ;eqJ+~ zh%n9Ziy(&a2F7I#$x8Zjd$EDil4j?C$(9%~5p%z!|79KF+3HMZBN;i%XbnclhKkG2 zzVD{L^&7mMivl@c?n}}Jb zwRak=C+%w53QQJIXpwD89`6{9EYkf5SRamwEp?QKwnLKZ!D|H1bsp<9JJ@4fOmP~g zm)!|Ot5PnyMq4F7W(q}&t1$ArymqL$m)YqwCaGOU{nfV$you9Aju_R^DrNaUE{=&< zzei(KIr~y=2DON`o4&7N^((30dG68evw{^ zxMp{<<|N%X;Ad?FYu6Qiz&v!Cb@CUd8s|^G$n4vbm0zm!wkXjE`qDwC^SZ@EI{iwV zlj0ClfCDA!&Fqr7xLT`p!S=RZvFaDSm&E#0PrzYBnxV~#MWQ@-sGl}I2(`rFS&vL8XYJ2xsM78|Z=o}(D zK0j8wEi{Uoo|$2cJm6=mjEy_Aaq zdL&vz*p%ySZQDQbDdvcR{qjST<(mevtJ@oW%NfeHAwKg;dHc4DMs8$v7-&FTXa1F; ziMSRKHp_G9RWQvc(Hn^m`RH{BxBKcZ4m61M<83r7&_?>%fOvZDmmMV{QQ~*qFp5Kd zG!@uE3v?~;@{-lZH(n+LHfyYN2ZYk_#41cgb&|VKhb^W^!>WUSiB0UYp4u?o@EGTN z{>^N_##%J6_MGjSbM@_5`(egt9z0BNrHFZ59r&3OH!kMuSIeOLX50hq2+@x%NQKv< zru<6`x;}3TE`CY|e6!jG!eV|0H(d{qwTEn*`O5b%&=rSEe&llfKCf^yZQnq)B&bxR zcv3T>(IN9Wj}rGC?x6QlVc@h8*CS|ks$NaB2Q0C2b+(vwBTa33DN|v@Jkh4Jw=g0` zPS=S(ZDsd@vJjwExiwTJ)av~Ngyv8XP13ZsfkHsgwGDu39TOb%5;PW4n;QveBF<2*{;_sRNi~5Lu3)28<= zd^Hx5Cm>);B8boJ-lhGEh>fsAW!x*=958Nz@szaLSC>$~XN)wp?bgLMwYUGmr>0_N zTJxU$UD7Z(YiRTxjf(dRti3^IjsPlVKT6jiwqx77KVT=KX#d#`q!XUD{`Wr-T!~@z zt6t!0BXoOL<7(lygmxqMY0W3!S^=q%cfUrv2N(cOgM?z1we_P9*uOCpt%_RWZrHQFgkQ{k3y$9jSoysP zs3?zhXOV1__9+I5pj235{|MFzFzh!YDj4n!VOXxahIZ?ur$dD(q~1cr5@uFz3z5c1 zp>0uM>88|DzmUSbbB{o!( z3J`#mvu83C1mU?O~wlpJC%19e}b`I4=h{9P$Yd3`xVSyR4S0m%jqVd#&>CIT@HMVFmR)`b3Y59u(}|I7;lL zpN+%%Y@#DLUBeLMAy0><1=cJ)`*J&wY$B>%)(6!KRemNhL1bu?wr)fYnvacR#bU6f zI>wAPvrE>Oc2T2;n1i2!K0atLOm`TPF0qP|7JrZVCqn*He|-hatvu))=JXLs+P8)t zpW;`8PO|0pnbpp(VRiFDhy0l!v`Hz5DV;MlQ)_gV8$xWD5sfVwygY9Yb^P5f`lWIO z@{5cN{(z$6qV4wPD%n6Lpq@?Wy@zWFn?oDpv0=C?^}G-o)gDw0psP;mX%#s)(uLgC zTNCsNzN`{@YU2gV>QOZ-53&F`+f^6M-;rXC?L{=2-41je_invK%s9Ksht^F@3x$u( zQ@|-)a%Hb-e+hZT7k`GgBk1Y~rZ&`}L2qLv3cq#QWWxbKS^n-J?q<_*L%&K|-D@rT zV(N74McgH$5!X5LX)Pd^nL6WIKK?`ip0UUwF1%hG6*ztv?u@I6@bf!7r@3=OB|Jt% zc-CO$<<3I84k_Z0RfjzIDib(oZ8(>uyxGM23&4>o#X+t?4ZYR+T*xQT5~>-yy>0B$ zYyQ4afLk`s<%ne-p|POD`-!*9`Pe+eAHjv9M(Gtj;0RTp{Hum>Zctg@+QV86vZU0r;zCI)|iE(B|?In2yjc;$s;)tAhHbbWHrbR!!A;IBi<57L8T7 z8JH8!VF}JF_%*Ocb>>D328$|RI8vkhOK07I0N$8;Rp7X2Z=B0l&vQmJ&2gEv#$4e} zaLQc<&_UN*>Y{GBys-CgFVI;Cg&qaRYk7hr2WVv`=-O?Zxz^j_Q;J;a{jN*U(z>#J zDuE+7b!J+}etKg-;2NS*gDG5#P86kT(L-ctGiU-L0!(Ltw@AWQCo4pQ$A)QRC2&?$ zEtrJUq@!my{f`$`nU$9($}hgMIGwm5)FTIveWs1DC?nmH#W2`BZF)`F0r?6*z$rU_ z5M_klRRhJ_3Q+a}!XX8SDrxP-W(lC(TxRT}I2st99BJQ0R|p*fHZPwUvc!_+Y+@E6 z47q+3#H4s!41mqFley-|KsxL>)~Hh7nam7^Kpy2r=ZMYMfV^}*A^?cyLq_N!e}U+f zvtB>I|J}jQ-_=L^KY)TW#Ke98$Z!>J0qNS*6LXdz zPo7|vurYtR5V zO?FM=Gw!I|=w$#s_J->3<}q3U0iJF{LUuiqhP`MCZmHp4z`-yd9FXGwOPqWZ;QmO= zJ#Gy_ml)HqI$D`dZ{T4X^drog7UZ~Wrg5O^{B=$L7TYE;x=|&GLB-ZkCN2PJld#5aHmzziRP{_5pX(0=R@>gh0uE=(;L{~ky5R;V>F3r zqPE~-hrq12ItTvb>eJM8O>t|p)xCXgv)kJtko74Iqc>Uqk|zj0M~<<6INF>g>ZPgv zh_ax@yxdL9awA`gVEYVM-K(?CI#I4GzGhQQhoX~OKC-8|1m%7Mb-)e2_KD?v=PlI< z9pz{Sx%E?0&X!Zl)w;>v?pj&Gui>+!{osVF)VCMA41R5CY<;KE4sRE0(pMP`&+sd-yodPKpO%>rql3CYED3xEje*OM0eGb**v^qfz#vn#@gS`vGvCjEO%nU#*wo&H?-G3Hkabj zk=+AFU!N5^`9 z%yyJ>)0mqqA9o|TA3aYD|Ew=nDoG^r$4{Tc4fb(a`?Rkfn6lKq*l4IskWk@X{H9tJ zSJyu_v;SOfv|YGrfdJ9HsFf5GTCN+7m6GhBe4$t|zcgmk8R}-loNGi2W^6z4cWr21 z=twT_C5Rw=_t7R z#`#yDG^ctCg6OoIXi`UuUEnY1!Jy(^OoO(ahUxGXWAU2?xCar8I=vEk%?@dz(FAi`n#`up#kS8PK z>U1Lt{ZCXQ75Zp{F5^*c9ZvC;(P$lxFhfWx=uH9?2N2qRj^2|eL#|o5jEC{nkI6sG zw^>|sTderfQt>1W96B??D9(+obQ!y?yF!_(uN8P22SUM^V64W?is4}+d+SAY<2ZIn zg)^~6#m)wcl%Y!Bpm()dui5R!K}L684Bi7#1c0$=A(ekxBpPmOXaZEW{<5Bll`5ZSpBkpSh0w&?$h>e5Z3P-$T=VCsvxKha@m?a0y z(o_K{)DYsm^$TAIqlLP3m-C5q!yzJZ@x#Nlb8pzQGc#u^&iPJ9;&&*5H`g>Go7E6u zM&dhlEuzT_v471h)+07aL$i1NXSTH0VwK+dV;jCKH-7Y_d@WUrKNme1ccj)i#M9gR z;9ScG`I!*Q_l_XUuf#k$)`hL~S@xc(udEjlePI= zo)@@56Vt2FpF$SO)q~s_F9+hM{ttQY9oN*htqognyOphOLBR%C&?pF~G^tTkAe10o zq$$z_1*P{Wij5{jqy|KKm)=1XLArG5BE9zx$vaj8i2L66-gC?M{_~yRIe#2Uveuew z&N0V)#`8SmF?Lc{Tf1=i?YqX6?|O8b5NiK^KJGNm+*VBQmDXUH6JF^GL10{x8zne7 zCJARWVbbyxhy8%0uT;_5tq4aitm=hs@Gh-(%a~N6NWmCtztkcdU%Ta%!ETdGF-Ggc zvt%Y;n9M8WQ^LjSrn#ixuxsj)gW-(*%)-TN-}3C20&Pe6k~bZ7S$$4h=H={7v)_m6 z8^cPq_JAcS`=d+CW%x@B>o27jr$WGk7lDreo``^yZij0cFj;~y-WN?ejge!C7{ zcp4Z>@|cfAHR?Gcd>?B={lVI79Jq>H{ps$zsUCT$QPpReZv)klQ}`N7*h5CNpyl+Z z>FvB|o~o0fH&s*?KGElmFZ2b$N(E<}MXI}WG(W>?zSpH{5`2FqOPuku&kqv9=?vn- zT6$HU-djGr8QHzx2#fhSb>A~K=CCsxn*2IHW!y8H$A1_cve*Mw#3J1D@DL2>cW#?n zzAVUoX7gU;ex>fxd8TD%TANOEmG>9I44(2vx&I|4)PeRLv>r7ZJ^N{ z`3m0{<{;xi|A5T2EHFdld^cQz3bN~TqA%ZqSW7`H+6h|peH80e`O%u`_j6q~y@lI# z`6}S3mV?qUG%ORuTsnX&q51$(#5^2tQv@1jYjixI{=PczB1W2$`|6_PbvM6uMS?Hl zMaKk57W7Hn~^-PV5N zF-(q3`=wdmZI@V(AdL9rQ2p!(pb~@;AZKDW8MPWDqSTovBS4*9`L$~QRGFK#{ zRW6+{1NQ&JY782Ahy!qq6;A`YZ+{{grJ7mI^71l${`@r<2XJ%=)0C?~;6PJwQy}o#|{w#n4kX&9I42=kKSo~4&1V;NQteX5#zinLLiW+dmIqdmK z<5w%iA-v}aN5lwkO0?mAWRo|EBTJS1>7d#y!G=}J#Zz3t=i9>QrkOjzvdpKPPU&8_p^+h`Fqw+RA7f@ z#-Z%%ONV7G(`({h=2|bEnbrJeEWem7cUQ4JHiy*^&26dGP|TpXy+|E3vB&fZV#q{( zM_+@TB@3)0D-PxeHdj}nykuq@zU;Smnr?c+}zFE!y*}ipBnM+ z&+p9&seCcW_E{h{8~;Gv*Z68&dcs|&_^>F0GiZH%WxmO5~E5K!=b<(HT{3?t0A_O8cWz^)4!m<35^Z{R2{9|vNk+^MnsX;M*(bpoM!v@yJ%UTI}Tb-jm{MON>AAGpHQT2rl+| z2zxB)Eq+@pjqAy_q7CSJG9t}%g8?K?2CdZ`oVnrOgOW%4H4UP3aki+qeJ>qiqumeI zFEiF(c{-=mbn1pNgJK1|#bSY%?x!ywTAMeQv*+?u&vnxB)v9)7;eSOiunVM2tjoaT zH&e5u!S(N|SzA)O-$P{{J`UlQxR^j{KD%kl`kw|Jv066PYL=eQ(J!cF*8T1I#${irur(jkWIG8L1*o6LMzj?+xIYXQC~_xayjyQdc)vvwNzTTP=^1jON(8D zAt=8y4e!P%vlR+^hp1HBf#M>?_&WIx1bTYDWU?I`54FA_5y|kd6Jb zwT~CsT3l#KR1NA*2TShSKe$}6jz=KCy77bMWE*R!a(iI&(qOE^pW%jmkXJJZqqzln zQ~({C+RpWy@=;{#rI{?L8F?JTxATm8myl*3hm1o`%DupAKo225`C8iCZf7|-@!7Nh zFw*Lr*~+>KRqH9WEs)S6k1r9#P$AN?)9KR!NDi|4+`UbMh&_SUqK~usnZE*gJ50t^ zH&_TV{m)G=jq{|K!)$Z(#s~Ym5yL5s$5yLXiV%f-H>{^6AxCI`fRU~4Znn3KZynFf zGNl^{X@6V zZA|HM>QXy3H3ozE1m1v<0({CK)|1DUoJ@bn$yxr?1o`X8OIdGcgB*X0;Oh=^Y&NM; z-n|_%Jw^^@WrEq4{#v~~{7=Lqg|9D}>Bz-)RVM5t+7`U!hs(sHee0g%OULqNDg~#C zrt4aB7T7k!#suT(*I{PyW~W^vsWygxT4^0FI+^G!z_KF;`!jKZCHWHC5uPODGrqiS zbuIS`q`mf7&V60(ZLLEsoCF>!*zZwZH}jLbDp z-Z7n1z;pyRNZ1pPg0%LH@EJd+Sr;sp^dr^x$JMe>OE~}W2%Ntks0>LRdDTr@!x5wp zT>j~w+l~bJz2S@C=oxM6lIeWEaT>G?FS|ZL*^bNPy!6{z91+pm&RcaFNMV$pfP^>Y zzOAhQr*Q7rTyg=%8`Eev_jR~FF$xhTyKFJ1EIjgLrUBcu`ovcGgsID6(-m-{$rR-8 z5qbg&8%S#?_k7vU=_$DDyUJALP0rTwYV0ID^NnX1^X0d5U=iTU&dj{KVHHJSl3z!{ z+*VHR%3rD7*Z4Ne8cv}ub4S!GvF(e@`MJ6G0|noKl`s-*YEY8NuT!8R;^pNv5!D3c zlHl@r2y=IXIs)W_W4&Q8;|_BU3x zwziY}dbqkw#r2seV*tH7ayttPqvyIN!HQ~Y(pvOF(%kQqmj{-GVBC0*awim*Mjpyk zhC~r?b?E&<4uc3J_-HlckQ3OCYf%x&ZEuB;M~Pzi2$?n|NdA5qKr$Dn1|z!UlmF^6 zq7%;2acBXpH8QxXH0$Oi>gSbG!ZVA1ea`UF>j)@y!TNOY=&j!;I3w~uu#+GyA3QbD zv^02@0&}jVk?UaQ8wU(Gwf<8q+3bgm*Zj&{SK*`8q_ku~?X=+8{kyLzU5ML5!C%&X zEtPZ0^vm-wPwrHk$QsIF+Y<7Qtvfiqm4Sgk|<<}!%{GduI999re!Dn>b8W#>z zxrQmZseg6%o%urSvdMk(+m$t{+9w>;prM2vxdvL7diWDMh|A(~LVCy5S{2%X(Ei5G zFW+n*804;`sq?wlEk5&3vN7B^0v4=NMzRHt{ zkSOCg2Uf8;!o4Foj9?RhU|f{J?UpgcEsPp637Rg3Af`Ed-bD$u7=zLJ;|JpFRW`7eD7!`TSGPlj7E?lydLaEH98cm{W6z*{Hzl3pHPpicBQC{f6 z5g9%;7E-Qi=j+8RQIulZMB`JVnyAo-8aXo>_*KwJP_n_-;2gsbE9%!9C#NeLpZ5tU z521)nfkcrr4msV}IH=@oW)-)iWF1#g=dl~#CjX0HVBKmOTH$Wwx`|!7JG{c!AM8y2 zmlFse1pbFFDIyBCmI>XlnB>L1zUoXXE^ro{0i@=XK-zdUgd?`8^38ybQNo`N<(x00 zng5VD8EScIH?~}=v9jxVA0T0a1{ST7s#E*6NUsHWX-crvLFp}FWyR0<8|Ro+NVbHv zSeDc7fFmC{ow9f2qQ-o0Z=XH>vP^t{Ks(k;%vp@G=HHk_9NQspI>vNSm?6N-x2^)N z_D6g#Qt{>731;Jz8{_tKN<#{s(_v~4ige`ommJXk1Row57O3S=Ht`$)NRpvYcQ9xc zn^-WA=G-gNc^h2Y&NHcZ)SaD9sLwb4ysL&6@{rUNyB5LJU;8YQY6M@uh_k+MvD%{k z$j!5^Y&KB}7ZuFqD<;y?v&6Je4>3C`)*c$!)mlNZm>)D)%G>6az#bza$IWRGJlJrP zc9c1o^UXmHa2{{kX0SGKpoa(KBW$aC zi(VluZOllOb6-T(WKc_*#5MIBuclwCxKLg1wvp43{UWWu2UeotR(18+Y+LAI#P7*Y zps(zG>z&)ZRf`hH2T3#j{Y{CDML7fE^sG9xs^^G>7M{7=W6X!KJM&ZN=S~}xO?sFO z2m*pr)mOo>6KNZUY#P%C&ztDz>rDaD*kNbQezDA=Byz6VF+F|SXGj!)Fx+z@qa#P` zF26Bmv#@_OSYG*uYT&)lQ_-mlQJ;*td*)z?a(o*=8?B&`uaGQs7_2 z8X-2&8=mzlWR!d8j2H#0bs%E6vdeb<%2_~E5NYH>wEU0jf& z4F_i;Vq>cQj&3!3KxX&;~>yj&pct$dY%)uAMxeQn$Yyu_6tgX7A~B-L=TAzV6^14 z3-G{WJ0M|IE)LI{PUyTKU0!A^(~5VdZ5*-!5Yk7xx>;SpAXN?z`1*HB+(ABIZuL5AfS9nNg~H?uWtGEkFkU2fo(A9pamw>x^FiZ ztfvAH6t}EJ+M7U9*}Rsr#J$HuFOJoeMG44#k0_65CKm%c!Rk}+M=6@oKu?d=+=GRG z2Xr}DOl~BYPH_#h^&*LD3C*~R%dr0z(hiX?q&$4h)E^6mMf7T z2w2(U)tu%iav=ZreAhG5}Xs3UZq9aw(_FDD8@1}-Q|e&OvqKGG@Ek;TGm~u^(zI7Mj(Cob@5MV zQs5Wy&r5@?RKEp zrOj+reBU$0*cAir)suMWNG9)nMk%p`^i&cYKN zjgGw(rG54EKF7cpdz{C=tJK<|6dP=5+4hqh@%z~m#Wc9%m|S?3PFYMqKJn`vvfF={ zEh~^YuKdj6oUychb3NGYPjqP3O5f7CIy@8l9XmM}k}w^Kd54e9U7!VzE$Mm>WuxfU z^d9V_D1#>yj&eU-MQvW60|YNm92(OjQi0vcA993t;&!Jc<^lf65QaOV*CQQwu2Xg> zo6BqCdri(t!z=JpW!^Hsbn--wS5Ml9@Dl9g;W8|(p|Vm`|32pdW>R8o_<8xUuTRA8 z&fWS{tB^PXz9+vPLeG3^hS}>+V(RfFt(Wz?96Wq>)y+4_j%{&CwNFIr>AclsGq8^o z&pC5Mj`xeXC$9sGuj|Ul$_%%=;Nvnh%VkM}H~>GQLh6Ez^2v`X5e(|L ztARiS$=Ybhxg^X^e&^M!jSL>bS~6>>YhC{HM@_M0*~YcI$--qdUeG*ZSUb~D-6~#- z2%EpJolf@BMT0mwlxHxB8nJ*Vfr|(^jq5OC0 zbwp7Jb|19m8OCn){JwDCbPcaSR(A4gmb*SH^$@`Ae>z@oTe19r%CHDc>mdldl*n)6 zeKHk4357)yqXLpmFfQ)FS52ILB4k*`_myn@T3sf9?(pkfNa~}aoH1~ssh%;D`}zCt zEZE3pnA0sbmbW}GVBu{VqJC~*9Im9)o|AojJpHdccH^A1EX{;B$RT5W0jrpxgA~|( zCbNwVqS^O3Z8@EhO4RkjzREN>Y4F?9=!TWOWO^2=ZXY=>`Q+4-HPQu$x{uUUM zpCUbk&~~-l@*((G(pjvuAv8ZE{SkC1m>%R}zal7%vpQd@K#6v>o7#G;CJ}p3Xz^rj-!g^o^@3K)@)dKFLMJ!OT!l#5`U}*v#}Oa;+xz@!&r3eo{O`VUIzr(^gxavS z2lSs!zz5o!4nmdjK+%^Y{G1rnW(=8BZcz;-@uCRbgGFu2)-&>eysjcp|5NnzKRf&Y z|6vW2jlP2zR4ZQMMVz3mjUEx+Qw|72*qiF=gv{9jaUKD|3l_vl=2{`shgK$qoPpU3 z)p1Dq{OM*OCy-AQ*;r^)FjZL~)=?s~)LRGH()8BzZ9E-97na5%OyJZM-;seBg#H7( z37Dg&tJ>X@WBTBMux^&!B34@cU-?Ey`^3_27)z;S5Zn1gFSb96^)+x5B z3UA~B;~K$rF{aWC*rgEKMGr-yf9q5RYd%w03ghK+Y>_%kvBA zCIy*krl!H;AE0Hek9)ka0jxj^yN*Btup87F5B8yPS2iN3fgTfW3wv4tuq~p?RbV+1 zofXw<)uMX)Dyly4#8!FB(bn@aZ0ngULP&sa0TUX!$KeEEL^&5_uAhs-XNS@JLVWn| z+Z(?@j`j;s1o?}A{ayNYvz8#%!Tue2<6?U94zUVy#wA{mhOiE;a1-ZSo+n}Qog(z^ zo98#TXB(TL2id`jSB4basI+H+q^c1$niQb=?eKi|E_TbN;=g03(>P`|$Nf00-uU^O z8$loi>H-jFf8DDUxsw=psaVZc_yV#TRV~zwi(@}~%_h>K;c7fek?xA^H`-?R!DEE8 z(Y7M)VV+;}mYhCKzUS?gjTKATeKAEN;zmYTsbwPr-4R?dg{Oe@DM6l#Oj3|pPU|9t z`CHdYbG)?;TQ={xpYg3HU>^HQjYgK)nxLK{|!0umr8G40lZH`uq-hoB;0=?C=fPBySro?2(CuUyd$4D&J4Tehm{7!FM z*Jz;Jo?G|X+E(fCb1f`~64L{7lu8SDSc#%~4|AxOY3DxKGPrg$g|jRVl+~d$|0MaI z*r`^!_NN>p3Px~rExpsOLOq5u^A$te%>2>5wWru@#Y#Y>+`H?{_jgIT^*8DXDb)0@ zhZjaYnmi@~{s}I_iAc&~c;YjI-4L4^niy#?(Xn7qhv{Lxq??$9mx_v9shhX+L=Ut$2RP|Q~i1;o#Ns8QDz*P+b#OZ6f8(ybe2w_`q7PWx1NC!(U+Hh z&b!TER+>*|(A?8)zt=@#8|#v+|G>0tSBLso@t#B6orZ!oOXKI~xBo4eQh8P&wEPcU z<4h4L6p#fEOX;H+eBjBcogDvpo@=ujs+f6d%X&e5eAFkTX>O@$xG-fyO#|WZr0v#} zGeOVrmn@peChVfee_LC(Nadmh^dddgQMn1DpENlha+>pF+V&B}sBE-}Q|`56xUVSu zw|%S29H>U(pOD5IyJZ}vdfZ5=5>hm#Kjx?BfljvvTqY>kF)){2zXs;5yP~KIxuv_SzeX5N@}t>ex+hp`FXmq)Oa<;s&=E^&0^ZU+#D8X& z{vpb>z;i|EEZtaZCcdgqFW&x~Ft`68pXoLG(ZT1%@z)w69vay%znlxTVlxaxy)&mg z%-|)|j3>|WGTarxPWR_%I(rM@y8WMUlW)gh8y{1Jkk>u!5 zcq_eLpiWiPEoV{oIIF6V&#lCq34qsc+4H)-!OH1ePu~?_S@Vg5l;+f?U>rBQn4Yh8 zPEumw;mwxhnnBAH`N46xYCnH2#3P&)D?L>`jh*4n`)=z#fNv_x0IFcTe;CAFj}>r)xG}5*W9~PxA<*x z;|P0eFzq{*R6C*%Z#SdtX($jW zha%_WL)PY2Cok?u<+G2_&C0?r%dXtsCUNqFNbuj&SM6>*Ew1$I6^Ke|_t%e_rw@pI z@KR_p`tHiDoWu)>&SFZ;K}#NMr!Ld z#?vO{BX-nn&~b-6gUqfQ5Y;!4R=C@!ltc?PWT5W|4!tPh?nlL6((I28-c{P7z+l}I zUTUujBK*2z3zlQ;)RHv(7=qgh-hA9C_-$(bN)Ja&RX?|JbnCa)+5JkK{aa;O%he51 z9WlE|hW6W6@`*cf(hCiffkUH8Z8tPJ3N5wA&~|4VENKMapqBMTKZMb##NHg;yaqZv zk*mcxu-6TTzT+%Czn6*5!JCSgFC$RF)PT`?X*(@rYM!J#<`Qba=FhypD*GImd=5|V zKws1;ZqrUkw^Y(o-mkQ8zQubiwt@GB%j6Z6?D4$6Min&F_0k`T=_fSuzM(I5j|y07 z=x``IY{)rgX#3=1&xu-*J>gu*&QLp{z$y%N6@<{5V_&z$Y-Ksv8Fx0_iCfyjv*U(^ z-;L}fiE9xzpqIM44!5hXjTob#MD}*t!0=c1EyL%)oZR_|X|g#?{*Vz)8)(o`n`QYV z|AwA2ondO$6&+`vk+{QP3wOs=PUCQXOU8+mbXkLr;-%7jsW9UmjMwhp8%cRPPOKNY zvWK28Rs(2W8}!f?|s_b zmpZIA$($)3X;wr&Tkn>rf@b$cV}A|(l(_iPhuv3WEHs)kk-uUIHS>eIqW#=x_}9ft z1a+0z`oY~^Y+7k^{R~0LY4I9eXU2{?z>7Ix-#?zz)RAdCkZr^J41Gc|cvN`^Mcahy zK6l(%2n55cvvp9Q#0JOWCoN?uy zYz9ZPeVhEvO=tW{cMlHpjQ&}_c#GBWL`6qudMs~iUGbaP=YK}-x-!QlQv73rsm0;q zP*Jp)%*nNAa5-v}0xS5nkB0W&ZC2(}Uea8Mj>i|aD`XZZYiQ~z>ogQRO^>vG^Q=9A zu*XJPe`#{};HXlE%*!Le&6Sa*Z^oZEdB-kU$BM~);`gMwIL#zwHM|7Zf9XlA{4VtKe zhVWLgO)CC0Aw#enZvGuCYB|c}d-P$jqk0ugk9P``T@0u~u z8Ct#~z35m}I+-`Ee#Jes?qbrR7^q6D-ouua*hz~R^WMM#CSGl zdt~eNTxHd6C3EGWz4dVhC7Sogm=}e(Yz|P2O|y021ZQpCwEP&1#i0!$oOGr3;Dpco z`AR}%zItyby=X<@$PwBzg58~GPChgw-V`lY|msxqPx!3vFBD04$W$e zI>&xoh<~2{q=l|lOex!ko7i~F+*!0Oa#XSDbeei>@nl__VFlsFcI7-ilk#fgV`9p^exBQZWU;k6%b115`}GNp=I?0~J${yZ_2<%wG5Z2UrpV zbH;xGOA=WgOzsV47%qxZA*lrTHSm`lChZdD z7U4L%5&3~pB}SG;wP75Xw{5OloMASslXw}m5eQ~r23U83D)`QRmz_tKY8yZmlknFz zg0?Xo3yR#LKGZ=8is!#THu1?BW<{R*u@~FMlDt@>mp7lnC94&5%hu~QEEzgo8HC=d z3Xcc83|Qy`m^UV#W`B=m|7Y*--^MFSVEYBhQKr`hunZ}^gX!-tuxq@PRNz3S^{44#3V6ynl(60s(+IF!1Ka zzjt>|$pfks!{j(niP+t98cXd_^YtO*lRLYjf1?Jy27ybJW?<_Qi_@EMJ}Z;K!S8iN zMbE719)l$1HJOih0wAMy%^QLjE;0nz`|hi-bT8lS+AV&PYpn(j6~5-#zIqv%9Di!W z2)IZxEar}U&gSQ*Hn5;<0g>i#cR@Q?v6FG7RZbNcUu@)56$@nAM122YR;ExD`~@Ll zuUxaN{L)zhd`+LeU-**-7xn$qbj~m=Kd!boh17&o0SD1{_yCFOB#4_R^?u}YQk7~gxRjU7pDM(%M38ox-SFRh~c4;?r^npS(4dpVIx(_U7ULT*m?iO+DNol;C zjnDv0W$2#w51{3?x%o`Lfcgr({up;UJBy&YfJ>nQ&F>t+-b!nIePy10N@%09Ak< zIJ% zqnzB0d{O%&omb1-@#tX4xh!Tx*^Ux@{RM_G=5iC(NhbkbKl6a?_1W1 zX9+U_)LYleP8SiAcq76H%IJf@?6pYnIWEtkN%UON_b&4hSk#$K*2i}MagH)sfd|vQ z&-qKq!5QOm!KGd@5fD+Wp)0%Nb&HMdKjr7SzFk{^XDdW%AUKq#?zzx(p2NrHj)R3s zFD!uK_7VV0%${B7I?*3&F3|xB4Y80&E6n4nk%F zR6q@K*_>~!_!V`s#G(e;bKba=YL)A??A)8p~Cx-Y@wxMVSF8 z4D>|(jj2cD(-l(|R&xbc#IDd*%KRId4K$sz-K((4j0ovw=j(jpH?4tAt@h^FS+2~3 zUC2HP8cs4T3|LO70)tv|i6kpCA;O#a-)~K>B_tl@q^cK;tH{|E5pIId&3h0zt81Xs zQ;|)*4OjMKXtKyKW@$zO1F03F*QVU?a(CRdv0`(F*?6Sc>8BvxZU^BgwR1g|9d!!o zr+03<{=jghf`zcpv|a*w3;g1_sqZ0HHISAb^efa==I{!hO2IET1+gxs*46dl!7q?I zSXbc8^qJGazg=v4WuOa%nA#!MZ1_y_zmm|bvnct+A@TpOBs6O;f}GI&Clo$NXvmeWHG(7g zqy}B+{%2gmLxiun_BubwFyVRn1UKA=2er#->(lveIz$El7=aZJ72Ie4ujq< z>E~d$Eh1$N8Vj2vieD}PJzRwWx_t@*OY zs}X;Pbz&hx6@*HIC1>UsWAJM^9`N$=@+bTQxZZ&j&p?qnKG=;guOIoQlqVZky2xmv zyw>4$q%5Wic1v8IOTA^L1=ik}w&jG{TGKI{exNM4eE!-WTA=n13Dk?u)RiGW9N5oaVf+XvmliDzWIB1Mbb=voSJpyJ{}1G7W*WwU%WeOhZl( zd625jG^Gr}@j2XgoHbbX?^a=DvOSNc1HZIn(9eGG$y!w!{Ig1ixQVz4Ib3WDk}_z; zfZ$c}7~6D$R}uSDUR4k(+5!Qxl&(5L{Yvb%MA1XzGKz&u;Tj3@1mi{9n2H5&Jn!znfF0PxGlWG# zXuBab(UeE1mlGp2pXU!U`t@uMD3CnUAJIF1xJJMKR-72;ELwkFTU|7IcWg=(gnG^p z+J7c>z|_C4D|oRi++1N%foSVM+9J2Gi+iT()HNd8qpzyQ!3sNZ-vsQZ$`9Adn@;`X z+qR-bwm*$K27jKH-x1=c?6UlNr@dCxrP{tZ=s{7Sd~0l-rrBVEku|PNgHkPo1(*k(wRp|6qSMM9;NIzt)smi#E_gfPu0RaU(2F(+dw!O zzCQYK;*4->TWT_BB{%{qK+}HK&J3ninV|J0)3qA1RKMND?nll9re#E1o&AM>&_N zQ3i|Ce_QK9dcSLgQj%6c2}Et*XvD9*M!`YMSN<=ug8xn;($D;_s24Dfgp|BIVNXTe z?OhLa?tPl+;0Y(^brihrJ@5Q!Rn2t<`ZUe z7fjb`JWkQ7zEA&AMe_7nz7Yk-nDKm#eofXRlZ{L_&kCuPtNPamp5ncevk|!wg=Wj5 z>QXGTOz!a!cpAjEWsT_p#U=@@x|z@iLqL!AP4BEzFiL8q-(BA>6&IUhZ5jN-_@JG7 zyA@R3HO|~!%fb-ukw@Ye$GNV>_G%|!9pA6)pON{GGn940$_b8~^dkXJn*$)N`4QlP_||0XvO&*v{ao#too_uG7VK z|Ll;N6jQ{GU?)$U`SV>v0!k%BNkZ!6h5_h5nn(zJh5C~r=9a>yrl7Rl=AJm6)BVi0 z$=CS?5c)9lOtQpA4$@^$K=G5J9K_CAdB>^A_Ut*g;NP?JlzTK!ayz^SxpatvJEam7 z1@EY$8>FOdI7U-M|dO6Jeca#0tY7ry@C!V8snql*HGh?eZvo`oE* z_3R905i1DO`<8Blp}?orJ&*3~Q8y}RKYHOgT?m_EZaAv1!kLd4wux))zze<;_rdA~ z>|3ZSlhg$|u?9zkv;@`;;p_MZ*`VV74OLYEfj8t222-G1SM@)Q)cZB5+dWy2>|`6{ ziPn&}=g5tLVDue#d4v=^_vK-Je5|l@_f2|anEtu1%Sgqh@#SaR4WTQ;e*|rP0mm8| zRu)S~-JR@*xU&Mg#pJB3qnT#h0==XgArbplu&*_SxMZI#3^2^$65R^p9e=MnR{T6c|VsIHYuAW>(ulDv!Q_n zbl@|uh$<4WZ{t~>Gx|-(iQ*XYtTT`-H)z|JGn3{|yCke`xr@ZeyFOD9w61F`yFREtA|%Va zJ>y)eNncg(?@4hBC~vmM_kwi@eZa$mhH~Ror>r5(;_Rw@xgzl{eQlY6QtXJ6tC{?05S;ll`FRwPRN*&qP|2BnI}rgTKj#$+dHNm)Rx@Z&Xqm-f1#ZG7gHQSP{6=?IhgyS>u~>feydm7*qwest_IXBMwt;c-|N8$gMIm_NQ3~8iih-_>5$0=cG{R*9G-*ni^%bN$E z-gl`WZiY9;Os-s!Rd!>U%hhh#yXp!4x<62|>V~ugN`h80-)l-r+Y4jv4{OpIq~S$^ z9BB{?VV$Q;HC8-BXcW$HSW4#6BZlZ?BH{qjXI^zqZXkjUrWm!*#BLc{E#t;~3uXK%}&r#q1y9E<%<@hae zr|7oVD|d&kqZX8(IbxG|slD)dj}+=La_E?iwIylsLDZ=Q8&4MhLCZo%%cj!(io{L$ ze3kfHlaU6TLo2DDj+w`FV4^=xOK^KpV?8&foPMwCWL)OjelGzcKPdW-Dj@lT|0o1< z9g7M&@Q>QJzK9(9{6EV{PeUEFkb))uHw(G%qXMIu0S6nXKG~x^nK+DTH zt6$e!QJSFLDhOvM+)5+vKHa9xP&~ajl>RE{z>gB`3+}>;kt&<0K==JKwgb6PpA)@? z)no~(V#`sagueQ9aO5g1-rr?DxZ>HGI{`34wUxQ?b(=eFdv7H5M@IMU_g=tS_pRIhXi%oi*< z=XMIu&;q7!`43*&toctN*MJdB9sBNj)jb`PqcE+N?FbmI=wDk1Ri0(R^M2~<}ke%>2@6xa+D;n5a~;}CEf zC{`Xvf!470m%8CK0k*&UM)&TFPZDp(J~r?|0CM{Yz2oSFQrR>^jiN8HTMdgl>gX?FgXxV@V|2uWeX zoEpZ0b@6DzO-&(|t1No0h1idsZ9GE3*iv`JW^vbanS5D`5WFK(??k;$dQ_bup)iQ` zvG)3)3=D)8hOc1dY$I3Lh7C}BOE1k!nAIkQ_Fh=2+3*V?m*(3^Yi^q5o?H*`u& zEp5Rpwi;i1loh~fQIH=QQdCAyy6|i<>pQNs{r(5xBww^w=!<(wdD%FpB2AUys%?Z& zrraE9eKXXy?Yc}-70<`h&VqT6`%hyv>#ITqj0Q}%?NDEYS}PrlbnUH4gAG2$$x-)z z=2zI@tx#Z-rfD#noYr-3Il%8V9X7JJ!}7Z>C|W8RwH)Xnp-L-z@oRVgVcA!bfR6ayx;Z zRQ()Tu{HO+@3^4>w!co};83dyK6-Gu{HCZY`G59E{oAHN8Pnv^8V%GJdwxDmw12-=+ zfw>;qR|cud5fsK+VtK)YAMqV*glG%?7dn@i*LYq}D=legc^!llw2s%%32_P#dGLeG z!UemaPxe~82_5zQ`XyLjX1a8EzC|h;KTpN`V~r>X`pc}l(BrMaH2JeJrw8^YZ7bpg zN6wT$4}1Qu?^XVnG7q*MT6;)xq-q`u1se|zFhR3(JUqU}qJu)c)J<6Vzk*)V`b|J$ zRy&3z+g@DsEAvgX;D70iSZyG7boK5_Xo*lf*r%Kd?{`EaY$SBPpNLdJ_dd; zG|(Tz|Ka%^FDRk<8tU>E_ETiXJ+k(7S`hvpVg%S93bNRKYiRcwO*WSU#q771-o8F2 z>+Ze3eIX6ZGz0j}OV4gPO>T$+I@{pq)|5Tx7MTr({EIT;d5JjS!G9_)Y@%2tgQ7Nf z5L}OB&?_k_oBpO)ZZ2h@2u|EtSvJ#z0OA6t zi}S%!7kV({q^381_;A8Qj8O$leabe0c45N~B!wqThk++#n`H+#HN_zgkrGl~lrOBl zhg;!rwDD~}BfKf=L44_mhk4%}Twj^UMi)I#fxn~3he%Xm4z0N4YUz;dAX#e*}o;37xabK0})-PgR>oFe2xB1flZcd788Zk~D ziK@leo!z0oe{H^rB&-^b)SK#8vp*}`ay+Lc994rUNPhqjVXlJ7^!?F>LUS72Fx~gf zYm0)4|4acU1K%u+73=6VlCHr1Om6uI`p?zL^x{o36TKni0d53E z?2)7y-toyV`G1Avv4cgE<>6TOd%ZGY*yH|QW22g^lge~UrWIzM%|Ja*ZkJ%q6~6f6 z$5F#0GD97@dKncxjIbTp4IMt5*)>TakUh2u}9I zaW!q}=crz_c>bf4XMz?t%Q9Rth_x&}PAh1nov!$@m%Mwp=Zy6#JELbm*AIo>9I8*5 zxnIPPqtfd1lI(>@wlRA|x0WXKb_=WIlhge9#Tr&)nQaj%>b~=aj4ag4ljrmn)3%7X z;}RokxDpB4_q*Jit+kaK-p{bjdz-R!RK}ah#XV{CA1NxdcRT!X_u8A;Em7Q;p-2^} zV8D7bXX5bj@3CN*e;y+L^E{_-A;XI^p=}!x-2QiFW^xOy38f#KlTsgzpHetC$nJ&R z$?ym#{guUQGBVpIeanh^Juo*mU)`P5gl%4+jMm2U%H_5iOpoP@<%z1f!9q=yyFWkH zy&QN%w^hV-<^~b>A>5QXM-{i+d`{IyzWvIFuyj%T`we39GD7+fWX1YqyV+;>qehH5 zdw*E|4tQq4DYN}|y6Zpl{eOWz_Mbzb-R3nx?C$6eG^Dh;R@!f%&`)lZF+w*+^>(}3 zO%089P{-sy*wjp>Rc_t{#uErZ^!G*=z?wxsGH?U;X`zg%WS0X9rP4hbW>!&LiZpBE-y^!Zthn? z!VM3EQpAHu z1OHGY$p%e{W~wmP;>Wk9)WO`YqxDl)P%}AIXwowHsLBX0bayOQbO?g$GZk$XG}wG2 zyu;UtCo~BkJ3l@Y3KEi}$4~A;^BJQMJX9mD!hwk2XLh*Bbh=+QneMyd`h{n)7YxDi zMAgtjXL+mY%qy0R(5ooxE2t7Puz3dO)FF*?h)JNcv$HPS2Y6O+E&d9`qV4SOwbYu){TqU%A{WC1|Uc?TAaT3qF zy|Nr4_F4&^%X`l;- zxDIMzOvv|4gp~F2&X?_VYN!ELq25sdJ%e4b7w+$iec5D+->wwT&gr#%gb4Rh42~^u zFb7Lq{kNO9ug!&H=5TT}>}TehhLb#Lz8K8|P4w3O2v!$9S4?R-yzIM;4imt06H zLajOPsIuwTpEOW}jB~wVG;oa8B%K#S1!K%;)F6F>yoc=B@<;$_0hfOt5{k8d-}FxM z8|DGI&Dxf4clwz#$acY-k;(<~&G-0C(+Bu>u)}>p;IaXB6+JvLgasksmr%pvf{?*@ z1y!&O9t-*}xCi5ZY#|4|cg6qaXX|~jH=!R2Aju0;wEeqb=Z0Fbsc9|vDJQ%mfA8N~ z!8+xJxxMn>*WrEESUM!B#UggLW>jtssx2hso51Rl7t z&CPz+#7A5ql#2+18u2NJ3w4Vkmax*>^t8g4^uV)9@3{#R2b;g%UU4?c0}q%&HO7%1 z1DG=~GY$tl0v@bK!N49PhkJpNM+ua%3afGh6K(KZXew!9%Hg36umoSJYU4u)A|296|pGI&o+mfJ}q|JW_R7TwMI<^%4}#kD=3-${l6ru7Uo~<~jH^>qYgW zimM|;Ha(|6Jlph|c1xL~7Q9UzA)qQApR({dyVqSj;s2BGX{)i8liop zTqgHTzIuUavN07yetP&aTcoj=vHWnAc@{!+RXa6g?|f;IGR+1P=@Z1TuLS~ecBvsj zKjNz~UKSHqLhXi#YSrBygI?Fg!I&l|Ax_v%=?EM+N_lMxF#g+!-e zF6mnwmzPS*dEtVVgXALx%1fz}FGjl{^jsN+k^X!(l?43zy5$DG>ayWyGSRA~t}3D8D(IFg z!RG;`W2HSz>S$jmYvLvmM)_a-M!rHp(|H3E1Y7o=k@F;wtmmsLrX4Gxu*5 z-0_Yk*pzuPm;{Kx|S*ZBl>ndt{+(+K?U^L80W;g9%D%?0>P&-MgT z**`*UPI-db{1=npj>SzfTlBZfY&jqdH?}#D>f7!>s&jV#-US$JYO1TN+mHD{Riv0xVcf#ve1f1XwQ7ZBUul}vREs&~f3;9ltzlh%=xbBbSU(*uL`^+1wLJ1bTkMBzeV0nqN|O4%!`OVQ+<}&<@mkVfd3Mh(r>Ar_ z^e4Y!eR)wp;69Fb)G|BsB4yrr*DzXp23(8FZ|sxmwApZ;|>o9=Z3vcmH|&`*!C0CYkKDX4b6rTfe>c%uq+* zu5pe2kmBv|CLtB6nmf|^o*0`)-^q5vbY3_Wt{SI+@&=`fcb~JhA8wep>K;O4;MGsp zT){#v!?VAX-=1@q0P!8TIu;eB#7p1nY&^$Y4)RNv3zxHSqmIrJ;-tbEuSpK32+Yg5 zcm>I~kG=?7SgPH)5YWOHVpW#r-tM2`s#Nq;pZihUu8pv0)*COxA&!bb-lj7x>1xTakI<&yZBrM zNG#TeZmmHviX<0$kw7b}w>&akCf7$G~*7QISN~pC#B(^A>-qGx9n)^Em z7(pbN&VW*-g8fF2_%@SNQM8y~YEhN6TR)XOhYlhx$e!JBL>9qFFynT+jZvch^NF^x zB*m$wia$wCn-vIR&1U!Bll5FuQ>0LE!**4zgON#p@JfqI za^BSrcUzuBDQ?7%m`cikVw>IhR#z1?mDbCZ1?Hd;+U_mQ&G}bvj8r>fQc6>pJ$$C*YMkXbj?PaR0e&#Z$`4OHJW39Feu_6+n!6r-ImDPIyLo zqE~MvSL5uBu6)7qP*E*xnk%L9z*HBPjI4(#r0OnPAuWBO}_}}ba`j%$nFGo&f{DWobV2aI-S_vKK0iNcaxrf&jE&T|NTK_|^f6E2{90r7zs(Y^m)E)N|`C24#Gkb1%Ha7h=y? z1;gD9>CUqtX1i0O4Jca8ee-*`Dn3&s>x`A+!pZ6SB(Zw9gGbrukKC3F95oA8hO~xo z-%pNqx6LD)wS^sA)A1C)wFy5t;)da&__E{f&_N;1=@N|HVzx)O@f6=HcD^A!kukLz zZLMWiOeNud@a1~zqmBo?y|tc~EMR#qTfo9Tfd&uRnRH}RzoLtd^{az$1*&E0T|4j& zc4TVMUb#YMk+QGxu8144`I;m)xUXX z5PqfQ&vsjA&0>+*^4C2{AZL?~iek-x71YwOP5$7G?}n@zAtohVRjnOJi%y$WXZgNl zXP1LZ7E|zha|>;{p?ZcN7eX-PIS-xs#9xPl$mnguTI*w_-?X5$ZM0Z<_&uunmSR#$ z0;{2ERQYREcRW{!!XZYp{UGWJN7!HTI&a$YCfmLRG+OL%+PEvH)^xx% z4(lYts0al90E-9#aD{U@0UjWF31GA8L+6HZ?h`!7*{eG{37{tAsTA{H(Dawib#w(x zgw8cE%TPd4FK&4}8V2^~G!s49uF`Ng0k6DS< zJoDl?pi2R0BjTyMwZ)C48E5&RqCuAEoE407juJuhB`~`RYu9V15^o@VDZMuxd3F5y z$1X2e@LKQz?w$rfa(_z?X4X@VtP88AJ#3G_m&j_h$tvYn);A8(g|qCGpxWwtujMGe zPy6;_)zoWJ=|dIzU)tm!?4iZ{?Q*%A?rRL0eTcj)Sf0_hdTb84;cizEbZa$LB4)R( z)|R)s%Jg36f}NFTPB7A+y=YO@Kwa`CLg^2g9| z@|LDBhQ(|_t~ok7i5vsEUU1{~h3yE#ti9-}_rM2a-hO>=U|8{l&GIJD zpATpN@Vb*wy^;?nFAvXZINsp?ry5QRP}XNgDHnZPhEk5Q4ZvH#=&1n98UHq5+jjYd z(bbJ&!YA$7xz-A5$w z_b&)+@z#C_-CiW!SAo>)$}O~wqn+EZ*LtxBZ;nG4an;vxSX(OuzEKSs%2AT*UXS;$aRuJ( zqxOooU>Uul6Fftf2uiVs2Db~3yZ+@IaDgQ#QU^d{`Q7N&)KKx6#1;1>g8ty0^xBY$ zG0Co<%h8=vW3Ba88Oot<-bTIWi_~QO@D}}?NA`ne0*^<}WCA*ugge>#QS3pCPT)9P zUGpHI?H|`6+1cmMFBGS~q%LO4YX0~rJG+ooZN)n&45not^_{1Rx(t?TAXu-;V+mKD zy3}ADl}Zo^CVFX!7yczQg280r$T#H5xDy^ln;BKgc@e9kTc=utT*GsWv*_wR+6}#q zi+_@g%q-bIu_>O*Rgcpp*12yoof@wqX~bh7fy7a|*04316F3#MwsttH zIG$|(cywJ=*XX_(PNhjp%cFXX*pXG*u-_gYYc8QCU^oZYR1hS_I(Yb|wHPMS~*n`BBy_WmtvkNzW;F^q=zbZ9NLGf7#OJ z0a(Vj$uL5b0b5`h{XF^gxOuG`UsPVw{_e72)V~oxr;#n%CI~X>o-Q8_`|H^Lt>wFb z{|x~MaDzd`uZ-E|7Gl-g*c9L8JIkU&QjZvaPeUYGAPO6CP?v-=>AVEEK5d%!8ivZPdN=48Ex&Bqwf2fGx5&0Jt zp%=cB3nT{9rDWFDXMYU~{I5uGGWGGw-cirpfA|YM6%$M)4!74tB;dyDAvZdhfvrG8 znQGRebk9VR+0I?!a4UwAm#6>VP;eC32i%i*rSjyH04Q^w&o)qQVRN^)_z2%owOg2Nz)4r1;5QwQ z2iZp^G0R%a*zstNXO_1Y?z9o&ELgm7@8SR=WuZSGp!PLrxBs~)lr;gDM0dGS-+9w6 zIDeT&tL0mdO{#{2c>C;7Wz+W707x4P!dCxP(Xf`+UuXRGX#}B-0f>qKc~(^sXhq8_naX!=tg;rZm;tZN_Q`yAcuXXyb}hb__lv*FBM0KOTaKM;V4OQaCU|%G)gLBf z5)U#@N91s@aT#%AV?#UAaFe4=te z525ujKaY(Pmuu`BlU3-==n>sE^o-=vQac2Oo!F+in3InN^@!+?Vx2O?e2ct-Pt6vX zrC-yfbB^~WTcS!CeuM)ah4IUMIWW@?eyGt9g+k>wZ=t%B#&L#MK3t**BzCEsg{R{3 z+~@c%cyvrnz6eV|p%v&>;?+cHtbYOWqNM9R944}`YJ_z4kyXgtm+Vct!MfSu6kwcK zbTE~8{1GwD1Gro1Z*Ol8Y$w&YPJMw4a^94$WiOW^-0QrJNL?pLNjZJ=B_`Kyet&0a zccB+}x@01Bk3b;6g0EQL28{O#1;ijr{%&Y>I7mqO|2uWE&H_@gv&;(kEp7SC@6f?W^&ja}gtw>Xx(ARj zZOwHP_AdPW17LoEV-t`8I0DzXfzPLMa9W^vz%EA#6t@9h7${x>R4`C{_6j*Xxe*xOi9C%q2 diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 62bdf664f0..375d058557 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1411,6 +1411,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware +[DeviceStatus CSP](devicestatus-csp.md) +

    Added the following node in Windows 10, version 1803:

    +
      +
    • OS/Mode
      • +
    + + [Understanding ADMX-backed policies](understanding-admx-backed-policies.md)

    Added the following videos:

      From c0bb8f48d6d3aede76a7cc3a1d97ac78e2eeb89c Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 13 Mar 2018 23:19:03 +0000 Subject: [PATCH 118/119] Merged PR 6349: Added Browser/PreventTabPreloading policy in Policy CSP --- .../policy-configuration-service-provider.md | 3 + .../mdm/policy-csp-browser.md | 57 ++++++++++++++++++- 2 files changed, 59 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6f733c2214..204daddb5b 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -498,6 +498,9 @@ The following diagram shows the Policy configuration service provider in tree fo
      Browser/PreventSmartScreenPromptOverrideForFiles
      +
      + Browser/PreventTabPreloading +
      Browser/PreventUsingLocalHostIPAddressForWebRTC
      diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index ccafd7cbed..79d91ff2dc 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 03/13/2018 --- # Policy CSP - Browser @@ -117,6 +117,9 @@ ms.date: 03/12/2018
      Browser/PreventSmartScreenPromptOverrideForFiles
      +
      + Browser/PreventTabPreloading +
      Browser/PreventUsingLocalHostIPAddressForWebRTC
      @@ -2150,6 +2153,58 @@ The following list shows the supported values:
      + +**Browser/PreventTabPreloading** + + + + + + + + + + + + + + + + + + + + + +
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4
      + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
      + + + +Added in Windows 10, version 1803. This is only a placeholder. Do not use in production code. + + + + +The following list shows the supported values: + +- 0 (default) – Allow pre-launch and preload. +- 1 – Prevent pre-launch and preload. + + + + +
      + **Browser/PreventUsingLocalHostIPAddressForWebRTC** From 4b4bf0403a347892651488e6832a96c4b3e12d4c Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 14 Mar 2018 15:21:49 +0000 Subject: [PATCH 119/119] Merged PR 6353: Remove system/allowfontproviders from Holographic Correction to Policy CSP --- .../mdm/policy-configuration-service-provider.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 204daddb5b..c94b2fe9d3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4546,7 +4546,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - [Settings/AllowDateTime](#settings-allowdatetime) - [Settings/AllowVPN](#settings-allowvpn) -- [System/AllowFontProviders](#system-allowfontproviders) - [System/AllowLocation](#system-allowlocation) - [System/AllowTelemetry](#system-allowtelemetry) - [Update/AllowAutoUpdate](#update-allowautoupdate)