AppVPublishing/LastSync/LastError|String|Read-only data, provided by your App-V packages.| -|LastErrorDescription|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/LastErrorDescription|String|- **0**: No errors returned during publish.
- **1**: Unpublish groups failed during publish.
- **2**: Publish no-group packages failed during publish.
- **3**: Publish group packages failed during publish.
- **4**: Unpublish packages failed during publish.
- **5**: New policy write failed during publish.
- **6**: Multiple non-fatal errors occurred during publish.| -|SyncStatusDescription|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
- **1**: App-V connection groups publish in progress.
- **2**: App-V packages (non-connection group) publish in progress.
- **3**: App-V packages (connection group) publish in progress.
- **4**: App-V packages unpublish in progress.| -|SyncProgress|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
- **1**: App-V Sync is initializing.
- **2**: App-V Sync is in progress.
- **3**: App-V Sync is complete.
- **4**: App-V Sync requires device reboot.| -|PublishXML|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/
AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.| -|Policy|Windows 10/11|./Vendor/MSFT/EnterpriseAppVManagement/
AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.| diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md deleted file mode 100644 index 5d052067c5..0000000000 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: App-V Capacity Planning (Windows 10/11) -description: Use these recommendations as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- -# App-V Capacity Planning - ->Applies to: Windows Server 2016 - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. - ->[!IMPORTANT] ->Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - -## Determine the project scope - -Before you design the App-V infrastructure, determining which applications will be available virtually, and also identify the target users and their locations. This information will determine what type of App-V infrastructure your project should implement. You should base your decisions about your project's scope on your organization's specific needs. - -|Task|More information| -|----|----------------| -|Determine application scope|The App-V infrastructure can be set up in different ways depending on which applications you want to virtualize. This customization in set up means your first task is to define which applications you want to virtualize.| -|Determine location scope|"Location scope" refers to the physical locations where you plan to run the virtualized applications (for example, enterprise-wide or a specific geographic location). It can also refer to the user population that will run the virtual applications (for example, a single department). You should obtain a network map that includes the connection paths, the available bandwidth for each location, the number of users using virtualized applications, and the WAN link speed.| - -## Determine which App-V infrastructure is required - -You can also manage your App-V environment using an electronic software distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information, see [How to deploy App-V packages using electronic software distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). - -* **Standalone model**—The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone mode only needs the sequencer and the client; no extra components are required. Applications are prepared for virtualization using a process called sequencing. For more information, see [Planning for the App-V Sequencer and Client deployment](appv-planning-for-sequencer-and-client-deployment.md). The standalone model is recommended for the following scenarios: - - * When there are disconnected remote users who can't connect to the App-V infrastructure. - * When you're running a software management system, such as Configuration Manager. - * When network bandwidth limitations inhibit electronic software distribution. -* **Full infrastructure model**—The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V full infrastructure model consists of one or more App-V management servers that can be used to publish applications to all clients. Publishing places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about how to install the management server, see [Planning for App-V Server deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - * When you want to use the Management Server to publish the application to target computers. - * For rapid provisioning of applications to target computers. - * When you want to use App-V reporting. - ->[!IMPORTANT] ->The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information, see [App-V supported configurations](appv-supported-configurations.md). - -## End-to-end server sizing guidance - -The following section describes end-to-end App-V sizing and planning. For more specific information, refer to the subsequent sections. - ->[!NOTE] ->Round trip response time on the client is the time taken by the computer running the App-V client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - -* 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time (<3 seconds). -* A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time (<5 seconds). - -## App-V Management Server capacity planning recommendations - -The App-V publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V management server supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - ->[!NOTE] ->The default refresh time on the App-V publishing server is ten minutes. - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors will influence the publishing server's round-trip response time: - -1. The number of publishing servers making simultaneous requests. -2. The number of connection groups configured on the management server. -3. The number of access groups configured on the management server. - -The following table describes each factor that impacts round-trip time in more detail. - ->[!NOTE] ->Round trip response time is the time taken by the computer running the App-V publishing server to receive a successful package metadata update from the management server. - -|Factors impacting round-trip response time|Description| -|------------------------------------------|-----------| -|The number of publishing servers simultaneously requesting package metadata refreshes.|A single management server can respond to up to 320 publishing servers simultaneously requesting publishing metadata. For example, in a case with 30 publishing servers simultaneously requesting publishing metadata, the round-trip response time is about 40 seconds, while for less than 50 servers it's less than 5 seconds. From 50 to 320 publishing servers, response team increases linearly (approximately 2×).| -|The number of connection groups configured on the management server.|For up to 100 connection groups, there's no significant change in the round-trip response time on the publishing server. For 100–400 connection groups, there's a minor linear increase in the round-trip response time.| -|The number of access groups configured on the management server.|For up to 40 access groups, there's a linear (approximately 3×) increase in the round-trip response time on the publishing server.| - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V management server. - -|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization| -|---|---|---|---|---|---|---|---| -|Publishing servers contact management server for publishing metadata at same time|Number of publishing servers.|0
0
0
0
0
0|1
1
1
1
1
1|50
100
200
300
315
320|LAN|5
10
19
32
30
37|17
17
17
15
17
15| -|Publishing metadata contains connection groups|Number of connection groups|10
20
100
150
300
400|1
1
1
1
1
1|100
100
100
100
100
100|LAN|10
11
11
16
22
25|17
19
22
19
20
20| -|Publishing metadata contains access groups|Number of access groups|0
0
0
0|1
10
20
40|100
100
100
100|LAN|10
43
153
535|17
26
24
24| - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example, transactions/sec is approximately 30, batch requests approximately 200, and user connects approximately six. - -Through a geographically distributed deployment, where the management server and publishing servers utilize a slow link network between them, the round-trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - -|Scenario|Variation|Number of connection groups|Number of access groups|Number of publishing servers|Network connection type|Round-trip response time (seconds)|Management server CPU utilization (in %)| -|---|---|---|---|---|---|---|---| -|Network connection between the publishing server and management server|1.5 Mbps Slow link Network|0
0|1
1|50
100|1.5 Mbps Cable DSL|4
5|1
2| -|Network connection between the publishing server and management server|LAN/WiFi Network|0
0|1
1|100
200|WiFi|11
20|15
17| - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V Reporting Server capacity planning recommendations - -App-V clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V client. For more information about the App-V Reporting Server's supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - ->[!NOTE] ->Round-trip response time is the time taken by the computer running the App-V client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients send reporting information to the reporting server simultaneously.|Round-trip response time from the reporting server is 2.6 seconds for 500 clients. Round-trip response time from the reporting server is 5.65 seconds for 1000 clients. Round-trip response time increases linearly depending on number of clients.| -|Requests per second processed by the reporting server.|A single reporting server and a single database can process a maximum of 139 requests per second. The average is 121 requests/second. With the help of two reporting servers that report to the same Microsoft SQL Server database, the average requests/second, like a single reporting server, is about 127, with a max of 278 requests/second. A single reporting server can process 500 concurrent/active connections. A single reporting server can process a maximum 1,500 concurrent connections.| -|Reporting database.|Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second. Throughput and response time are independent of database size.| - -### Calculating random delay - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -*Random delay = 4 × number of clients/average requests per second*. - -Example: Random delay for 500 clients with 120 requests per second is *4 × 500/120 = about 17 minutes*. - -## App-V publishing server capacity planning recommendations - -Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and receive a response. Round trip response time is measured on the computer running the App-V client, while processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations, see [App-V supported configurations](appv-supported-configurations.md). - -> [!IMPORTANT] -> The following list displays the main factors to consider when setting up the App-V publishing server: -> * The number of clients connecting simultaneously to a single publishing server. -> * The number of packages in each refresh. -> * The available network bandwidth in your environment between the client and the App-V publishing server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients connect to a single publishing server simultaneously.|A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously. For 5,000–10,000 clients, the publishing server requires a minimum quad core. For 10,000–20,000 clients, the publishing server should have dual quad cores for more efficient response times. A publishing server with a quad core can refresh up to 10,000 packages within three seconds. (Supports 10,000 simultaneous clients.)| -|Number of packages in each refresh.|Increasing number of packages will increase response time by about 40% (up to 1,000 packages).| -|Network between the App-V client and the publishing server.|Across a slow network (1.5-Mbps bandwidth), there's a 97% increase in response time compared to LAN (up to 1,000 users).| - ->[!NOTE] ->The publishing server CPU usage is always high during the time interval when it must process simultaneous requests (>90% in most cases). The publishing server can handle about 1,500 client requests in one second. - -|Scenario|Variation|Number of App-V clients|Number of packages|Processor configuration on publishing server|Network connection type|App-V client round-trip time (in seconds)|Publishing server CPU utilization (in %)| -|---|---|---|---|---|---|---|---| -|App-V client sends publishing refresh request and receives response, each request containing 120 packages|Number of clients|100
1,000
5,000
10,000|120
120
120
120|Dual Core
Dual Core
Quad Core
Quad Core|LAN|1
2
2
3|100
99
89
77| -|Multiple packages in each refresh.|Number of packages|1,000
1,000|500
1,000|Quad Core|LAN|2
3|92
91| -|Network between client and publishing server.|1.5 Mbps Slow link network|100
500
1,000|120
120
120|Quad Core|1.5-Mbps intra-continental network|3
10 (0.2% failure rate)
7 (1% failure rate)|| - -## App-V streaming capacity planning recommendations - -Computers running the App-V client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V client, and is the time taken to stream the entire package. - -> [!IMPORTANT] -> The following list identifies the main factors to consider when setting up the App-V streaming server: -> * The number of clients streaming application packages simultaneously from a single streaming server. -> * The size of the package being streamed. -> * The available network bandwidth in your environment between the client and the streaming server. - -|Scenario|Summary| -|---|---| -|Multiple App-V clients stream applications from a single streaming server simultaneously.|If the number of clients simultaneously streaming from the same server increases, there's a linear relationship with the package download/streaming time.| -|Size of the package being streamed.|The package size has a significant impact on the streaming/download time only for larger packages with a size of about 1 GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.| -|Network between the App-V client and the streaming server.|Across a slow network (1.5-Mbps bandwidth), there's a 70–80% increase in response time compared to LAN (up to 100 users).| - -The following table displays sample values for each of the factors in the previous list: - -|Scenario|Variation|Number of App-V clients|Size of each package|Network connection type|Round-trip time on the App-V client (in seconds)| -|---|---|---|---|---|---| -|Multiple App-V clients streaming virtual application packages from a streaming server.|Number of clients.|100
200
1,000
100
200
1,000|3.5 MB
3.5 MB
3.5 MB
5 MB
5 MB
5 MB|LAN|29
39
391
35
68
461| -|Size of each package being streamed.|Size of each package.|100
200
100
200|21 MB
21 MB
109 MB
109 MB|LAN|33
83
100
160| -|Network connection between client and App-V streaming server.|1.5 Mbps Slow link network.|100
100|3.5 MB
5 MB|1.5-Mbps intra-continental network|102
121| - -Each App-V streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - ->[!NOTE] ->The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - -For example, an average user can stream a 100-MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real-world environments, streaming demand isn't uniformly distributed, you'll need to understand the approximate peak streaming requirements present in your environment to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V server roles - -Discounting scaling and fault-tolerance requirements, the minimum number of servers that a location with Active Directory connectivity needs to function is 1. This server will host the management server, management server service, and Microsoft SQL Server roles. This coverage means that you can arrange server roles in any combination you like, as they don't conflict with one another. - -Notwithstanding scaling requirements, the minimum number of servers that a fault-tolerant implementation needs to function is four. The management server and Microsoft SQL Server roles support placement in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are many fault-tolerance strategies and technologies you can use, not all are applicable to a given service. Additionally, if App-V roles are combined, the resulting incompatibilities could cause certain fault-tolerance options to stop working. - - - - - -## Related articles - -* [App-V supported configurations](appv-supported-configurations.md) -* [Planning for high availability with App-V](appv-planning-for-high-availability-with-appv.md) -* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md deleted file mode 100644 index c7b029ac7a..0000000000 --- a/windows/application-management/app-v/appv-client-configuration-settings.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About Client Configuration Settings (Windows 10/11) -description: Learn about the App-V client configuration settings and how to use Windows PowerShell to modify the client configuration settings. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- -# About Client Configuration Settings - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. Understanding how the register's format for data works can help you better understand the client, as you can configure many client actions by changing registry entries. This topic lists the App-V client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md). - -You can use Group Policy to configure App-V client settings by navigating to the **Group Policy management console** at **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. - -## App-V Client Configuration Settings: Windows PowerShell - -The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets: - - -| Windows PowerShell cmdlet or cmdlets,
**Option**
Type | Description | Disabled policy state keys and values | -|------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------| -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-PackageInstallationRoot**
String | Specifies directory where all new applications and updates will be installed. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-PackageSourceRoot**
String | Overrides source location for downloading package content. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-AllowHighCostLaunch**
True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows client machines connected by a metered network connection (for example, 4G). | 0 | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentRetries**
Integer (0–99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReestablishmentInterval**
Integer (0–3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-LocationProvider**
String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-CertFilterForClientSsl**
String | Specifies the path to a valid certificate in the certificate store. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VerifyCertificateRevocationList**
True (enabled); False (Disabled state) | Verifies Server certificate revocation status before streaming with HTTPS. | 0 | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-SharedContentStoreMode**
True (enabled); False (Disabled state) | Specifies that streamed package contents will not be saved to the local hard disk. | 0 | -| Set-AppvPublishingServer
**-Name**
String | Displays the name of publishing server. | Policy value not written (same as Not Configured) | -| Set-AppvPublishingServer
**-URL**
String | Displays the URL of publishing server. | Policy value not written (same as Not Configured) | -| Set-AppvPublishingServer
**-GlobalRefreshEnabled**
True (enabled); False (Disabled state) | Enables global publishing refresh (Boolean) | False | -| Set-AppvPublishingServer
**-GlobalRefreshOnLogon**
True (enabled); False (Disabled state) | Triggers a global publishing refresh on sign in. (Boolean) | False | -| Set-AppvPublishingServer
**-GlobalRefreshInterval**
Integer (0–744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, specify 0. | 0 | -| Set-AppvPublishingServer
**-GlobalRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 | -| Set-AppvPublishingServer
**-UserRefreshEnabled**
True (enabled); False (Disabled state) | Enables user publishing refresh (Boolean) | False | -| Set-AppvPublishingServer
**-UserRefreshOnLogon**
True (enabled); False (Disabled state) | Triggers a user publishing refresh on sign in. (Boolean) Word count (with spaces): 60 | False | -| Set-AppvPublishingServer
**-UserRefreshInterval**
Word count (with spaces): 85
Integer (0–744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 | -| Set-AppvPublishingServer
**-UserRefreshIntervalUnit**
0 for hour, 1 for day | Specifies the interval unit (Hour 0–23, Day 0–31). | 1 | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-MigrationMode**
True (enabled state); False (Disabled state) | Migration mode allows the App-V client to modify shortcuts and FTAs for packages created by a previous version of App-V. | | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnablePackageScripts**
True (enabled); False (Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | | -| Set-AppvClientConfiguration
**-RoamingFileExclusions**
String | Specifies the file paths relative to %userprofile% that don't roam with a user's profile. For example, ```/ROAMINGFILEEXCLUSIONS='desktop;my pictures'``` | | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-RoamingRegistryExclusions**
String | Specifies the registry paths that don't roam with a user profile. For example, ```/ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients``` | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootUser**
String | Specifies the location to create symbolic links associated with the current version of a per-user published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links won't be used when you publish the package. For example, ```%localappdata%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-IntegrationRootGlobal**
String | Specifies the location to create symbolic links associated with the current version of a globally published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links won't be used when you publish the package. For example, ```%allusersprofile%\\Microsoft\\AppV\\Client\\Integration```. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-VirtualizableExtensions**
String | A comma-delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command-line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingEnabled**
True (enabled); False (Disabled state) | Returns information to a reporting server. | False | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingServerURL**
String | Specifies the location on the reporting server where client information is saved. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingDataCacheLimit**
Integer \[0–1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingDataBlockSize**
Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This limit can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingStartTime**
Integer (0–23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0–23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
**Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingInterval**
Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ReportingRandomDelay**
Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This method can help to prevent collisions on the server. | Policy value not written (same as Not Configured) | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
-EnableDynamicVirtualization
1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-EnablePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | | -| Sync-AppvPublishingServer
**-HidePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | | -| Set-AppvClientConfiguration,
Set-AppvPublishingServer
**-ProcessesUsingVirtualComponents**
String | Specifies a list of process paths (that may contain wildcards) that are candidates for using dynamic virtualization (such as supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. | - -## App-V client configuration settings: registry keys - -The following table provides information about App-V client configuration settings that can be configured through the registry: - - -| **Setting name**
Type | Registry key value | Disabled policy state keys and values | -|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------| -| **PackageInstallationRoot**
String | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) | -| **PackageSourceRoot**
String | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) | -| **AllowHighCostLaunch**
True (Enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 | -| **ReestablishmentRetries**
Integer (0–99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) | -| **ReestablishmentInterval**
Integer (0–3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) | -| **LocationProvider**
String | Streaming\\LocationProvider | Policy value not written (same as Not Configured) | -| **CertFilterForClientSsl**
String | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) | -| **VerifyCertificateRevocationList**
True (Enabled); False (Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 | -| **SharedContentStoreMode**
True (Enabled); False (Disabled state) | Streaming\\SharedContentStoreMode | 0 | -| **Name**
String | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) | -| **URL**
String | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) | -| **GlobalRefreshEnabled**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False | -| **GlobalRefreshOnLogon**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False | -| **GlobalRefreshInterval**
Integer (0–744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 | -| **GlobalRefreshIntervalUnit**
0 for hour, 1 for day | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 | -| **UserRefreshEnabled**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False | -| **UserRefreshOnLogon**
True (Enabled); False (Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False | -| **UserRefreshInterval**
Word count (with spaces): 85; Integer (0–744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 | -| **UserRefreshIntervalUnit**
0 for hour, 1 for day | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 | -| **MigrationMode**
True(Enabled state); False (Disabled state) | Coexistence\\MigrationMode | | -| **EnablePackageScripts**
True (Enabled); False (Disabled state) | \\Scripting\\EnablePackageScripts | | -| **RoamingFileExclusions**
String | | | -| **RoamingRegistryExclusions**
String | Integration\\RoamingRegistryExclusions | Policy value not written (same as Not Configured) | -| **IntegrationRootUser**
String | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) | -| **IntegrationRootGlobal**
String | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) | -| **VirtualizableExtensions**
String | Integration\\VirtualizableExtensions | Policy value not written | -| **ReportingEnabled**
True (Enabled); False (Disabled state) | Reporting\\EnableReporting | False | -| **ReportingServerURL**
String | Reporting\\ReportingServer | Policy value not written (same as Not Configured) | -| **ReportingDataCacheLimit**
Integer \[0–1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) | -| **ReportingDataBlockSize**
Integer \[1024–Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) | -| **ReportingStartTime**
Integer (0–23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) | -| **ReportingInterval**
Integer | Reporting\\RetryInterval | Policy value not written (same as Not Configured) | -| **ReportingRandomDelay**
Integer \[0 - ReportingRandomDelay\] | Reporting\\RandomDelay | Policy value not written (same as Not Configured) | -| EnableDynamicVirtualization
1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | | -| **EnablePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing | | -| **HidePublishingRefreshUI**
1 (Enabled), 0 (Disabled) | | | -| **ProcessesUsingVirtualComponents**
String | Virtualization\\ProcessesUsingVirtualComponents | Empty string. | - -## Related topics - -* [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md deleted file mode 100644 index 23f43e8cb3..0000000000 --- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to configure access to packages by using the Management Console (Windows 10/11) -description: How to configure access to packages by using the App-V Management Console. -author: aczechowski -ms.service: windows-client -ms.date: 06/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- -# How to configure access to packages by using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -## Grant access to an App-V package - -1. Find the package you want to configure: - - 1. Open the App-V Management console. - - 1. Right-click the package to be configured, then select **Edit active directory access** to display the **AD Access** page. Alternatively, select the package and select **Edit** in the **AD Access** pane. - -2. Provision a security group for the package: - - 1. Go to the **Find valid Active Directory names and grant access** page. - - 1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**. - - > [!NOTE] - > Ensure that you provide an associated domain name for the group that you are searching for. - -3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD entities with access** pane. - -4. Select **Close** to accept the default configuration settings and close the AD Access page. - - To customize configurations for a specific group, select the **Assigned configurations** drop-down menu, then select **Custom**. To make changes to your custom configurations, select **Edit**. After you grant access, select **Close**. - -## Remove access to an App-V package - -1. Find the package you want to configure: - - 1. Open the App-V Management console. - - 1. To display the **AD Access** page, right-click the package to be configured, then select **Edit active directory access**. Alternatively, select the package, then select **Edit** in the **AD Access** pane. - -2. Select the group you want to remove, then select **Delete**. - -3. Select **Close**. - - - - - -## Related articles - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md deleted file mode 100644 index 9524c2d447..0000000000 --- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to make a connection group ignore the package version (Windows 10/11) -description: Learn how to make a connection group ignore the package version with the App-V Server Management Console. -author: aczechowski -ms.service: windows-client -ms.date: 06/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- -# How to make a connection group ignore the package version - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use Application Virtualization (App-V) to configure a connection group to use any version of a package, simplifying package upgrades and reducing the number of connection groups you need to create. - -You can also configure a connection group to accept any version of a package, so that you can upgrade the package without having to disable the connection group. - -- If the connection group has access to multiple versions of a package, App-V will use the latest version. - -- If the connection group contains an optional package with an incorrect version, App-V ignores the package and won't block the connection group's virtual environment from being created. - -- If the connection group contains a non-optional package that has an incorrect version, App-V won't be able to create the connection group's virtual environment. - -## Make a connection group ignore the package version with the App-V Server Management Console - -1. In the Management Console, select **Connection Groups**. - -2. Select the correct connection group from the Connection Groups library. - -3. Select **Edit** in the Connected Packages pane. - -4. Select the **Use Any Version** check box next to the package name, then select **Apply**. - -For more about adding or upgrading packages, see [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md). - -## Make a connection group ignore the package version from the App-V client on a stand-alone computer - -1. Create the connection group XML document. - -2. Set the **Package** tag attribute **VersionID** to an asterisk (*) to upgrade the package. - -3. Enter the following cmdlet (including the path to the connection group XML document) to add the connection group: - - ```PowerShell - Add-AppvClientConnectionGroup - ``` - - For more information about how to use the **Add-AppvClientConnectionGroup** cmdlet, see [**Add-AppvClientConnectionGroup**](/powershell/module/appvclient/add-appvclientconnectiongroup). - -4. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package: - - - [**Remove-AppvClientPackage**](/powershell/module/appvclient/remove-appvclientpackage) - - [**Add-AppvClientPackage**](/powershell/module/appvclient/add-appvclientpackage) - - [**Publish-AppvClientPackage**](/powershell/module/appvclient/publish-appvclientpackage) - -For more information, see [How to manage App-V packages running on a stand-alone computer by using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md). - - - - - -## Related articles - -- [Managing connection groups](appv-managing-connection-groups.md) diff --git a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md deleted file mode 100644 index c8e45c8af1..0000000000 --- a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to configure the client to receive package and connection groups updates from the publishing server (Windows 10/11) -description: How to configure the client to receive package and connection groups updates from the publishing server. -author: aczechowski -ms.service: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to configure the client to receive package and connection groups updates from the publishing server - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V publishing server's single-point management and high scalability lets you deploy packages and connection groups and keep them up to date. - -This article will tell you how to configure the App-V client to receive updates from the publishing server. - ->[!NOTE] ->The following example has the management server installed on a computer named **MyMgmtSrv**, and the publishing server installed on a computer named **MyPubSrv**. If the computers you'll be configuring the App-V client on have different names, you should replace the example's names with your computer's names. - -## Configure the App-V client to receive updates from the publishing server - -1. Deploy the App-V management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to add or upgrade packages by using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md) and [How to create a connection group](appv-create-a-connection-group.md). -2. To open the management console, open a web browser and enter the following URL: `https://MyMgmtSrv/AppvManagement/Console.html`. Import, publish, and entitle all packages and connection groups that your users will need. -3. On the computer running the App-V client, open an elevated Windows PowerShell command prompt, and run the following command: - - ```PowerShell - Add-AppvPublishingServer -Name ABC -URL https://MyPubSrv/AppvPublishing - ``` - - This command will configure the specified publishing server. You should see output similar to the following: - - ```PowerShell - Id : 1 - SetByGroupPolicy : False - Name : ABC - URL : https://MyPubSrv/AppvPublishing - GlobalRefreshEnabled : False - GlobalRefreshOnLogon : False - GlobalRefreshInterval : 0 - GlobalRefreshIntervalUnit : Day - UserRefreshEnabled : True - UserRefreshOnLogon : True - UserRefreshInterval : 0 - UserRefreshIntervalUnit : Day - ``` - -4. On the computer running the App-V client, open a Windows PowerShell command prompt and enter the following cmdlet: - - ```PowerShell - Sync-AppvPublishingServer -ServerId 1 - ``` - - This cmdlet will query the publishing server for which packages and connection groups need to be added or removed for this particular client based on your configured entitlements for the packages and connection groups on the management server. - - - - - -## Related article - -* [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md deleted file mode 100644 index 50ed9fd433..0000000000 --- a/windows/application-management/app-v/appv-connect-to-the-management-console.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: How to connect to the Management Console (Windows 10/11) -description: In this article, learn the procedure for connecting to the App-V Management Console through your web browser. -author: aczechowski -ms.service: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to connect to the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to connect to the App-V Management Console. - -## Connect to the App-V Management Console - -1. Open your web browser and enter the address for the App-V Management server. For example, **https://\<_management server name_\>:\<_management service port number_\>/console.html**. - -2. To view different sections of the console, select your desired section in the navigation pane. - - - - - -## Related articles - -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-connection-group-file.md b/windows/application-management/app-v/appv-connection-group-file.md deleted file mode 100644 index bfad2cc36f..0000000000 --- a/windows/application-management/app-v/appv-connection-group-file.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: About the connection group file (Windows 10/11) -description: A summary of what the connection group file is and how to configure it. -author: aczechowski -ms.service: windows-client -ms.date: 06/25/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# About the connection group file - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -## Connection group file overview - -### What is a connection group? - -A connection group is an App-V feature that can group packages together to create a virtual environment where applications within that package group can interact with each other. - -For example, let's say you want to use plug-ins with Microsoft Office. You can create one package that contains the plug-ins and another package that contains Office, and then add both packages to the same connection group to enable Office to use those plug-ins. - -### How a connection group file works - -When you apply an App-V connection group file, all packages specified in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) connection group file to configure existing App-V connection groups. - -An example file path for a package file would be %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}. - -## Structure of the connection group XML file - -This section will tell you more about the components of the connection group XML file. - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - -|Field|Description| -|-----|-----------| -|Schema name|Name of the schema.If you want to use the “optional packages” and “use any version” features described in this table, you must specify the following schema in the XML file:`xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"`| -|AppConnectionGroupId|Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.You can create a new GUID by entering **[Guid]::NewGuid()**.| -|VersionId|Version GUID identifier for this version of the connection group.When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.| -|DisplayName|Display name of the connection group.| -|Priority|Optional priority field for the connection group.A value of **0** indicates the highest priority.If a priority is required but has not been configured, the package will fail because it can't determine the correct connection group to use.| - -### Parameters that define the packages in the connection group - -In the **<Packages>** section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - -|Field|Description| -|---|---| -|PackageId|Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.| -|VersionId|Unique GUID identifier for the version of the package. If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.| -|IsOptional|Parameter that enables you to make a package optional within the connection group. Valid entries are:- “**true**”—package is optional in the connection group- “**false**”—package is required in the connection group| - -### App-V example connection group XML file - -The following example connection group XML file shows examples of the fields listed in the previous tables. - -```XML - -
Use the format **INSTANCENAME**. The assumed installation location is the local computer.
Not supported: A server name using the format **ServerName**\\**INSTANCE**.| - | You are using a custom database name. | Select **Custom configuration** and type the database name.
The database name must be unique, or the installation will fail.| - -8. On the **Configure** page, accept the default value, **Use this local computer**. - - > [!NOTE] - > If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed. - -9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - | Method | What you need to do | - |---|---| - | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
Use the format **INSTANCENAME**. The assumed installation location is the local computer.
Not supported: A server name using the format **ServerName**\\**INSTANCE**.| - | You are using a custom database name. | Select **Custom configuration** and type the database name.
The database name must be unique, or the installation will fail.| - -10. On the **Configure** page, accept the default value: **Use this local computer**. - - > [!NOTE] - > If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed. - -11. On the **Configure** (Management Server Configuration) page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Specify AD group | Specify the AD group with sufficient permissions to manage the App-V environment. Example: MyDomain\MyUser
After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.| - |Website name | Specify the custom name that will be used to run the publishing service.
If you do not have a custom name, you don't have to change it.| - |Port binding | Specify a unique port number that will be used by App-V. Example: **12345**
Ensure that the port specified is not being used by another website. | - -12. On the **Configure Publishing Server Configuration** page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Specify the management service URL | Example: http://localhost:12345 | - | Website name | Specify the custom website name that will be used to run the publishing service.
If you do not have a custom name, do not make any changes. | - | Port binding | Specify a unique port number that will be used by App-V. Example: 54321
Ensure that the port specified is not being used by another website. | - -13. On the **Reporting Server** page, specify the following: - - | Item to configure | Description and examples | - |---|---| - | Website name | Specify the custom name that will be used to run the Reporting Service.
If you do not have a custom name, do not make any changes. | - | Port binding | Specify a unique port number that will be used by App-V. Example: 55555
Ensure that the port specified is not being used by another website.| - -14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -15. To verify that the setup completed successfully, open a web browser, and type the following URL with the bracketed variables adjusted according to your specifications in the earlier steps: - - `http://
- Package Accelerator
- Office Deployment Kit| -|Supported licensing|Volume Licensing| -|Supported deployments|- Desktop
- Personal VDI
- RDS| - -## Creating Office 2010 App-V using the sequencer - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. For more information, see [How to Sequence a New Application with App-V 5.0](/microsoft-desktop-optimization-pack/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030). - -## Deploying the Microsoft Office package for App-V - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -* Microsoft Configuration Manager -* App-V server -* Stand-alone through Windows PowerShell commands - -## Office App-V package management and customization - -Office 2010 packages can be managed like any other App-V packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - -The following table provides a full list of supported integration points for Office 2010. - -(POPULATE THE THIRD COLUMN) - -|Extension Point|Description|Office 2010| -|---|---|---| -|Lync meeting Join Plug-in for Firefox and Chrome|User can join Lync meetings from Firefox and Chrome|| -|Sent to OneNote Print Driver|User can print to OneNote|Yes| -|OneNote Linked Notes|OneNote Linked Notes|| -|Send to OneNote Internet Explorer Add-In|User can send to OneNote from IE|| -|Firewall Exception for Lync and Outlook|Firewall Exception for Lync and Outlook|| -|MAPI Client|Native apps and add-ins can interact with virtual Outlook through MAPI|| -|SharePoint Plugin for Firefox|User can use SharePoint features in Firefox|| -|Mail Control Panel Applet|User gets the mail control panel applet in Outlook|Yes| -|Primary Interop Assemblies|Support managed add-ins|| -|Office Document Cache Handler|Allows Document Cache for Office applications|| -|Outlook Protocol Search handler|User can search in Outlook|Yes| -|Active X Controls:
- Groove.SiteClient
- PortalConnect.PersonalSite
- SharePoint.openDocuments
- SharePoint.ExportDatabase
- SharePoint.SpreadSheetLauncher
- SharePoint.StssyncHander
- SharePoint.DragUploadCtl
- SharePoint.DragDownloadCtl
- Sharpoint.OpenXMLDocuments
- Sharepoint.ClipboardCtl
- WinProj.Activator
- Name.NameCtrl
- STSUPld.CopyCtl
- CommunicatorMeetingJoinAx.JoinManager
- LISTNET.Listnet
- OneDrive Pro Browser Helper|Active X Control.
For more information about ActiveX controls, see the [ActiveX Control API Reference](/previous-versions/office/developer/sharepoint-2010/ms440037(v=office.14)).|| -|OneDrive Pro Icon Overlays|Windows explorer shell icon overlays when users look at folders OneDrive Pro folders|| - -### Connection Groups - -* [Managing Connection Groups](appv-managing-connection-groups.md) - -### Dynamic Configuration - -* [About App-V Dynamic Configuration](appv-dynamic-configuration.md) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md deleted file mode 100644 index 8b8c6ca547..0000000000 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ /dev/null @@ -1,430 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V (Windows 10/11) -description: Use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Deploying Microsoft Office 2013 by Using App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. - -## What to know before you start - -Before you deploy Office 2013 with App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -The following table will direct you to more information about which versions of Office App-V supports and how to run App-V with coexisting versions of Office. - -|Information to review|Description| -|---|---| -|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|- Supported versions of Office
- Supported deployment types like desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI
- Office licensing options.| -|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.| - -### Packaging, publishing, and deployment requirements - -Before you deploy Office with App-V, review the following requirements. - -|Task|Requirement| -|---|---| -|Packaging|All Office applications you wish to deploy to users must be in a single package.
In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office).| -|Publishing|You can only publish one Office package per client computer.
You must publish the Office package globally, not to the user.| -|Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - -|Task|Details| -|---|---| -|Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool.|Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
For more information, see [ExcludeApp element](/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ad=US&rs=en-US&ui=en-US#excludeapp-element).| -|Modify the **DeploymentConfig.xml** file|Modify the **DeploymentConfig.xml** file after creating the package. This file contains the default package settings for all users on a computer running the App-V Client.
For more information, see [Disabling Office 2013 applications](#disabling-office-2013-applications).| - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - -Complete the following steps to create an Office 2013 package for App-V or later. - ->[!IMPORTANT] ->In App-V and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -Before you start, ensure that the computer on which you're installing the Office Deployment Tool has the following prerequisites fulfilled: - -|Prerequisite|Description| -|---|---| -|Prerequisite software|.NET Framework 4| -|Supported operating systems|64-bit version of Windows 8 or later
64-bit version of Windows 7| - ->[!NOTE] ->In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - -### Create Office 2013 App-V packages using Office Deployment Tool - -You create Office 2013 App-V packages with the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10/11 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The App-V sequencer can't create or modify packages. To create a package: - -1. Download the [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 -3. Check that a **setup.exe** and a **configuration.xml** file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. You can create the Office 2013 App-V package after getting all the Office applications. - -The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following example denotes a configuration.xml file: - - ```XML -
Specifies the products and languages to include in the package.|N/A| -|OfficeClientEdition (attribute of Add element):
Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if **OfficeClientEdition** isn't set to a valid value.|```OfficeClientEdition="32"```
```OfficeClientEdition="64"```| -|Product element:
Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.|```Product ID="O365ProPlusRetail"```
```Product ID="VisioProRetail"```
```Product ID="ProjectProRetail"```
```Product ID="ProPlusVolume"```
```Product ID="ProjectProVolume"```| -|Language element:
Specifies the language supported in the applications.|```Language ID="en-us"```| -|Version (attribute of Add element):
Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).|```15.1.2.3```| -|SourcePath (attribute of Add element):
Specifies the location where the applications will be saved to.|```Sourcepath="\Server\Office2013”```| - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. You'll need to make sure to have the right procedure depending on your licensing model. - -#### What you'll need to do - -* Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10/11 computers. -* Create an Office App-V package for either the Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, then modify the **Customconfig.xml** configuration file. - - The following table summarizes the values you need to enter in the **Customconfig.xml** file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - -|Product ID|Volume Licensing|Subscription Licensing| -|---|---|---| -|Office 2013|ProPlusVolume|O365ProPlusRetail| -|Office 2013 with Visio 2013|ProPlusVolume
VisioProVolume|O365ProPlusRetail
VisioProRetail| -|Office 2013 with Visio 2013 and Project 2013|ProPlusVolume
VisioProVolume
ProjectProVolume|O365ProPlusRetail
VisioProRetail
ProjectProRetail| - -#### How to convert the Office applications into an App-V package - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - * **SourcePath**: Point to the Office applications downloaded earlier. - * **ProductID**: Specify the type of licensing, as shown in the following examples: - * Subscription Licensing: - ```XML -
- * **WorkingDir** - - > [!NOTE] - >To troubleshoot any issues, see the log files in the %temp% directory (default). -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package that you created globally to a test computer and verify that the Office 2013 shortcuts appear. - 2. Start a few Office 2013 applications, such as Excel or Word, to test that your package is working as expected. - -## Publishing the Office package for App-V - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -* Microsoft Configuration Manager -* App-V Server -* Stand-alone through Windows PowerShell commands - -### Publishing prerequisites and requirements - -|Prerequisite or requirement|Details| -|---|---| -|Enable Windows PowerShell scripting on the App-V clients.|To publish Office 2013 packages, you must run a script. Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
```Set-AppvClientConfiguration –EnablePackageScripts 1```| -|Publish the Office 2013 package globally.|Extension points in the Office App-V package require installation at the computer level.
When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.| - -### How to publish an Office package - -Run the following command to publish an Office package globally, with the bracketed value replaced by the path to the App-V package: - -```PowerShell -Add-AppvClientPackage
A package that contains only Office—deploy to computers whose users need only Office.
A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.| -|Create just one package for the whole organization, or for users who share computers|Follow these steps:
1. Create a package that contains Office, Visio, and Project.
2. Deploy the package to all users.
3. Use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project.| - -## Additional resources - -### Additional resources for Office 2013 App-V Packages - -* [Office 2013 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778) - -### Additional resources for Connection Groups - -* [Managing Connection Groups](appv-managing-connection-groups.md) -* [Connection groups on the App-V team blog](/archive/blogs/gladiator/app-v-5-more-on-connection-groups) - -### Additional resources for Dynamic Configuration - -* [About App-V Dynamic Configuration](appv-dynamic-configuration.md) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md deleted file mode 100644 index e76a52b47d..0000000000 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ /dev/null @@ -1,383 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by using App-V (Windows 10/11) -description: Use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Deploying Microsoft Office 2016 by using App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the information in this article to use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). - -## What to know before you start - -Before you deploy Office 2016 with App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and running coexisting versions of Office. - -|Information to review|Description| -|---|---| -|[Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#supported-versions-of-microsoft-office)|Supported versions of Office and deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), and pooled VDI), and Office licensing options.| -|[Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#before-you-implement-office-coexistence)|Considerations for installing different versions of Office on the same computer.| - -### Packaging, publishing, and deployment requirements - -Before you deploy Office with App-V, review the following requirements. - -|Task|Requirement| -|-----------|-------------------| -| Packaging. | All Office applications that you deploy to users must be in a single package.
In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
If you're deploying Microsoft Visio 2016 and Microsoft Project 2016 at the same time as Office, you must put them all in the same package. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). | -| Publishing. | You can only publish one Office package per client computer.
You must publish the Office package globally, not to the user. | -| Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - -|Task|Details| -|-------------|---------------| -| Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool. | With this setting, you can exclude specific Office applications from the package that the Office Deployment Tool creates. For example, you can use this setting to create a package that contains only Microsoft Word.
For more information, see [ExcludeApp element](/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ad=US&rs=en-US&ui=en-US#excludeapp-element). | -| Modify the DeploymentConfig.xml file | Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
For more information, see [Disabling Office 2016 applications](#disabling-office-2016-applications). | - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - -Complete the following steps to create an Office 2016 package for App-V. - ->[!IMPORTANT] ->In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You can't use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you're installing the Office Deployment Tool must have the following: - -| Prerequisite | Description | -|----------------------|--------------------| -| Prerequisite software | .NET Framework 4 | -| Supported operating systems | 64-bit version of Windows 10/11
64-bit version of Windows 8 or 8.1
64-bit version of Windows 7 | - ->[!NOTE] ->In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - -### Create Office 2016 App-V packages with the Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with subscription licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10/11 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package can't be created or modified through the App-V sequencer. To begin package creation, follow these steps: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - - >[!IMPORTANT] - >You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example location: \\\\Server\\Office2016 -3. Check that the **setup.exe** and **configuration.xml** files exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - 1. Open the sample XML file in Notepad or your favorite text editor. - 2. With the sample **configuration.xml** file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the **configuration.xml** file: - - ```XML -
`OfficeClientEdition="64"` | - | Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.
For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](/office365/troubleshoot/installation/product-ids-supported-office-deployment-click-to-run). | `Product ID ="O365ProPlusRetail"`
`Product ID ="VisioProRetail"`
`Product ID ="ProjectProRetail"` | - | Language element | Specifies which language the applications support. | `Language ID="en-us"` | - | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` | - | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` | - | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
The default is **Deferred** for Microsoft 365 Apps for enterprise and **Current** for Visio Pro for Office 365 and Project Desktop Client.
For more information about update channels, see [Overview of update channels for Microsoft 365 Apps for enterprise](/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
`Channel="Deferred"`
`Channel="FirstReleaseDeferred"`
`Channel="FirstReleaseCurrent"` | - -After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml." -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. An example command is: - - `\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml` - - The following table describes the example command's elements: - - | Element | Description | - |-------------------------------|--------------------------------------| - | ```\\server\Office2016``` | This network share location is the one that contains the Office Deployment Tool and the custom **Configuration.xml** file, which in this example is **Customconfig.xml**. | - | ``Setup.exe`` | This element is the Office Deployment Tool. | - | ```/download``` | Downloads the Office 2016 applications that you specify in the **Customconfig.xml** file. | - | ```\\server\Office2016\Customconfig.xml```| This element passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After the download command is used, Office applications should be found in the location specified in the configuration file, which in this example is ```\\Server\Office2016```. | - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -#### What you’ll need to do - -* Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10/11 computers. -* Create an Office App-V package for either Subscription Licensing package by using the Office Deployment Tool, and then modify the **Customconfig.xml** configuration file. - - The following table summarizes the values you need to enter in the **Customconfig.xml** file. The steps in the sections that follow the table will specify the exact entries you need to make. - ->[!NOTE] ->You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - -| Product ID | Subscription licensing | -|---|---| -| Office 2016| O365ProPlusRetail | -| Office 2016 with Visio 2016 | O365ProPlusRetail
VisioProRetail | -| Office 2016 with Visio 2016 and Project 2016 | O365ProPlusRetail
VisioProRetail
ProjectProRetail | - -#### How to convert the Office applications into an App-V package - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - * **SourcePath**: Change to the location where you saved the Office applications you downloaded during setup. - * **ProductID**: Specify the type of licensing, as shown in the following example: - - * Subscription Licensing: - ```XML -
`Set-AppvClientConfiguration -EnablePackageScripts 1` | -| Publish the Office 2016 package globally. | Extension points in the Office App-V package require installation at the computer level.
When you publish at the computer level, no prerequisite actions or redistributables are needed. The Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. | - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -```PowerShell -Add-AppvClientPackage
If you're not deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic. | -| How can I deploy Visio 2016 and Project 2016 to specific users? | Use one of the following methods:
**To create two different packages and deploy each one to a different group of users**:
Create and deploy the following packages:
- A package that contains only Office—deploy to computers whose users need only Office.
- A package that contains Office, Visio, and Project—deploy to computers whose users need all three applications.
**To create only one package for the whole organization, or to create a package intended for users who share computers**:
1. Create a package that contains Office, Visio, and Project.
2. Deploy the package to all users.
3. Use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) to prevent specific users from using Visio and Project. | - -## Related articles - -* [Deploying App-V for Windows client](appv-deploying-appv.md) -* [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -* [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) -* [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md deleted file mode 100644 index f9ba5b9a57..0000000000 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Deploying App-V packages by using electronic software distribution (ESD) -description: Deploying App-V packages by using electronic software distribution (ESD) -author: aczechowski -ms.service: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Deploying App-V packages by using electronic software distribution (ESD) - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can deploy App-V packages using an electronic software distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to deploy App-V with an electronic software distribution system](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). - -To learn how to deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to application management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682125(v=technet.10)#BKMK_Appv) - -## How to deploy virtualized packages using an ESD - -To learn more about how to deploy virtualized packages using an ESD, see [How to deploy App-V packages using electronic software distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). - -## How to enable only administrators to publish packages by using an ESD - -To learn how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD, see [How to enable only administrators to publish packages by using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md). - -## Related articles - -- [App-V and Citrix integration](https://www.microsoft.com/download/details.aspx?id=40885) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md deleted file mode 100644 index d9f2150218..0000000000 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Deploying the App-V Sequencer and configuring the client (Windows 10/11) -description: Learn how to deploy the App-V Sequencer and configure the client by using the ADMX template and Group Policy. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Deploying the App-V Sequencer and configuring the client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V Sequencer and client let administrators virtualize and run virtual applications. - -## Enable the client - -The App-V client is the component that runs a virtualized application on a target computer. The client lets users interact with icons and file types, starting virtualized applications. The client can also get the virtual application content from the management server. - ->[!NOTE] ->Starting with Windows 10 version 1607, App-V is included with the operating system. You only need to enable it. - -[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) - -## Client configuration settings - -The App-V client stores its configuration in the registry. Understanding the format used in the data registry can help you learn useful information about the client. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About client configuration settings](appv-client-configuration-settings.md). - -## Configure the client by using the ADMX template and Group Policy - -You can use Group Policy to configure the client settings for the App-V client and the Remote Desktop Services client. - -To manage the ADMX template, perform the following steps on the computer that you'll use to manage Group Policy. This computer is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: ```Windows\PolicyDefinitions``` -2. Save the **.adml** file to the following directory: ```Windows\PolicyDefinitions\
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| - ->[!NOTE] ->Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md deleted file mode 100644 index d6073f10c0..0000000000 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ /dev/null @@ -1,617 +0,0 @@ ---- -title: About App-V Dynamic Configuration (Windows 10/11) -description: Learn how to create or edit an existing Application Virtualization (App-V) dynamic configuration file. -author: aczechowski -ms.service: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# About App-V dynamic configuration - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -You can use dynamic configuration to customize an App-V package for a user. This article will tell you how to create or edit an existing dynamic configuration file. - -When you edit the Dynamic Configuration file, it customizes how an App-V package will run for a user or group. Therefore, package customization is made more convenient by removing the need to resequence packages using the desired settings and provides a way to keep package content and custom settings independent. - -## Advanced: dynamic configuration - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no further customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files: - -- User Configuration file -- Deployment Configuration file - -These .xml files specify package settings let you customize packages without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. These automatically generated configuration files reflect the package's default settings that were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This result provides you with a package-specific template to get started if any of the defaults must be changed. - ->[!NOTE] ->The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements. - -## Dynamic Configuration file contents - -All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. The following list represents the relationship between these files in how they'll be read, from most to least precedence: - -- User Configuration .xml file -- Deployment Configuration .xml file -- Package Manifest - -The first item represents what will be read last. Therefore, its content takes precedence. All packages inherently contain and provide default settings from the Package Manifest, but it also has the least precedence. If you apply a Deployment Configuration .xml file with customized settings, it will override the Package Manifest's defaults. If you apply a User Configuration .xml file with customized settings prior to the override of the Package Manifest's defaults, it will override both the deployment configuration and the Package Manifest's defaults. - -There are two types of configuration files: - -- **User Configuration file (UserConfig)**: Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V client. -- **Deployment Configuration file (DeploymentConfig)**: Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V client. - -You can use the UserConfig file to customize the settings for a package for a specific set of users on a computer or make changes that will be applied to local user locations such as HKCU. You can use the DeploymentConfig file to modify the default settings of a package for all users on a machine or make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the All Users folder. - -The UserConfig file provides configuration settings that you can apply to a single user without affecting any other users on a client: - -- Extensions that will be integrated into the native system per user: shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM. -- Virtual Subsystems: Application Objects, Environment variables, Registry modifications, Services, and Fonts. -- Scripts (user context only). - -The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the preceding UserConfig list: - -- All UserConfig settings from the preceding section in this topic -- Extensions that can only be applied globally for all users -- Virtual Subsystems that can be configured for global machine locations, such as the registry -- Product Source URL -- Scripts (Machine context only) -- Controls to terminate child processes - -## File structure - -The structure of the App-V Dynamic Configuration file is explained in the following section. - -## Dynamic User Configuration file - -### Header - -An example of a Dynamic User Configuration file's header is: - -```xml - -
Although ScriptRunner.exe is included in the App-V client, the App-V client's location must be in %path% or ScriptRunner won't run. `ScriptRunner.exe` is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.| -|`-appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10`
`-appvscript script2.vbs arg1 arg2`
`-appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 -rollbackonerror`|`-appvscript`—token that represents the actual script you want to run.
`script1.exe`—name of the script you want to run.
`arg1 arg2`—arguments for the script you want to run.
`-appvscriptrunnerparameters`—token that represents the execution options for script1.exe.
`-wait`—token that tells ScriptRunner to wait for execution of script1.exe to finish before proceeding to the next script.
`-timeout=x`—token that informs ScriptRunner to stop running the current script after *x* number of seconds. All other specified scripts will still run.
`-rollbackonerror`—token that tells ScriptRunner to stop running all scripts that haven't yet run and roll back an error to the App-V client.| -|`
Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts.
If any individual script reported an error and rollbackonerror was set to True, then ScriptRunner should report the error to App-V client.| - -ScriptRunner will run any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type isn't associated with any of the computer's applications, the script won't run. - -### Create a Dynamic Configuration file using an App-V Manifest file - -You can create the Dynamic Configuration file using one of three methods: manually, using the App-V Management Console, or by sequencing a package, which will generate a package with two sample files. - -For more information about how to create the file using the App-V Management Console, see [How to create a Custom Configuration file by using the App-V Management Console](appv-create-a-custom-configuration-file-with-the-management-console.md). - -To create the file manually, you can combine the components listed in the previous sections into a single file. However, we recommend you use files generated by the sequencer instead of manually created ones. - - - - - -## Related topics - -- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) -- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) -- [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md deleted file mode 100644 index 39c355141c..0000000000 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: How to enable only administrators to publish packages by using an ESD -description: Learn how to enable only administrators to publish packages by bsing an electronic software delivery (ESD). -author: aczechowski -ms.service: windows-client -ms.subservice: itpro-apps -ms.date: 05/02/2022 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: how-to ---- - -# How to enable only administrators to publish packages by using an ESD - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you couldn't prevent end users from performing these tasks. - -Here's how to enable only administrators to publish or unpublish packages: - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To instead use Windows PowerShell to set this item, see [Understanding pending packages: UserPending and GlobalPending](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#about-pending-packages-userpending-and-globalpending). - - - - diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md deleted file mode 100644 index 757e57fbf2..0000000000 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10/11) -description: How to Enable Reporting on the App-V Client by Using Windows PowerShell -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to Enable Reporting on the App-V Client by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to configure the App-V for reporting. - -**To configure the computer running the App-V client for reporting** - -1. Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings: - -|Setting|Description| -|--- |--- | -|ReportingEnabled|Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.| -|ReportingServerURL|Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.
**Note:**
This is the port number that was assigned during the Reporting Server setup| -|Reporting Start Time|This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.| -|ReportingRandomDelay|Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.| -|ReportingInterval|Specifies the retry interval that the client will use to resend data to the reporting server.| -|ReportingDataCacheLimit|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.| -|ReportingDataBlockSize|Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.| - -3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet. - - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md deleted file mode 100644 index 7622c5c8dd..0000000000 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Enable the App-V in-box client (Windows 10/11) -description: Learn how to enable the Microsoft Application Virtualization (App-V) in-box client installed with Windows 10/11. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Enable the App-V in-box client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -The App-V client is the component that runs virtualized applications on user devices. Once you enable the client, users can interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. - -Starting with Windows 10 version 1607, the App-V client is installed automatically. However, you'll still need to enable the client yourself to allow user devices to access and run virtual applications. You can set up the client with the Group Policy editor or with Windows PowerShell. - -Here's how to enable the App-V client with Group Policy: - -1. Open the device’s **Group Policy Editor**. -2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. -3. Run **Enables App-V Client**, then select **Enabled**. -4. Restart the device. - -Here's how to enable the App-V client with Windows PowerShell: - -1. Open Windows PowerShell. -2. Enter **Enable-Appv**, then select the Enter key. -3. Restart the device. -4. To verify that the App-V client is working, enter **Get-AppvStatus**, then select the Enter key. - -Check out these articles for more information about how to configure the App-V client: - -* [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) -* [How to modify client configuration by using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) -* [Using the client management console](appv-using-the-client-management-console.md) -* [How to configure the client to receive package and connection group updates from the Publishing server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - - - diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md deleted file mode 100644 index dc3deee0f3..0000000000 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Evaluating App-V (Windows 10/11) -description: Learn how to evaluate App-V for Windows 10/11 in a lab environment before deploying into a production environment. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Evaluating App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this article to set up App-V in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V Evaluation - -Use the following links for information about setting up the App-V sequencer on a computer in your lab environment. - -### Installing the App-V Sequencer and Creating Packages - -Use the following links for information about setting up the App-V sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](appv-install-the-sequencer.md) - -- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) - -### Configuring the App-V Server - -Use the following links for information about setting up the App-V server in your lab environment. - -- [How to Deploy the App-V server](appv-deploy-the-appv-server.md) - -- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) - -### Enabling the App-V Client - -Use the following links for more information about creating and managing virtualized packages in your lab environment. - -- [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - - -## Related articles - -- [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md deleted file mode 100644 index b2ded1f268..0000000000 --- a/windows/application-management/app-v/appv-for-windows.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Application Virtualization (App-V) (Windows 10/11) -description: See various articles that can help you administer Application Virtualization (App-V) and its components. -author: aczechowski -ms.service: windows-client -ms.date: 09/27/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Application Virtualization (App-V) for Windows client overview - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -The articles in this section provide information and instructions to help you administer App-V and its components. This information is for system administrators who manage large installations with many servers and clients, and for support personnel who interact directly with the computers or users. - -[Getting started with App-V](appv-getting-started.md) - -- [What's new in App-V](appv-about-appv.md) -- [Evaluating App-V](appv-evaluating-appv.md) -- [High-level architecture for App-V](appv-high-level-architecture.md) - -[Planning for App-V](appv-planning-for-appv.md) - -- [Preparing your environment for App-V](appv-preparing-your-environment.md) -- [App-V prerequisites](appv-prerequisites.md) -- [Planning to deploy App-V](appv-planning-to-deploy-appv.md) -- [App-V supported configurations](appv-supported-configurations.md) -- [App-V planning checklist](appv-planning-checklist.md) - -[Deploying App-V](appv-deploying-appv.md) - -- [Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md) -- [Deploying the App-V Server](appv-deploying-the-appv-server.md) -- [App-V deployment checklist](appv-deployment-checklist.md) -- [Deploying Microsoft Office 2016 by using App-V](appv-deploying-microsoft-office-2016-with-appv.md) -- [Deploying Microsoft Office 2013 by using App-V](appv-deploying-microsoft-office-2013-with-appv.md) -- [Deploying Microsoft Office 2010 by using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) - -[Operations for App-V](appv-operations.md) - -- [Creating and managing App-V virtualized applications](appv-creating-and-managing-virtualized-applications.md) -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-provision-a-vm.md) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-sequencing.md) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](appv-auto-batch-updating.md) -- [Administering App-V Virtual Applications by using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) -- [Managing connection groups](appv-managing-connection-groups.md) -- [Deploying App-V packages by using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) -- [Automatically clean up unpublished packages on the App-V client](appv-auto-clean-unpublished-packages.md) -- [Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md) -- [Maintaining App-V](appv-maintaining-appv.md) -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) - -[Troubleshooting App-V](appv-troubleshooting.md) - -[Technical reference for App-V](appv-technical-reference.md) - -- [Performance guidance for Application Virtualization](appv-performance-guidance.md) -- [Application publishing and client interaction](appv-application-publishing-and-client-interaction.md) -- [Viewing App-V Server publishing metadata](appv-viewing-appv-server-publishing-metadata.md) -- [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) - - - diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md deleted file mode 100644 index aab10ec1a4..0000000000 --- a/windows/application-management/app-v/appv-getting-started.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Getting Started with App-V (Windows 10/11) -description: Get started with Microsoft Application Virtualization (App-V) for Windows 10/11. App-V for Windows client devices delivers Win32 applications to users as virtual applications. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Getting started with App-V for Windows client - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -> [!NOTE] -> [!INCLUDE [Application Virtualization will be end of life in April 2026](../includes/app-v-end-life-statement.md)] - -Microsoft Application Virtualization (App-V) for Windows delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. - -Starting with Windows 10 version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows client and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). - -If you’re already using App-V, performing an in-place upgrade to Windows 10/11 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10/11, see [Upgrading to App-V for Windows from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). - ->[!IMPORTANT] ->You can upgrade your existing App-V installation to App-V for Windows from App-V versions 5.0 SP2 and higher only. If you are using an earlier version of App-V, you’ll need to upgrade your existing App-V installation to App-V 5.0 SP2 before upgrading to App-V for Windows. - -To learn more about previous versions of App-V, see [MDOP information experience](/microsoft-desktop-optimization-pack/index). - -## Getting started with App-V for Windows (new installations) - -To start using App-V to deliver virtual applications to users, you’ll need to download, enable, and install server- and client-side components. The following table describes the App-V for Windows client components, what they do, and where to find them. - - - -| Component | What it does | Where to find it | -|------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more information, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).
If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:
If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.
If you're using [Windows client for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx).
For more information about installing and using the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).| -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | Starting with Windows 10 version 1607, the App-V client is automatically installed.
To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | -| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows client](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | - -For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). - -If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/learning/default.aspx). - -## Getting started with App-V - -[What's new in App-V](appv-about-appv.md) provides a high-level overview of App-V and how it can be used in your organization? - -[Evaluating App-V](appv-evaluating-appv.md) provides information about how you can best evaluate App-V for use in your organization. - -[High Level Architecture for App-V](appv-high-level-architecture.md) provides a description of the App-V features and how they work together. - -## Other resources for this product - -* [Application Virtualization (App-V) overview](appv-for-windows.md) -* [Planning for App-V](appv-planning-for-appv.md) -* [Deploying App-V](appv-deploying-appv.md) -* [Operations for App-V](appv-operations.md) -* [Troubleshooting App-V](appv-troubleshooting.md) -* [Technical reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md deleted file mode 100644 index 1757dca790..0000000000 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: High-level architecture for App-V (Windows 10/11) -description: Use the information in this article to simplify your Microsoft Application Virtualization (App-V) deployment. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# High-level architecture for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following information to simplify your Microsoft Application Virtualization (App-V) deployment. - -## Architecture overview - -A typical App-V implementation consists of the following elements. - -|Element|Description| -|---|---| -|App-V Management server|The App-V Management server provides overall management functionality for the App-V infrastructure. Additionally, you can install more than one instance of the management server in your environment, which provides the following benefits:
**Fault tolerance and high availability**—installing and configuring the App-V Management server on two separate computers can help in situations when one of the servers is unavailable or offline. You can also help increase App-V availability by installing the Management server on multiple computers. In this scenario, consider using a network load balancer to keep server requests balanced.
**Scalability**—you can add more management servers as necessary to support a high load. For example, you can install multiple servers behind a load balancer.| -|App-V Publishing Server|The App-V publishing server provides functionality for virtual application hosting and streaming. The publishing server doesn't require a database connection and supports HTTP and HTTPS protocols.
You can also help increase App-V availability by installing the Publishing server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| -|App-V Reporting Server|The App-V Reporting server lets authorized users run and view existing App-V reports and unplanned reports for managing App-V infrastructure. The Reporting server requires a connection to the App-V reporting database. You can also help increase App-V availability by installing the Reporting server on multiple computers. You should also consider having a network load balancer to keep server requests balanced.| -|App-V Client|The App-V client enables packages created using App-V to run on target computers.| - ->[!NOTE] ->If you are using App-V with electronic software distribution (ESD), you aren't required to use the App-V Management server. However, you can still use App-V's reporting and streaming functionality. - -## Related articles - -- [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md deleted file mode 100644 index 911023aae0..0000000000 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10/11) -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell - -**Applies to** -- Windows Server 2016 - -Use the following Windows PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This item can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a Windows PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - .DESCRIPTION - This is a Windows PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { - param([System.Security.Principal.SecurityIdentifier]$sidToConvert) - $sb = New-Object System.Text.StringBuilder - [int] $binLength = $sidToConvert.BinaryLength - [Byte[]] $byteArray = New-Object Byte[] $binLength - $sidToConvert.GetBinaryForm($byteArray, 0) - foreach($byte in $byteArray) - { - $sb.Append($byte.ToString("X2")) |Out-Null - } - return $sb.ToString() - } - [string[]]$myArgs = $args - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - [string]::Format("{0}====== Description ======{0}{0}" + - " Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - " Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - " The output is written to the console in the format 'Account name SID as string SID as hexadecimal'{0}" + - " And can be written out to a file using standard Windows PowerShell redirection{0}" + - " Please specify user accounts in the format 'DOMAIN\username'{0}" + - " Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - " For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - "{0}====== Arguments ======{0}" + - "{0} /? Show this help message", [Environment]::NewLine) - { - else - { - #If an array was passed in, try to split it - if($myArgs.Length -eq 1) - { - $myArgs = $myArgs.Split(' ') - } - - #Parse the arguments for account names - foreach($accountName in $myArgs) - { - [string[]] $splitString = $accountName.Split('\') # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - if($splitString.Length -ne 2) - { - $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - Write-Error -Message $message - continue - } - #Convert any account names to SIDs - try - { - [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - } - catch [System.Security.Principal.IdentityNotMappedException] - { - $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - Write-Error -Message $message - continue - } - - #Convert regular SID to binary format used by SQL - $hexSIDString = ConvertSIDToHexFormat $SID - $SIDs = New-Object PSObject - $SIDs | Add-Member NoteProperty Account $accountName - $SIDs | Add-Member NoteProperty SID $SID.ToString() - $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - - Write-Output $SIDs - } - } - ``` - -3. Run the script you saved in Step 1 of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md deleted file mode 100644 index ba5480496d..0000000000 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services (Windows 10/11) -description: How to install the Management and Reporting Databases on separate computers from the Management and Reporting Services. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services - ->Applies to: Windows Server 2016 - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - ->[!NOTE] ->After you complete the deployment, the administrator installing the service will need the Microsoft SQL Server name, instance name and the database name to connect to these databases. - -## Installing the management database and the management server on separate computers - -1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**, then select **Next**. -4. On the **Feature selection** page, select the components you want to install by first selecting the **Management Server Database** checkbox, then selecting **Next**. -5. On the **Installation location** page, accept the default location and select **Next**. -6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. - * If you are using a custom SQL Server instance, select **Use a custom instance** and enter the name of the instance. - * If you are using a custom database name, select **Custom configuration** and enter the database name. -7. On the next **Create new management server database** page, select **Use a remote computer**, then enter the remote machine account using the following format: ```Domain\MachineAccount```. - - > [!NOTE] - >If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: ```Domain\AdministratorLoginName```. After that, select **Next**. -8. To start the installation, select **Install**. - -## Installing the reporting database and the reporting server on separate computers - -1. Copy the App-V server installation files to the computer you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. After that, select **Next**. -4. On the **Feature selection** page, select the components you want to install by first selecting the **Reporting Server Database** checkbox, then selecting **Next**. -5. On the **Installation Location** page, accept the default location and select **Next**. -6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**. - * If you're using a custom SQL Server instance, select **Use a custom instance** and enter the instance name. - * If you're using a custom database name, select **Custom configuration** and enter the database name. -7. On the next **Create new management server database** page, select **Use a remote computer**, and enter the remote machine account using the following format: ```Domain\MachineAccount```. - - > [!NOTE] - >If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. After that, select **Next**. -8. To start the installation, select **Install**. - -## Installing the management and reporting databases using App-V database scripts - -1. Copy the App-V server installation files to the computer on which you want to install it on. -2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - ```SQL - appv\_server\_setup.exe /LAYOUT /LAYOUTDIR=”InstallationExtractionLocation” - ``` - -3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: - - * The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - * The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - > [!NOTE] - >For more information about modifying the required SIDs contained in the scripts, see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). -5. Run the scripts on the computer running Microsoft SQL Server. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md deleted file mode 100644 index a9263f3cba..0000000000 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database (Windows 10/11) -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - ->Applies to: Windows Server 2016 - -To install the management server on a standalone computer and connect it to the database, follow these steps. - -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting Started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft Update, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**, then select **Next**. -4. On the **Feature Selection** page, select the **Management Server** checkbox, then select **Next**. -5. On the **Installation Location** page, accept the default location, then select **Next**. -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, then enter the computer running Microsoft SQL's machine name, such as ```SqlServerMachine```. - - > [!NOTE] - >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance**, then enter the instance's name. Specify the **SQL Server Database name** that this management server will use, such as ```AppvManagement```. -7. On the **Configure management server configuration** page, specify the following items: - * The AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - * The **Website Name** you want to use for the management service. Accept the default if you do not have a custom name. - * For the **Port Binding**, specify a unique port number, such as **12345**. -8. Select **Install**. -9. To confirm that the setup has completed successfully, open a web browser and enter the following URL: https://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings displayed. - - - - - -## Related articles - -* [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md deleted file mode 100644 index b25c54796c..0000000000 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Install the Publishing Server on a Remote Computer (Windows 10/11) -description: Use the procedures in this article to install the Microsoft Application Virtualization (App-V) publishing server on a separate computer. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# How to install the publishing server on a remote computer - ->Applies to: Windows Server 2016 - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -## Installing the publishing server on a separate computer - -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation, run **appv\_server\_setup.exe** as an administrator, then select **Install**. -2. On the **Getting started** page, review and accept the license terms, then select **Next**. -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended)**. To disable Microsoft Update, select **I don’t want to use Microsoft Update**. Click **Next**. -4. On the **Feature selection** page, select the **Publishing Server** checkbox, then select **Next**. -5. On the **Installation location** page, accept the default location, then select **Next**. -6. On the **Configure publishing server configuration** page, specify the following items: - - * The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - * Specify the website name that you want to use for the publishing service. If you don't have a custom name, then use the default name. - * For the **Port binding**, specify a unique port number that will be used by App-V. For example, **54321**. -7. On the **Ready to install** page, select **Install**. -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server: - - 1. Open the App-V management server console. - 2. In the left pane, select **Servers**, then select **Register New Server**. - 3. Enter the server name and a description (if required), then select **Add**. -9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: https://publishingserver:pubport. If the server is running correctly, information like the following example should appear. - - ```xml -
- True
- False| -|GlobalPending|Indicates whether the listed package has a pending task that is being applied globally to the computer:
- True
- False| - -The pending task will run later, according to the following rules: - -|Task type|Applicable rule| -|---|---| -|User-based
(for example, publishing a package to a user)|The pending task will be performed after the user logs off and then logs back on.| -|Globally based
(for example, enabling a connection group globally)|The pending task will be performed when the computer is shut down and then restarted.| - -For more information about pending tasks, see [Upgrading an in-use App-V package](appv-application-publishing-and-client-interaction.md#upgrading-an-in-use-app-v-package). - - - - - -## Related topics - -- [Operations for App-V](appv-operations.md) -- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md deleted file mode 100644 index 181e13b751..0000000000 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10/11) -description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group for the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](appv-connection-group-file.md). - -This article explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#to-add-and-publish-the-app-v-packages-in-the-connection-group) - -- [To add and enable the connection group on the App-V client](#to-add-and-enable-the-connection-group-on-the-app-v-client) - -- [To enable or disable a connection group for a specific user](#to-enable-or-disable-a-connection-group-for-a-specific-user) - -- [To allow only administrators to enable connection groups](#to-allow-only-administrators-to-enable-connection-groups) - -## To add and publish the App-V packages in the connection group - -1. To add and publish the App-V packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -## To add and enable the connection group on the App-V client - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name "Financial Applications" - - When any virtual applications that are in the member packages are run on the target computer, they'll run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -## To enable or disable a connection group for a specific user - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - |Cmdlet|Examples| - |--- |--- | - |Enable-AppVClientConnectionGroup|Enable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345| - |Disable-AppVClientConnectionGroup|Disable-AppVClientConnectionGroup "ConnectionGroupA" -UserSID S-1-2-34-56789012-3456789012-345678901-2345| - -## To allow only administrators to enable connection groups - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - |Cmdlet|Parameter and values|Example| - |--- |--- |--- | - |Set-AppvClientConfiguration|-RequirePublishAsAdmin
1| - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - - -[Operations for App-V](appv-operations.md) - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md deleted file mode 100644 index 7f676c5b81..0000000000 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Managing Connection Groups (Windows 10/11) -description: Connection groups can allow administrators to manage packages independently and avoid having to add the same application multiple times to a client computer. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Managing Connection Groups - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note** -In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. - -**In this section:** - -|Links|Description| -|--- |--- | -|[About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)|Describes the connection group virtual environment.| -|[About the Connection Group File](appv-connection-group-file.md)|Describes the connection group file.| -|[How to Create a Connection Group](appv-create-a-connection-group.md)|Explains how to create a new connection group.| -|[How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)|Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.| -|[How to Delete a Connection Group](appv-delete-a-connection-group.md)|Explains how to delete a connection group.| -|[How to Publish a Connection Group](appv-publish-a-connection-group.md)|Explains how to publish a connection group.| -|[How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)|Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.| -[How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)|Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.| - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for App-V connection groups - - -- [Operations for App-V](appv-operations.md) - - - - - - - - - diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md deleted file mode 100644 index cb9d2085c0..0000000000 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Migrating to App-V from a Previous Version (Windows 10/11) -description: Learn how to migrate to Microsoft Application Virtualization (App-V) for Windows 10/11 from a previous version. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Migrating to App-V from previous versions - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -To migrate from App-V 4.x to App-V for Windows 10/11, you must upgrade to App-V 5.x first. - -## Improvements to the App-V Package Converter - - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package. - -|New in App-V for Windows client|Prior to App-V for Windows 10| -|--- |--- | -|New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:
You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.|Registry information and scripts included in .osd files associated with a package weren't included in package converter output.
The package converter would populate the new package with information from all of the .osd files in the source directory.| - -### Example conversion statement - -To understand the new process, review the following example `ConvertFrom-AppvLegacyPackage` package converter statement. - -**If the source directory (\\\\OldPkgStore\\ContosoApp) includes the following:** - -- ContosoApp.sft - -- ContosoApp.msi - -- ContosoApp.sprj - -- ContosoApp\_manifest.xml - -- X.osd - -- Y.osd - -- Z.osd - -**And you run this command:** - -``` syntax -ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ --DestinationPath \\NewPkgStore\ContosoApp\ --OSDsToIncludeInPackage X.osd,Y.osd -``` - -**The following is created in the destination directory (\\\\NewPkgStore\\ContosoApp):** - -- ContosoApp.appv - -- ContosoApp.msi - -- ContosoApp\_DeploymentConfig.xml - -- ContosoApp\_UserConfig.xml - -- X\_Config.xml - -- Y\_Config.xml - -- Z\_Config.xml - -**In the above example:** - -|These Source directory files…|…are converted to these Destination directory files…|…and will contain these items|Description| -|--- |--- |--- |--- | -|
In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.| -|
In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it wasn't included as one of these arguments.| - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses Windows PowerShell to convert packages and can help automate the process if you have many packages that require conversion. App-V packages created with App-V 5.x don't need to be converted. - - -**Important** -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - -|Issue|Workaround| -|--- |--- | -|Virtual packages using DSC aren't linked after conversion.|Link the packages using connection groups. See [Managing Connection Groups](appv-managing-connection-groups.md).| -|Environment variable conflicts are detected during conversion.|Resolve any conflicts in the associated **.osd** file.| -|Hard-coded paths are detected during conversion.|Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it's recommended to re-sequence the package.| - -When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. - -**Note** -It's recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). - -If a converted package doesn't open after you convert it, it's also recommended that you resequence the application using the App-V sequencer. - -[How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) - -## Migrating the App-V Server Full Infrastructure - - -There's no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server. - -|Task|More Information| -|--- |--- | -|Review prerequisites.|[App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software)| -|Enable the App-V client.|[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)| -|Install App-V Server.|[How to Deploy the App-V Server](appv-deploy-the-appv-server.md)| -|Migrate existing packages.|See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this article.| - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Other resources for performing App-V migration tasks - -- [Operations for App-V](appv-operations.md) - -- [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](/archive/blogs/appv/a-simplified-microsoft-app-v-5-1-management-server-upgrade-procedure) diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md deleted file mode 100644 index d9b051f74f..0000000000 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ /dev/null @@ -1,155 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package (Windows 10/11) -description: Learn how to modify an existing virtual application package and add a new application to an existing virtual application package. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to Modify an Existing Virtual Application Package - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article explains how to: - -- [Update an application in an existing virtual application package](#update-an-application-in-an-existing-virtual-application-package) - -- [Modify the properties associated with an existing virtual application package](#modify-the-properties-associated-with-an-existing-virtual-application-package) - -- [Add a new application to an existing virtual application package](#add-a-new-application-to-an-existing-virtual-application-package) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -## Update an application in an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important** - If you're required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update doesn't have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you're finished with the installation, select **I am finished installing**. Click **Next**. - - >**Note** The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - >**Note** You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it's saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - - -## Modify the properties associated with an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - Import and export the manifest file. - - - Enable or disable Browser Helper Objects. - - - Import or export a VFS file. - - - Import a directory into the virtual file system. - - - Import and export virtual registry keys. - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review the extra package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - >**Note** To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -## Add a new application to an existing virtual application package - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you'll add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - >**Important** If you're required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application doesn't have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If more installation files must be run as part of the installation, click **Run**, and locate and run those installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this directory is a new location so that you don’t overwrite the existing version of the virtual application package. - - >**Note** The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you're finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you're customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - >**Note** You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md deleted file mode 100644 index 84f2710b45..0000000000 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10/11) -description: Learn how to modify the Application Virtualization (App-V) client configuration by using Windows PowerShell. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to Modify Client Configuration by Using Windows PowerShell - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to configure the App-V client configuration. - -1. To configure the client settings using Windows PowerShell, use the **Set-AppVClientConfiguration** cmdlet. For more information about installing Windows PowerShell, and a list of cmdlets see, [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md). - -2. To modify the client configuration, open a Windows PowerShell Command prompt and run **Set-AppVClientConfiguration** with any required parameters. For example: - - `$config = Get-AppVClientConfiguration` - - `Set-AppVClientConfiguration $config` - - `Set-AppVClientConfiguration –Name1 MyConfig –Name2 "xyz"` - - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md deleted file mode 100644 index 2b4ee820e3..0000000000 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer (Windows 10/11) -description: Learn how to create a new management server console in your environment and learn how to connect it to the App-V database. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to move the App-V server to another computer - -**Applies to** -- Windows Server 2016 - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -Follow these steps to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server, see [Deploying the App-V server](appv-deploying-the-appv-server.md). - -2. After you've completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md deleted file mode 100644 index 8af6d33a4d..0000000000 --- a/windows/application-management/app-v/appv-operations.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Operations for App-V (Windows 10/11) -description: Learn about the various types of App-V administration and operating tasks that are typically performed by an administrator. -author: aczechowski -ms.service: windows-client -ms.date: 04/18/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# Operations for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This section of the Microsoft Application Virtualization (App-V) Administrator’s Guide includes information about the various types of App-V administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - -- [Creating and Managing App-V Virtualized Applications](appv-creating-and-managing-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. -- [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. -- [Managing Connection Groups](appv-managing-connection-groups.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. -- [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) - - Describes how to deploy App-V packages by using an ESD. -- [Using the App-V Client Management Console](appv-using-the-client-management-console.md) - - Describes how to perform client configuration tasks using the client management console. -- [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) - - Provides instructions for migrating to App-V from a previous version. -- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V server tasks. - -## Additional information - -- [Application Virtualization (App-V) overview](appv-for-windows.md) -- [Getting Started with App-V](appv-getting-started.md) -- [Planning for App-V](appv-planning-for-appv.md) -- [Deploying App-V](appv-deploying-appv.md) -- [Troubleshooting App-V](appv-troubleshooting.md) -- [Technical Reference for App-V](appv-technical-reference.md) - - - diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md deleted file mode 100644 index aca5169513..0000000000 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ /dev/null @@ -1,496 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization -description: Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Performance Guidance for Application Virtualization - -**Applies to**: - -- Windows 7 SP1 -- Windows 10 -- Windows 11 -- Server 2012 R2 -- Server 2016 - -Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Application Virtualization (App-V) overview](appv-for-windows.md) - -- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) - -- [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760) - -> [!Note] -> Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk `*`, review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - -Finally, this document will provide you with the information to configure the computer running App-V client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment, you should review each section's brief overview and applicability checklist. - -## App-V in stateful\* non-persistent deployments - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This access is achieved by uniquely addressing the often long-running App-V publishing refresh. As you'll discover the basis of the approach, the fastest publishing refresh, is one that doesn't have to actually do anything. Many conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these scenarios are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you're concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – It's a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – It describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -|Checklist|Deployment Environment| -|--- |--- | -||Non-Persistent VDI or RDSH.| -||User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).| - -|Checklist|Expected Configuration| -|--- |--- | -||User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.| -||App-V Shared Content Store (SCS) is configured or can be configured.| - - -|Checklist|IT Administration| -|--- |--- | -||Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.| - -### Usage Scenarios - -As you review the two scenarios, keep in mind that these scenarios represent the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - -- **Performance**: To provide the most optimal user experience, this approach uses the capabilities of a UPM solution and requires extra image preparation and can incur some more image management overhead. - - The following section describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) (in this article). - -- **Storage**: The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in costly arrays; a slight alteration has been made to the approach. Don't pre-configure user-targeted virtual application packages in the base image. - - The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) (in this article). - -### Preparing your Environment - -The following information displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -#### Prepare the Base Image - -- **Performance**: - - - Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md). - - Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps. - - Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - - Configure Preserve User Integrations on Login Registry DWORD. - - Pre-configure all user and global-targeted packages, for example, **Add-AppvClientPackage**. - - Pre-configure all user- and global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**. - - Pre-publish all global-targeted packages. Or: - - Perform a global publishing/refresh. - - Perform a user publishing/refresh. - - Unpublish all user-targeted packages. - - Delete the following user-Virtual File System (VFS) entries: - - - `AppData\Local\Microsoft\AppV\Client\VFS` - - `AppData\Roaming\Microsoft\AppV\Client\VFS` - -- **Storage**: - - - Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md). - - Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps. - - Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - - Configure Preserve User Integrations on Login Registry DWORD. - - Pre-configure all global-targeted packages, for example, **Add-AppvClientPackage**. - - Pre-configure all global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**. - - Pre-publish all global-targeted packages. - -#### Configurations - -For critical App-V Client configurations and for a little more context and how-to, review the following configuration settings: - -- **Shared Content Store (SCS) Mode**: When running the shared content store, only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM). Such a result helps to conserve local storage and minimize disk I/O per second (IOPS). - - This setting is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN. - - - Configurable in Windows PowerShell: `Set-AppvClientConfiguration -SharedContentStoreMode 1` - - Configurable with Group Policy: See [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md). - -- **PreserveUserIntegrationsOnLogin**: If you have not pre-configured (**Add-AppvClientPackage**) a specific package and this setting isn't configured, the App-V Client will de-integrate* the persisted user integrations, then reintegrate*. - - For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh. - - If you don't plan to pre-configure every available user package in the base image, use this setting. - - - Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Integration`. - - Create the DWORD value **PreserveUserIntegrationsOnLogin** with a value of 1. - - Restart the App-V client service or restart the computer running the App-V Client. - -- **MaxConcurrentPublishingRefresh**: This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit. - - Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync. - - If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they sign in could take an indeterminate amount of time. - - - Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing`. - - Create the DWORD value **MaxConcurrentPublishingrefresh** with the desired maximum number of concurrent publishing refreshes. - - The App-V client service and computer don't need to be restarted. - -### Configure UE-V solution for App-V Approach - -We recommend using User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information, see: - -- [User Experience Virtualization (UE-V) for Windows client overview](/windows/configuration/ue-v/uev-for-windows) - -- [Get Started with UE-V](/windows/configuration/ue-v/uev-getting-started) - -> [!Note] -> Without performing an additional configuration step, User Environment Virtualization (UE-V) won't be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user's device will have the same set of applications installed to the same location and every .lnk file is valid for all the users' devices. For example, UE-V wouldn't currently support the following two scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - -> [!Important] -> This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - -Using the Microsoft Registry Editor (regedit.exe), navigate to `HKEY\_LOCAL\_MACHINE\Software\Microsoft\UEV\Agent\Configuration\ExcludedFileTypes` and remove `.lnk` from the excluded file types. - -## Configure other User Profile Management (UPM) solutions for App-V Approach - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized sign-in experience, for example the App-V approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on sign in (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - - > [!Note] - > - > App-V is supported when using UPD only when the entire profile is stored on the user profile disk. - > - > App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver doesn't handle UPD selected folders. - -- Capturing changes to the locations, which constitute the user integrations, prior to session sign out. - -With App-V when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during a sign in and/or after a specified refresh interval. In both cases, a scheduled task is created. - -In previous versions of App-V, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. Starting with Hotfix Package 4 for Application Virtualization 5.0 SP2, the user refresh on a sign in was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -### User Integrations - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -### File Locations - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -### User Experience Walk-through - -This following process is a step-by-step walk-through of the App-V and UPM operations, and the users' expectations. - -- **Performance**: After implementing this approach in the VDI/RDSH environment, on first login, - - (Operation) A user-publishing/refresh is initiated. - - (Expectation) If it's the first time that a user has published virtual applications (for example, non-persistent), this operation will take the usual duration of a publishing/refresh. - -- (Operation) After the publishing/refresh, the UPM solution captures the user integrations. - - (Expectation) Depending on how the UPM solution is configured, this capture may occur as part of the sign-out process. This result will incur the same/similar overhead as persisting the user state. - - **On subsequent logins**: - - - (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh. - - (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (that is, package entitlements change), some may go away. - - - (Operation) Publishing/refresh will process unpublish and publish operations for changes in user package entitlements. - - (Expectation) If there are no entitlement changes, publishing will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity of virtual applications - - The publishing operation (**Publish-AppVClientPackage**) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. - - - (Operation) UPM solution will capture user integrations again at sign off. - - (Expectation) Same as previous. - - **Outcome**: - - - Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of sign in. - - The publishing/refresh will process changes to the users-entitled virtual applications, which impacts the experience. - -- **Storage**: After implementing this approach in the VDI/RDSH environment, on first login - - - (Operation) A user-publishing/refresh is initiated. - - (Expectation): - - - If this instance is the first time a user has published virtual applications (for example, non-persistent), this will take the usual duration of a publishing/refresh. - - First and subsequent logins will be impacted by pre-configuring of packages (add/refresh). - - - (Operation) After the publishing/refresh, the UPM solution captures the user integrations. - - (Expectation) Depending on how the UPM solution is configured, this capture may occur as part of the sign-off process. This result will incur the same/similar overhead as persisting the user state. - - **On subsequent logins**: - - - (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh. - - (Operation) Add/refresh must pre-configure all user targeted applications. - - - (Expectation): - - This may increase the time to application availability significantly (on the order of 10s of seconds). - - This will increase the publishing refresh time relative to the number and complexity* of virtual applications. - - - (Operation) Publishing/refresh will process unpublish and publish operations for changes to user package entitlements. - - **Outcome**: Because the add/refresh must reconfigure all the virtual applications to the VM, the publishing refresh time on every login will be extended. - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (unpublished) virtual application packages, it's recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the unpublish or publish operation, respectively, would fail. - -- Now, if a package is in use, the operation will be pended. The unpublish and publish-pend operations will be processed on service restart or if another publish or unpublish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it's unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it isn't applied to the environment prior to a sign in, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -#### Windows Server - -Server performance tuning guidelines for [Microsoft Windows Server 2012 R2](/previous-versions/dn529133(v=vs.85)) - -#### Server roles - -- [Remote Desktop Virtualization Host](/previous-versions/dn567643(v=vs.85)) - -- [Remote Desktop Session Host](/previous-versions/dn567648(v=vs.85)) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](/previous-versions/dn567678(v=vs.85)) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134210(v=ws.11)) - -#### Windows Client (guest OS) performance tuning guidance - -- [The Microsoft Premier Field Engineer (PFE) view on Virtual Desktop (VDI) Density](/archive/blogs/jeff_stokes/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density) - -- [Optimization Script: (Provided by Microsoft Support)](/archive/blogs/jeff_stokes/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe) - -## Sequencing Steps to Optimize Packages for Publishing Performance - -Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - -|Step|Consideration|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|No Feature Block 1 (FB1, also known as Primary FB)|No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:
Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.
Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.|Publishing times will improve if these files are used selectively or not at all.|Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.| - - -### Disabling a Dynamic Configuration by using Windows PowerShell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, don't use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) - -- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) - -|Step|Considerations|Benefits|Tradeoffs| -|--- |--- |--- |--- | -|Account for Synchronous Script Execution during Package Lifecycle.|If script collateral is embedded in the package, Add cmdlets may be slower.
Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.|Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.|This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.| -|Remove Extraneous Virtual Fonts from Package.|Most applications investigated by the App-V product team contained a few fonts, typically fewer than 20.|Virtual Fonts impact publishing refresh performance.|Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.| - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following syntax: - - ```xml -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -Help us to improve diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md deleted file mode 100644 index 2e05013ad9..0000000000 --- a/windows/application-management/app-v/appv-reporting.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: About App-V Reporting (Windows 10/11) -description: Learn how the App-V reporting feature collects information about computers running the App-V client and virtual application package usage. -author: aczechowski -ms.service: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# About App-V reporting - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Application Virtualization (App-V) includes a built-in reporting feature that collects information about computers running the App-V client and virtual application package usage. You can generate reports from a centralized database with this information. - -## App-V reporting overview - -The following list displays the end–to-end high-level workflow for reporting in App-V. - -1. The App-V Reporting server requires the following things: - - * Internet Information Service (IIS) web server role - * Windows Authentication role (under **IIS / Security**) - * SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, enter `https://localhost/Reports` in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. -2. Install the App-V reporting server and associated database. For more information about installing the reporting server, see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you aren't using an electronic software distribution system such as Configuration Manager to view reports, then you can define reports in SQL Server Reporting Service. - - > [!NOTE] - >If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. -4. After importing the App-V Windows PowerShell module using **Import-Module AppvClient** as administrator, enable App-V client reporting. This sample Windows PowerShell command enables App-V reporting: - - ```PowerShell - Set-AppvClientConfiguration -ReportingServerURL
The previous example will send the reporting data to the ```\\MyShare\MyData\``` location indicated by the **-URL** parameter. After the data has been sent, the cache is cleared.| - ->[!NOTE] ->If a location other than the Reporting Server is specified, the data is sent in **.xml** format with no additional processing. - -### Creating reports - -To retrieve report information and create reports using App-V, you must use one of the following methods: - -* Microsoft SQL Server Reporting Services (SSRS)—Microsoft SSRS is available with Microsoft SQL Server. SSRS isn't installed when you install the App-V reporting server. It must be deployed separately to generate the associated reports. For more information, see the [What is SQL Server Reporting Services (SSRS)?](/sql/reporting-services/create-deploy-and-manage-mobile-and-paginated-reports) article. - -* Scripting—You can generate reports by scripting directly against the App-V reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. Make sure the Microsoft SQL Server Agent is set to **AutoStart**. For more information, see [Autostart SQL Server Agent (SQL Server Management Studio)](/sql/ssms/agent/autostart-sql-server-agent-sql-server-management-studio). - - The stored procedure is also created when you use the App-V database scripts. - -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server can manage without affecting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - - - - - -## Related articles - -* [Deploying the App-V server](appv-deploying-the-appv-server.md) -* [How to install the reporting server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md) diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md deleted file mode 100644 index 4e4f47b94f..0000000000 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications (Windows 10/11) -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: aczechowski -ms.service: windows-client -ms.date: 03/08/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - -**Applies to** -- Windows 7 SP1 -- Windows 10 -- Windows 11 -- Windows Server 2012 R2 -- Windows Server 2016 - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this task if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage Windows PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There's no Group Policy setting available to manage this registry key. So, you have to use Microsoft Intune or Configuration Manager, another electronic software distribution (ESD) system, or manually edit the registry. - -Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages globally or to the user. - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - **Published globally**: Create the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key. - - For example, create `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`. - - - **Published to the user**: Create the `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key. - - For example, create `HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`. - - - Connection group can be: - - Packages that are published globally or just to the user - - Packages that are published globally and to the user - - Use the `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER` key. But, all of the following conditions must be fulfilled: - - - If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group. - - Create only one subkey for one of the packages in the connection group. For example, you have one package that is published globally and another package that is published to the user. You create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment. - - The key under which you create the subkey must match the publishing method you used for the package. - - For example, if you published the package to the user, you must create the subkey under `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual`. Don't add a key for the same application under both hives. - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: `
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md deleted file mode 100644 index f96111505d..0000000000 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: App-V Supported Configurations (Windows 10/11) -description: Learn the requirements to install and run App-V supported configurations in your Windows 10/11 environment. -author: aczechowski -ms.service: windows-client -ms.date: 04/16/2018 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.topic: article -ms.subservice: itpro-apps ---- - -# App-V Supported Configurations - -**Applies to**: - -- Windows 10 -- Windows 11 -- Windows Server 2019 -- Windows Server 2016 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 (Extended Security Update) - -This article specifies the requirements to install and run App-V in your Windows client environment. For information about prerequisite software such as the .NET Framework, see [App-V prerequisites](appv-prerequisites.md). - -## App-V Server system requirements - -This section lists the operating system and hardware requirements for all App-V server components. - -### Unsupported App-V server scenarios - -The App-V server does not support the following scenarios: - -* Deployment to a computer that runs the Server Core installation option. -* Deployment to a computer that runs a previous version of the App-V server components. You can only install App-V side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server. This scenario doesn't support side-by-side deployment of App-V and the Application Virtualization Management Service (HWS) 4.x. -* Deployment to a computer running Microsoft SQL Server Express edition. -* Deployment to a domain controller. -* Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 (Extended Security Update) or later. - ->[!IMPORTANT] ->Deploying a Management server role to a computer with Remote Desktop Services enabled is not supported. - -### Management server hardware requirements - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 1-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Management server database requirements - -The following table lists the SQL Server versions that the App-V Management database installation supports. - -|SQL Server version|Service pack|System architecture| -|---|---|---| -|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| -|Microsoft SQL Server 2017||32-bit or 64-bit| -|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2014||32-bit or 64-bit| -|Microsoft SQL Server 2012|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| - -For more information on user configuration files with SQL server 2016 or later, see the [support article](https://support.microsoft.com/help/4548751/app-v-server-publishing-might-fail-when-you-apply-user-configuration-f). - -### Publishing server operating system requirements - -The App-V Publishing server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later. - -### Publishing server hardware requirements - -App-V adds require nothing beyond the requirements of Windows Server. - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 2-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Reporting server operating system requirements - -You can install the App-V Reporting server on a server running Windows Server 2008 R2 with SP1 or later. - -### Reporting server hardware requirements - -App-V adds no other requirements beyond those requirements of Windows Server. - -* A 64-bit (x64) processor that runs at 1.4 GHz or faster. -* 2-GB RAM (64-bit). -* 200 MB of available hard disk space, not including the content directory. - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V Reporting database installation. - -|SQL Server version|Service pack|System architecture| -|---|---|---| -|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| -|Microsoft SQL Server 2017||32-bit or 64-bit| -|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2014||32-bit or 64-bit| -|Microsoft SQL Server 2012|SP2|32-bit or 64-bit| -|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| - -## App-V client and Remote Desktop Services client requirements - -Starting with Windows 10 version 1607, the App-V client is included with Windows Enterprise and Windows Education. The App-V client is no longer part of the Microsoft Desktop Optimization Pack. Before you can use the App-V client, it must be enabled, as described in [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -Similarly, the App-V Remote Desktop Services (RDS) client is included with Windows Server 2016 Standard and Windows Server 2016 Datacenter. - -## Sequencer system requirements - -Sequencer is now part of the Windows Assessment and Deployment Kit (Windows ADK). [Download the latest Windows ADK](/windows-hardware/get-started/adk-install) that is recommended for your version of the Windows OS. - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. - -## Supported versions of Microsoft Configuration Manager - -The App-V client works with Configuration Manager versions starting with Technical Preview for Configuration Manager, version 1606. - -## Related articles - -* [Planning to deploy App-V](appv-planning-to-deploy-appv.md) -* [App-V prerequisites](appv-prerequisites.md) diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md deleted file mode 100644 index 50ffd5963b..0000000000 --- a/windows/application-management/app-v/appv-technical-reference.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Technical Reference for App-V (Windows 10/11) -description: Learn strategy and context for many performance optimization practices in this technical reference for Application Virtualization (App-V). -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Technical Reference for App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This section provides reference information related to managing App-V. - -## In This Section - - -- [Performance Guidance for Application Virtualization](appv-performance-guidance.md) - - Provides strategy and context for many performance optimizations. Not all practices will be applicable. However, these practices are tested and supported. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) - -Describes how the following App-V client operations affect the local operating system: - -- App-V files and data storage locations -- Package registry -- Package store behavior -- Roaming registry and data -- Client application lifecycle management -- Integration of App-V packages -- Dynamic configuration -- Side-by-side assemblies -- Client logging - -- [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) - - Tells how to view publishing metadata, which can help you resolve publishing-related issues. - -- [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) - - Describes reasons and methods for running a locally installed application in a virtual environment, alongside applications that have been virtualized by using Application Virtualization (App-V). - - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md) - -[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) - -[Windows PowerShell reference for App-V](/previous-versions/) diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md deleted file mode 100644 index d2fbaa8450..0000000000 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console (Windows 10/11) -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V Management Console. Select the package to which you'll transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, and the configuration settings, will be copied. - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md deleted file mode 100644 index 0cde4c8496..0000000000 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Troubleshooting App-V (Windows 10/11) -description: Learn how to find information about troubleshooting Application Virtualization (App-V) and information about other App-V articles. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Troubleshooting App-V - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -For information that can help with troubleshooting App-V for Windows client, see: - -- [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - -- [Microsoft App-V Team Blog](/archive/blogs/appv/) - -- [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) - -- [Technical Reference for App-V](appv-technical-reference.md) - -- [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv) - - -## Other resources - -- [Application Virtualization (App-V) for Windows client overview](appv-for-windows.md) - -- [Getting Started with App-V for Windows client](appv-getting-started.md) - -- [Planning for App-V](appv-planning-for-appv.md) - -- [Deploying App-V](appv-deploying-appv.md) - -- [Operations for App-V](appv-operations.md) - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md deleted file mode 100644 index 872fdc6b2a..0000000000 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Upgrading to App-V for Windows 10/11 from an existing installation (Windows 10/11) -description: Learn about upgrading to Application Virtualization (App-V) for Windows 10/11 from an existing installation. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Upgrading to App-V for Windows client from an existing installation - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -If you’re already using App-V and you’re planning to upgrade user devices to Windows 10/11, you need to make only the following few adjustments to your existing environment to start using App-V for Windows client. - -1. [Upgrade user devices to Windows 10/11](#upgrade-user-devices-to-windows-1011). Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. - -2. [Verify that App-V applications and settings were migrated correctly](#verify-that-app-v-applications-and-settings-were-migrated-correctly). - -3. [Enable the in-box App-V client](#enable-the-in-box-app-v-client). - -4. [Configure the in-box App-V client to point to previously installed App-V server components](#configure-the-in-box-app-v-client-to-point-to-previously-installed-app-v-server-components). - -5. [Verify that the in-box App-V client can receive and launch .appv packages](#verify-that-the-in-box-app-v-client-can-receive-and-launch-appv-packages). - -These steps are explained in more detail below. - -## Upgrade user devices to Windows 10/11 - -Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. See the [Windows document set](/windows/windows-10/) for information about upgrading user devices. - -## Verify that App-V applications and settings were migrated correctly - -After upgrading a user device, it’s important to verify that App-V applications and settings were migrated correctly during the upgrade. - -To verify that the user’s App-V application packages were migrated correctly, type `Get-AppvClientPackage` in Windows PowerShell. - -To verify that the user’s App-V settings were migrated correctly, type `Get-AppvClientConfiguration` in Windows PowerShell. - -## Enable the in-box App-V client - -With Windows 10/11, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. - -**To enable the App-V client with Group Policy** - -1. Open the device’s **Group Policy Editor**. - -2. Navigate to **Computer Configuration > Administrative Templates > System > App-V**. - -3. Run **Enables App-V Client** and then select **Enabled** on the screen that appears. - -4. Restart the device. - -**To enable the App-V client with Windows PowerShell** - -1. Open Windows PowerShell. - -2. Type `Enable-Appv` and press enter. - -3. Restart the device. - -4. To verify that the App-V client is enabled on the device, enter `AppvClientEnabled` or `Get-AppvStatus` in Windows PowerShell. - -## Configure the in-box App-V client to point to previously installed App-V server components - -Once you’ve enabled the in-box App-V client, you need to configure it to point to your existing App-V server components. You can configure the App-V client with Windows PowerShell cmdlets or with the device’s local Group Policy editor. - -**To modify client settings to point to an existing App-V publishing server with Windows PowerShell** - -Type the following cmdlet in a Windows PowerShell window: - -`Add-AppvPublishingServer -Name AppVServer -URL https:// appvserver:2222` - -**To modify client settings to point to an existing App-V publishing server with Group Policy** - -1. Open the device’s **Local Group Policy Editor**. - -2. Navigate to **Computer Configuration > Administrative Templates > System > App-V > Publishing**. - -3. Enter your existing App-V publishing server’s details in **Options** and then click or press **Apply**. - -## Verify that the in-box App-V client can receive and launch .appv packages - -1. Add and publish a package using the following Windows PowerShell cmdlets: - - `Add-AppvClientPackage \\path\to\appv\package.appv | Publish-AppvClientPackage` - -2. Launch the published package. - -3. Unpublish an existing package use the following cmdlet: - - `Unpublish-AppvClientPackage "ContosoApplication"` - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md deleted file mode 100644 index 5d99029e54..0000000000 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Using the App-V Client Management Console (Windows 10/11) -description: Learn how to use the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Using the App-V Client Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -This article provides information about using the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. - -## Options for managing the App-V client - -The App-V client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client, or you can use Windows PowerShell or Group Policy. For more information about configuring the client by using Windows PowerShell or Group Policy, see: - -- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) - -- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - -## The App-V client management console - -You can obtain information about the App-V client or perform specific tasks by using the App-V client management console. Many of the tasks that you can perform in the client management console you can also perform by using Windows PowerShell. The associated Windows PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use Windows PowerShell, see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md). - -The client management console contains the following described main tabs. - -- **Overview**: The **Overview** tab contains the following elements: - - - **Update**: Refreshes a virtualized application or to receive a new virtualized package. - - **Last Refresh**: Displays the current version of the virtualized package. - - **Download all virtual applications**: Use the Download tile to download all of the packages provisioned to the current user. - - Associated Windows PowerShell cmdlet: `Mount-AppvClientPackage` - - - **Work Offline**: Disallows all automatic and manual virtual application updates. - - Associated Windows PowerShell cmdlet: `-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled` - -- **VIRTUAL APPS**: Displays all of the packages that have been published to the user. - - You can also click a specific package and see all of the applications that are part of that package. This option displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads, and repair the user state. A repair will delete all user data that is associated with a package. - -- **APP CONNECTION GROUPS**: Displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group. - - Associated Windows PowerShell cmdlets: - - - Download: `Mount-AppvClientConnectionGroup` - - Repair: `AppvClientConnectionGroup` - -For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md deleted file mode 100644 index 97d6680ac1..0000000000 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console (Windows 10/11) -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - -[!INCLUDE [Applies to Windows client versions](../includes/applies-to-windows-client-versions.md)] - -Use the following procedure to view and configure default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - - - -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md deleted file mode 100644 index f652726838..0000000000 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata (Windows 10/11) -description: Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. -author: aczechowski -ms.service: windows-client -ms.date: 04/19/2017 -ms.reviewer: -manager: aaroncz -ms.author: aaroncz -ms.collection: must-keep -ms.subservice: itpro-apps -ms.topic: article ---- - -# Viewing App-V Server Publishing Metadata - -**Applies to** -- Windows Server 2016 - -Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system](#bkmk-values-query-pub-meta) - -## Definition of publishing metadata - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - -## Query syntax for viewing publishing metadata - -This section provides information about queries for viewing publishing metadata for App-V 5.0 SP3 Server and App-V 5.1 server. The App-V server components have not changed since App-V 5.0 was released, so App-V 5.x Server is the version of the server used with App-V for Windows client. - -**Query syntax** - -`http://
`(Get-CimInstance Win32_OperatingSystem).version` | -| `ClientOS=
You can omit this parameter, with the result that only the packages that were sequenced to support all operating systems will appear in the metadata. | - -To get the name of the Publishing server and the port number (`http://
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related articles - -[Technical Reference for App-V](appv-technical-reference.md) diff --git a/windows/application-management/app-v/images/app-v-in-adk.png b/windows/application-management/app-v/images/app-v-in-adk.png deleted file mode 100644 index a36ef9f00f..0000000000 Binary files a/windows/application-management/app-v/images/app-v-in-adk.png and /dev/null differ diff --git a/windows/application-management/app-v/images/checklistbox.gif b/windows/application-management/app-v/images/checklistbox.gif deleted file mode 100644 index cbcf4a4f11..0000000000 Binary files a/windows/application-management/app-v/images/checklistbox.gif and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png b/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png deleted file mode 100644 index 775e290a36..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata-global.png and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png b/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png deleted file mode 100644 index 0e1205c62b..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata-stream.png and /dev/null differ diff --git a/windows/application-management/app-v/images/packageaddfileandregistrydata.png b/windows/application-management/app-v/images/packageaddfileandregistrydata.png deleted file mode 100644 index 603420e627..0000000000 Binary files a/windows/application-management/app-v/images/packageaddfileandregistrydata.png and /dev/null differ diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index 371bc58a37..7a3b8812e1 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -46,16 +46,16 @@ landingContent: - linkListType: overview links: - text: App-V overview - url: app-v/appv-for-windows.md + url: /microsoft-desktop-optimization-pack/app-v/appv-for-windows - text: Getting started with App-V - url: app-v/appv-getting-started.md + url: /microsoft-desktop-optimization-pack/app-v/appv-getting-started - text: Planning for App-V - url: app-v/appv-planning-for-appv.md + url: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-appv - text: Deploying App-V - url: app-v/appv-deploying-appv.md + url: /microsoft-desktop-optimization-pack/app-v/appv-deploying-appv - text: Operations for App-V - url: app-v/appv-operations.md + url: /microsoft-desktop-optimization-pack/app-v/appv-operations - text: Troubleshooting App-V - url: app-v/appv-troubleshooting.md + url: /microsoft-desktop-optimization-pack/app-v/appv-troubleshooting - text: Technical Reference for App-V - url: app-v/appv-technical-reference.md + url: /microsoft-desktop-optimization-pack/app-v/appv-technical-reference diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 1308c9ba12..7e86c36a76 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -20,236 +20,236 @@ items: - name: Application Virtualization (App-V) items: - name: App-V for Windows overview - href: app-v/appv-for-windows.md + href: /microsoft-desktop-optimization-pack/app-v/appv-for-windows - name: Getting Started items: - name: Getting Started with App-V - href: app-v/appv-getting-started.md + href: /microsoft-desktop-optimization-pack/app-v/appv-getting-started - name: What's new items: - name: What's new in App-V for Windows 10, version 1703 and earlier - href: app-v/appv-about-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-about-appv - name: Release Notes for App-V for Windows 10, version 1607 - href: app-v/appv-release-notes-for-appv-for-windows.md + href: /microsoft-desktop-optimization-pack/app-v/appv-release-notes-for-appv-for-windows - name: Release Notes for App-V for Windows 10, version 1703 - href: app-v/appv-release-notes-for-appv-for-windows-1703.md + href: /microsoft-desktop-optimization-pack/app-v/appv-release-notes-for-appv-for-windows-1703 - name: Evaluating App-V - href: app-v/appv-evaluating-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-evaluating-appv - name: High Level Architecture for App-V - href: app-v/appv-high-level-architecture.md + href: /microsoft-desktop-optimization-pack/app-v/appv-high-level-architecture - name: Planning items: - name: Planning for App-V - href: app-v/appv-planning-for-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-appv - name: Preparing your environment items: - name: Preparing your environment for App-V - href: app-v/appv-preparing-your-environment.md + href: /microsoft-desktop-optimization-pack/app-v/appv-preparing-your-environment - name: App-V Prerequisites - href: app-v/appv-prerequisites.md + href: /microsoft-desktop-optimization-pack/app-v/appv-prerequisites - name: App-V security considerations - href: app-v/appv-security-considerations.md + href: /microsoft-desktop-optimization-pack/app-v/appv-security-considerations - name: Planning to deploy items: - name: Planning to Deploy App-V - href: app-v/appv-planning-to-deploy-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-to-deploy-appv - name: App-V Supported Configurations - href: app-v/appv-supported-configurations.md + href: /microsoft-desktop-optimization-pack/app-v/appv-supported-configurations - name: App-V Capacity Planning - href: app-v/appv-capacity-planning.md + href: /microsoft-desktop-optimization-pack/app-v/appv-capacity-planning - name: Planning for High Availability with App-V - href: app-v/appv-planning-for-high-availability-with-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-high-availability-with-appv - name: Planning to Deploy App-V with an Electronic Software Distribution System - href: app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions - name: Planning for the App-V Server Deployment - href: app-v/appv-planning-for-appv-server-deployment.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-appv-server-deployment - name: Planning for the App-V Sequencer and Client Deployment - href: app-v/appv-planning-for-sequencer-and-client-deployment.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-sequencer-and-client-deployment - name: Planning for Using App-V with Office - href: app-v/appv-planning-for-using-appv-with-office.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-for-using-appv-with-office - name: Planning to Use Folder Redirection with App-V - href: app-v/appv-planning-folder-redirection-with-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-folder-redirection-with-appv - name: App-V Planning Checklist - href: app-v/appv-planning-checklist.md + href: /microsoft-desktop-optimization-pack/app-v/appv-planning-checklist - name: Deploying items: - name: Deploying App-V - href: app-v/appv-deploying-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-appv - name: App-V sequencer and client configuration items: - name: Deploying the App-V Sequencer and Configuring the Client - href: app-v/appv-deploying-the-appv-sequencer-and-client.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-the-appv-sequencer-and-client - name: About Client Configuration Settings - href: app-v/appv-client-configuration-settings.md + href: /microsoft-desktop-optimization-pack/app-v/appv-client-configuration-settings - name: Enable the App-V desktop client - href: app-v/appv-enable-the-app-v-desktop-client.md + href: /microsoft-desktop-optimization-pack/app-v/appv-enable-the-app-v-desktop-client - name: How to Install the Sequencer - href: app-v/appv-install-the-sequencer.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-sequencer - name: App-V server deployment items: - name: Deploying the App-V Server - href: app-v/appv-deploying-the-appv-server.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-the-appv-server - name: How to Deploy the App-V Server - href: app-v/appv-deploy-the-appv-server.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploy-the-appv-server - name: How to Deploy the App-V Server Using a Script - href: app-v/appv-deploy-the-appv-server-with-a-script.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploy-the-appv-server-with-a-script - name: How to Deploy the App-V Databases by Using SQL Scripts - href: app-v/appv-deploy-appv-databases-with-sql-scripts.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploy-appv-databases-with-sql-scripts - name: How to Install the Publishing Server on a Remote Computer - href: app-v/appv-install-the-publishing-server-on-a-remote-computer.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-publishing-server-on-a-remote-computer - name: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - href: app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers - name: How to install the Management Server on a Standalone Computer and Connect it to the Database - href: app-v/appv-install-the-management-server-on-a-standalone-computer.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-management-server-on-a-standalone-computer - name: About App-V Reporting - href: app-v/appv-reporting.md + href: /microsoft-desktop-optimization-pack/app-v/appv-reporting - name: How to install the Reporting Server on a Standalone Computer and Connect it to the Database - href: app-v/appv-install-the-reporting-server-on-a-standalone-computer.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-reporting-server-on-a-standalone-computer - name: App-V Deployment Checklist - href: app-v/appv-deployment-checklist.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deployment-checklist - name: Deploying Microsoft Office 2016 by Using App-V - href: app-v/appv-deploying-microsoft-office-2016-with-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2016-with-appv - name: Deploying Microsoft Office 2013 by Using App-V - href: app-v/appv-deploying-microsoft-office-2013-with-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2013-with-appv - name: Deploying Microsoft Office 2010 by Using App-V - href: app-v/appv-deploying-microsoft-office-2010-wth-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-microsoft-office-2010-wth-appv - name: Operations items: - name: Operations for App-V - href: app-v/appv-operations.md + href: /microsoft-desktop-optimization-pack/app-v/appv-operations - name: Creating and managing virtualized applications items: - name: Creating and Managing App-V Virtualized Applications - href: app-v/appv-creating-and-managing-virtualized-applications.md + href: /microsoft-desktop-optimization-pack/app-v/appv-creating-and-managing-virtualized-applications - name: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-provision-a-vm.md + href: /microsoft-desktop-optimization-pack/app-v/appv-auto-provision-a-vm - name: Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-batch-sequencing.md + href: /microsoft-desktop-optimization-pack/app-v/appv-auto-batch-sequencing - name: Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-auto-batch-updating.md + href: /microsoft-desktop-optimization-pack/app-v/appv-auto-batch-updating - name: Manually sequence a new app using Microsoft Application Virtualization Sequencer (App-V Sequencer) - href: app-v/appv-sequence-a-new-application.md + href: /microsoft-desktop-optimization-pack/app-v/appv-sequence-a-new-application - name: How to Modify an Existing Virtual Application Package - href: app-v/appv-modify-an-existing-virtual-application-package.md + href: /microsoft-desktop-optimization-pack/app-v/appv-modify-an-existing-virtual-application-package - name: How to Create and Use a Project Template - href: app-v/appv-create-and-use-a-project-template.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-and-use-a-project-template - name: How to Create a Package Accelerator - href: app-v/appv-create-a-package-accelerator.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-package-accelerator - name: How to Create a Virtual Application Package Using an App-V Package Accelerator - href: app-v/appv-create-a-virtual-application-package-package-accelerator.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-virtual-application-package-package-accelerator - name: Administering App-V items: - name: Administering App-V Virtual Applications by Using the Management Console - href: app-v/appv-administering-virtual-applications-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-administering-virtual-applications-with-the-management-console - name: About App-V Dynamic Configuration - href: app-v/appv-dynamic-configuration.md + href: /microsoft-desktop-optimization-pack/app-v/appv-dynamic-configuration - name: How to Connect to the Management Console - href: app-v/appv-connect-to-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-connect-to-the-management-console - name: How to Add or Upgrade Packages by Using the Management Console - href: app-v/appv-add-or-upgrade-packages-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-add-or-upgrade-packages-with-the-management-console - name: How to Configure Access to Packages by Using the Management Console - href: app-v/appv-configure-access-to-packages-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-configure-access-to-packages-with-the-management-console - name: How to Publish a Package by Using the Management Console - href: app-v/appv-publish-a-packages-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-publish-a-packages-with-the-management-console - name: How to Delete a Package in the Management Console - href: app-v/appv-delete-a-package-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-delete-a-package-with-the-management-console - name: How to Add or Remove an Administrator by Using the Management Console - href: app-v/appv-add-or-remove-an-administrator-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-add-or-remove-an-administrator-with-the-management-console - name: How to Register and Unregister a Publishing Server by Using the Management Console - href: app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console - name: How to Create a Custom Configuration File by Using the App-V Management Console - href: app-v/appv-create-a-custom-configuration-file-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-custom-configuration-file-with-the-management-console - name: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - href: app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console - name: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - href: app-v/appv-customize-virtual-application-extensions-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-customize-virtual-application-extensions-with-the-management-console - name: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - href: app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console - name: Connection groups items: - name: Managing Connection Groups - href: app-v/appv-managing-connection-groups.md + href: /microsoft-desktop-optimization-pack/app-v/appv-managing-connection-groups - name: About the Connection Group Virtual Environment - href: app-v/appv-connection-group-virtual-environment.md + href: /microsoft-desktop-optimization-pack/app-v/appv-connection-group-virtual-environment - name: About the Connection Group File - href: app-v/appv-connection-group-file.md + href: /microsoft-desktop-optimization-pack/app-v/appv-connection-group-file - name: How to Create a Connection Group - href: app-v/appv-create-a-connection-group.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-connection-group - name: How to Create a Connection Group with User-Published and Globally Published Packages - href: app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages - name: How to Delete a Connection Group - href: app-v/appv-delete-a-connection-group.md + href: /microsoft-desktop-optimization-pack/app-v/appv-delete-a-connection-group - name: How to Publish a Connection Group - href: app-v/appv-publish-a-connection-group.md + href: /microsoft-desktop-optimization-pack/app-v/appv-publish-a-connection-group - name: How to Make a Connection Group Ignore the Package Version - href: app-v/appv-configure-connection-groups-to-ignore-the-package-version.md + href: /microsoft-desktop-optimization-pack/app-v/appv-configure-connection-groups-to-ignore-the-package-version - name: How to Allow Only Administrators to Enable Connection Groups - href: app-v/appv-allow-administrators-to-enable-connection-groups.md + href: /microsoft-desktop-optimization-pack/app-v/appv-allow-administrators-to-enable-connection-groups - name: Deploying App-V packages with ESD items: - name: Deploying App-V Packages by Using Electronic Software Distribution (ESD) - href: app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions - name: How to deploy App-V Packages Using Electronic Software Distribution - href: app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md + href: /microsoft-desktop-optimization-pack/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions - name: How to Enable Only Administrators to Publish Packages by Using an ESD - href: app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md + href: /microsoft-desktop-optimization-pack/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions - name: Using the management console items: - name: Using the App-V client management console - href: app-v/appv-using-the-client-management-console.md + href: /microsoft-desktop-optimization-pack/app-v/appv-using-the-client-management-console - name: Automatically clean up unpublished packages on the App-V client - href: app-v/appv-auto-clean-unpublished-packages.md + href: /microsoft-desktop-optimization-pack/app-v/appv-auto-clean-unpublished-packages - name: Migrating items: - name: Migrating to App-V from a previous version - href: app-v/appv-migrating-to-appv-from-a-previous-version.md + href: /microsoft-desktop-optimization-pack/app-v/appv-migrating-to-appv-from-a-previous-version - name: How to convert a package created in a previous version of App-V - href: app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv - name: Maintenance items: - name: Maintaining App-V - href: app-v/appv-maintaining-appv.md + href: /microsoft-desktop-optimization-pack/app-v/appv-maintaining-appv - name: How to Move the App-V Server to Another Computer - href: app-v/appv-move-the-appv-server-to-another-computer.md + href: /microsoft-desktop-optimization-pack/app-v/appv-move-the-appv-server-to-another-computer - name: Administering App-V with Windows PowerShell items: - name: Administering App-V by using Windows PowerShell - href: app-v/appv-administering-appv-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-administering-appv-with-powershell - name: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help - href: app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md + href: /microsoft-desktop-optimization-pack/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help - name: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell - href: app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell - name: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell - href: app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell - name: How to Modify Client Configuration by Using Windows PowerShell - href: app-v/appv-modify-client-configuration-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-modify-client-configuration-with-powershell - name: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - href: app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md + href: /microsoft-desktop-optimization-pack/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server - name: How to Apply the User Configuration File by Using Windows PowerShell - href: app-v/appv-apply-the-user-configuration-file-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-apply-the-user-configuration-file-with-powershell - name: How to Apply the Deployment Configuration File by Using Windows PowerShell - href: app-v/appv-apply-the-deployment-configuration-file-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-apply-the-deployment-configuration-file-with-powershell - name: How to Sequence a Package by Using Windows PowerShell - href: app-v/appv-sequence-a-package-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-sequence-a-package-with-powershell - name: How to Create a Package Accelerator by Using Windows PowerShell - href: app-v/appv-create-a-package-accelerator-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-create-a-package-accelerator-with-powershell - name: How to Enable Reporting on the App-V Client by Using Windows PowerShell - href: app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-enable-reporting-on-the-appv-client-with-powershell - name: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell - href: app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md + href: /microsoft-desktop-optimization-pack/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell - name: Troubleshooting App-V - href: app-v/appv-troubleshooting.md + href: /microsoft-desktop-optimization-pack/app-v/appv-troubleshooting - name: Technical Reference items: - name: Technical Reference for App-V - href: app-v/appv-technical-reference.md + href: /microsoft-desktop-optimization-pack/app-v/appv-technical-reference - name: Available Mobile Device Management (MDM) settings for App-V - href: app-v/appv-available-mdm-settings.md + href: /microsoft-desktop-optimization-pack/app-v/appv-available-mdm-settings - name: Performance Guidance for Application Virtualization - href: app-v/appv-performance-guidance.md + href: /microsoft-desktop-optimization-pack/app-v/appv-performance-guidance - name: Application Publishing and Client Interaction - href: app-v/appv-application-publishing-and-client-interaction.md + href: /microsoft-desktop-optimization-pack/app-v/appv-application-publishing-and-client-interaction - name: Viewing App-V Server Publishing Metadata - href: app-v/appv-viewing-appv-server-publishing-metadata.md + href: /microsoft-desktop-optimization-pack/app-v/appv-viewing-appv-server-publishing-metadata - name: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - href: app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md + href: /microsoft-desktop-optimization-pack/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index 6239626e67..4e34b509fd 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -1,7 +1,7 @@ --- title: Use Quick Assist to help users description: Learn how IT Pros can use Quick Assist to help users. -ms.date: 08/10/2023 +ms.date: 05/09/2024 ms.topic: conceptual ms.localizationpriority: medium ms.collection: @@ -13,6 +13,11 @@ ms.collection: Quick Assist is an application that enables a person to share their [Windows](#install-quick-assist-on-windows) or [macOS](#install-quick-assist-on-macos) device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. +> [!IMPORTANT] +> Learn how to [protect yourself from tech support scams](https://support.microsoft.com/help/4013405). Tech support scams are an industry-wide issue where scammers use scare tactics to trick you into unnecessary technical support services. Only allow a Helper to connect to your device if you initiated the interaction by contacting Microsoft Support or your IT support staff directly. +> +> If you or someone you know has been affected by a tech support scam, use the [technical support scam form](https://support.microsoft.com/windows/cfa4609a-92cc-4808-95e8-392b4ffd0753) to report it. + ## Before you begin All that's required to use Quick Assist is suitable network and internet connectivity. No roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn't have to authenticate. @@ -38,7 +43,7 @@ Quick Assist communicates over port 443 (https) and connects to the Remote Assis | `*.trouter.skype.com` | Used for Azure Communication Service for chat and connection between parties. | | `aadcdn.msauth.net` | Required for logging in to the application (Microsoft Entra ID). | | `edge.skype.com` | Used for Azure Communication Service for chat and connection between parties. | -| `login.microsoftonline.com` | Required for Microsoft login service. | +| `login.microsoftonline.com` | Required for Microsoft sign-in service. | | `remoteassistanceprodacs.communication.azure.com` | Used for Azure Communication Service for chat and connection between parties. | | `turn.azure.com` | Required for Azure Communication Service. | @@ -105,7 +110,7 @@ Before installing Quick Assist, you need to set up synchronization between Intun 1. In the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Tenant administration** / **Connectors and tokens** / **Microsoft Store for Business** and verify that **Microsoft Store for Business sync** is set to **Enable**. 1. Using your Global Admin account, log into [Microsoft Store for Business](https://businessstore.microsoft.com). 1. Select **Manage** / **Settings** and enable **Show offline apps**. -1. Choose the **Distribute** tab and verify that **Microsoft Intune** is **Active**. You may need to use the **+Add management tool** link if it's not. +1. Choose the **Distribute** tab and verify that **Microsoft Intune** is **Active**. You might need to use the **+Add management tool** link if it's not. 1. Search for **Quick Assist** and select it from the Search results. 1. Choose the **Offline** license and select **Get the app** 1. In the Intune admin center, choose **Sync**. @@ -122,27 +127,64 @@ Visit [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps To install Quick Assist offline, you need to download your APPXBUNDLE and unencoded XML file from [Microsoft Store for Business](https://businessstore.microsoft.com). Visit [Download an offline-licensed app](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app) for more information. -1. Start **Windows PowerShell** with Administrative privileges. -1. In PowerShell, change the directory to the location you've saved the file to in step 1: `cd
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -80,7 +80,7 @@ Language to be installed or being installed. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -120,7 +120,7 @@ Language tag of the language to be installed or being installed. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -169,7 +169,7 @@ Copies the language to the international settings (that is, locale, input layout | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -218,7 +218,7 @@ Enables installations of all available language features when the value is true. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -257,7 +257,7 @@ Error code of queued language installation. 0 if there is no error. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -296,7 +296,7 @@ Execution node to queue a language for installation on the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -335,7 +335,7 @@ Status of the language queued for install. 0 - not started; 1 - in progress; 2 - | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -374,7 +374,7 @@ Languages currently installed on the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -414,7 +414,7 @@ Language tag of an installed language on the device. Delete to uninstall. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -453,7 +453,7 @@ Numeric representation of the language features installed. Basic Typing - 1 (0x1 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -492,7 +492,7 @@ Numeric representation of how a language is installed. 1 - The system language p | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -531,7 +531,7 @@ Language settings of the device. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index dbb6d25b17..99b94df749 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -13,7 +13,7 @@ This article lists the OMA DM device description framework (DDF) files for vario As of December 2022, DDF XML schema was updated to include additional information such as OS build applicability. DDF v2 XML files for Windows 10 and Windows 11 are combined, and provided in a single download: -- [DDF v2 Files, September 2023](https://download.microsoft.com/download/0/e/c/0ec027e5-8971-49a2-9230-ec9352bc3ead/DDFv2September2023.zip) +- [DDF v2 Files, May 2024](https://download.microsoft.com/download/f/6/1/f61445f7-1d38-45f7-bc8c-609b86e4aabc/DDFv2May24.zip) ## DDF v2 schema @@ -575,6 +575,7 @@ DDF v2 XML schema definition is listed below along with the schema definition fo You can download the older DDF files for various CSPs from the links below: +- [Download all the DDF files for Windows 10 and 11 September 2023](https://download.microsoft.com/download/0/e/c/0ec027e5-8971-49a2-9230-ec9352bc3ead/DDFv2September2023.zip) - [Download all the DDF files for Windows 10 and 11 December 2022](https://download.microsoft.com/download/7/4/c/74c6daca-983e-4f16-964a-eef65b553a37/DDFv2December2022.zip) - [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index f3477a1132..bd54fa0edc 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,7 +1,7 @@ --- title: Defender CSP description: Learn more about the Defender CSP. -ms.date: 01/31/2024 +ms.date: 05/20/2024 --- @@ -53,6 +53,8 @@ The following list shows the Defender configuration service provider nodes: - [RuleData](#configurationdevicecontrolpolicyrulesruleidruledata) - [DeviceControlEnabled](#configurationdevicecontrolenabled) - [DisableCacheMaintenance](#configurationdisablecachemaintenance) + - [DisableCoreServiceECSIntegration](#configurationdisablecoreserviceecsintegration) + - [DisableCoreServiceTelemetry](#configurationdisablecoreservicetelemetry) - [DisableCpuThrottleOnIdleScans](#configurationdisablecputhrottleonidlescans) - [DisableDatagramProcessing](#configurationdisabledatagramprocessing) - [DisableDnsOverTcpParsing](#configurationdisablednsovertcpparsing) @@ -71,6 +73,8 @@ The following list shows the Defender configuration service provider nodes: - [EnableConvertWarnToBlock](#configurationenableconvertwarntoblock) - [EnableDnsSinkhole](#configurationenablednssinkhole) - [EnableFileHashComputation](#configurationenablefilehashcomputation) + - [EnableUdpReceiveOffload](#configurationenableudpreceiveoffload) + - [EnableUdpSegmentationOffload](#configurationenableudpsegmentationoffload) - [EngineUpdatesChannel](#configurationengineupdateschannel) - [ExcludedIpAddresses](#configurationexcludedipaddresses) - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins) @@ -1585,6 +1589,104 @@ Defines whether the cache maintenance idle task will perform the cache maintenan + +### Configuration/DisableCoreServiceECSIntegration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceECSIntegration +``` + + + + +Turn off ECS integration for Defender core service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0x0 | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x0 (Default) | The Defender core service will use the Experimentation and Configuration Service (ECS) to rapidly deliver critical, org-specific fixes. | +| 0x1 | The Defender core service stops using the Experimentation and Configuration Service (ECS). Fixes will continue to be delivered through security intelligence updates. | + + + + + + + + + +### Configuration/DisableCoreServiceTelemetry + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableCoreServiceTelemetry +``` + + + + +Turn off OneDsCollector telemetry for Defender core service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0x0 | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x0 (Default) | The Defender core service will use the OneDsCollector framework to rapidly collect telemetry. | +| 0x1 | The Defender core service stops using the OneDsCollector framework to rapidly collect telemetry, impacting Microsoft's ability to quickly recognize and address poor performance, false positives, and other problems. | + + + + + + + + ### Configuration/DisableCpuThrottleOnIdleScans @@ -2372,6 +2474,9 @@ This setting controls whether network protection blocks network traffic instead ### Configuration/EnableDnsSinkhole +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| @@ -2467,6 +2572,104 @@ Enables or disables file hash computation feature. When this feature is enabled + +### Configuration/EnableUdpReceiveOffload + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableUdpReceiveOffload +``` + + + + +This setting enables Udp Receive Offload Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Udp Receive Offload is disabled. | +| 1 | Udp Receive Offload is enabled. | + + + + + + + + + +### Configuration/EnableUdpSegmentationOffload + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableUdpSegmentationOffload +``` + + + + +This setting enables Udp Segmentation Offload Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Udp Segmentation Offload is disabled. | +| 1 | Udp Segmentation Offload is enabled. | + + + + + + + + ### Configuration/EngineUpdatesChannel diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 2e65444a0f..a7f5fe4029 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,7 +1,7 @@ --- title: Defender DDF file description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. -ms.date: 01/31/2024 +ms.date: 05/20/2024 --- @@ -1755,6 +1755,7 @@ The following XML file contains the device description framework (DDF) for the D
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -488,7 +488,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -543,7 +543,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -587,7 +587,7 @@ If not specified, this setting will default to "WLapsAdmin". | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -643,7 +643,7 @@ If not specified, this setting defaults to False. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -759,7 +759,7 @@ If not specified, this setting will default to 0. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 6542f4aa17..b48e301116 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,7 +1,7 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -ms.date: 04/23/2024 +ms.date: 05/20/2024 --- @@ -871,6 +871,8 @@ This article lists the policies in Policy CSP that have a group policy mapping. ## WindowsAI - [TurnOffWindowsCopilot](policy-csp-windowsai.md) +- [DisableAIDataAnalysis](policy-csp-windowsai.md) +- [AllowImageCreator](policy-csp-windowsai.md) ## WindowsDefenderSecurityCenter diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index a6efb038f9..8985e0fd66 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,7 +1,7 @@ --- title: InternetExplorer Policy CSP description: Learn more about the InternetExplorer Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 05/20/2024 --- @@ -7718,7 +7718,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
✅ Windows 10, version 2004 [10.0.19041.3758] and later
✅ Windows 11, version 22H2 [10.0.22621.2792] and later
✅ Windows Insider Preview [10.0.25398.643] | @@ -8793,7 +8793,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
✅ Windows 10, version 2004 [10.0.19041.3758] and later
✅ Windows 11, version 22H2 [10.0.22621.2792] and later
✅ Windows Insider Preview [10.0.25398.643] | @@ -17364,7 +17364,7 @@ High Safety enables applets to run in their sandbox. Disable Java to prevent any | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2227] and later
✅ Windows 10, version 2004 [10.0.19041.3758] and later
✅ Windows 11, version 22H2 [10.0.22621.2792] and later
✅ Windows Insider Preview [10.0.25398.643] | diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index eeb0d6f1ba..bf9e5d11f5 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,7 +1,7 @@ --- title: Settings Policy CSP description: Learn more about the Settings Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 05/20/2024 --- @@ -169,10 +169,13 @@ Allows the user to change date and time settings. ## AllowEditDeviceName +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1607 [10.0.14393] and later | @@ -183,7 +186,7 @@ Allows the user to change date and time settings. -Allows the user to edit the device name. +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index 7f0e55df51..cf79d817d1 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,7 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -ms.date: 04/23/2024 +ms.date: 05/20/2024 --- @@ -9,10 +9,136 @@ ms.date: 04/23/2024 # Policy CSP - WindowsAI +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + +## AllowImageCreator + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowImageCreator +``` + + + + +This policy setting allows you to control whether Image Creator functionality is available in the Windows Paint app. + +- If you disable this policy setting, Image Creator functionality won't be accessible in the Windows Paint app. + +- If you enable or don't configure this policy setting, users will be able to access Image Creator functionality. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowImageCreator | +| Path | WindowsAI > AT > WindowsComponents > Paint | + + + + + + + + + +## DisableAIDataAnalysis + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis +``` + + + + +This policy setting allows you to control whether Windows saves snapshots of the screen and analyzes the user's activity on their device. + +- If you enable this policy setting, Windows won't be able to save snapshots and users won't be able to search for or browse through their historical device activity using Recall. + +- If you disable or don't configure this policy setting, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enable saving Snapshots for Windows. | +| 1 | Disable saving Snapshots for Windows. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableAIDataAnalysis | +| Path | WindowsAI > AT > WindowsComponents > WindowsAI | + + + + + + + + ## TurnOffWindowsCopilot diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 78f6dd37b7..f830d00fd8 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,7 +1,7 @@ --- title: SurfaceHub CSP description: Learn more about the SurfaceHub CSP. -ms.date: 04/22/2024 +ms.date: 05/20/2024 --- @@ -358,7 +358,7 @@ Possible error values: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later
✅ Windows 10, version 2009 [10.0.19042.789] and later
✅ Windows Insider Preview [99.9.9999] | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041.789] and later
✅ Windows 10, version 2009 [10.0.19042.789] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 347afc4322..b6e225d925 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -50,6 +50,8 @@ items: href: device-update-management.md - name: Manage Copilot in Windows href: manage-windows-copilot.md + - name: Manage Recall + href: manage-recall.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal diff --git a/windows/configuration/assigned-access/xsd.md b/windows/configuration/assigned-access/xsd.md index 89519a3862..209c3fb81d 100644 --- a/windows/configuration/assigned-access/xsd.md +++ b/windows/configuration/assigned-access/xsd.md @@ -2,7 +2,7 @@ title: Assigned Access XML Schema Definition (XSD) description: Assigned Access XSD reference article. ms.topic: reference -ms.date: 02/15/2024 +ms.date: 04/08/2024 --- # Assigned Access XML Schema Definition (XSD) @@ -232,7 +232,7 @@ Here's the Assigned Access XSD for the features added in Windows 11: ## Windows 11, version 21H2 additions -Here's the Assigned Access XSD for the features added in Windows 10, version 21H2: +Here's the Assigned Access XSD for the features added in Windows 11, version 21H2: ```xml
By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.| -|Settings package size warning threshold|Computers and Users|This Group Policy setting lets you configure the UE-V service to report when a settings package file size reaches a defined threshold.|Specify the preferred threshold for settings package sizes in kilobytes (KB).
By default, the UE-V service does not have a package file size threshold.| -|Settings storage path|Computers and Users|This Group Policy setting configures where the user settings are to be stored.|Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.| -|Settings template catalog path|Computers Only|This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V service.|Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.
Select the check box to replace the default Microsoft templates.| -|Sync settings over metered connections|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections.|By default, the UE-V service does not synchronize settings over a metered connection.| -|Sync settings over metered connections even when roaming|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.|By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.| -|Synchronization timeout|Computers and Users|This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.|Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.| -|Tray Icon|Computers Only|This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.|This setting only has an effect for UE-V 2.x and earlier. It has no effect for UE-V in Windows 10, version 1607.| -|Use User Experience Virtualization (UE-V)|Computers and Users|This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).|This setting only has an effect for UE-V 2.x and earlier. For UE-V in Windows 10, version 1607, use the **Enable UE-V** setting.| -|Enable UE-V|Computers and Users|This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.|This setting only has an effect for UE-V in Windows 10, version 1601. For UE-V 2.x and earlier, choose the **Use User Experience Virtualization (UE-V)** setting.| - ->[!NOTE] ->In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications. - -### Windows App Group Policy settings - -|Group Policy setting name|Target|Group Policy setting description|Configuration options| -|--- |--- |--- |--- | -|Do not synchronize Windows Apps|Computers and Users|This Group Policy setting defines whether the UE-V service synchronizes settings for Windows apps.|The default is to synchronize Windows apps.| -|Windows App List|Computer and User|This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app's settings.|You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.| -|Sync Unlisted Windows Apps|Computer and User|This Group Policy setting defines the default settings sync behavior of the UE-V service for Windows apps that are not explicitly listed in the Windows app list.|By default, the UE-V service only synchronizes settings of those Windows apps that are included in the Windows app list.| - -For more information about synchronizing Windows apps, see [Windows App List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist). - -**To configure computer-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the computer that acts as a domain controller to manage Group Policy settings for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization** -1. Select the Group Policy setting to be edited - -**To configure user-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer to manage Group Policy settings for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization** -1. Select the edited Group Policy setting - -The UE-V service uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration` -1. Computer-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration` -1. Configuration settings that are defined by the current user by using Windows PowerShell or Windows management Instrumentation (WMI) - These configuration settings are stored by the UE-V service under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration` -1. Configuration settings that are defined for the computer by using Windows PowerShell or WMI. These configuration settings are stored by the UE-V service under this registry location: `HKEY_LOCAL_MACHINE\Software\Microsoft\Uev\Agent\Configuration` - -## Related topics - -[Administering UE-V](uev-administering-uev.md) -[Manage Configurations for UE-V](uev-manage-configurations.md) diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md deleted file mode 100644 index 6aa403bde3..0000000000 --- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -title: Configuring UE-V with Microsoft Configuration Manager -description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Configuration Manager. -ms.date: 1/25/2024 -ms.topic: article ---- - -# Configuring UE-V with Microsoft Configuration Manager - -After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of Microsoft Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -## UE-V Configuration Pack supported features - -The UE-V Configuration Pack includes tools to: - -- Create or update UE-V settings location template distribution baselines - - Define UE-V templates to be registered or unregistered - - Update UE-V template configuration items and baselines as templates are added or updated - - Distribute and register UE-V templates using standard Configuration Item remediation -- Create or update a UE-V Agent policy configuration item to set or clear these settings - - |Configuration|Setting|Description| - |--- |--- |--- | - |Max package size|Enable/disable Windows app sync|Wait for sync on application start| - |Setting import delay|Sync unlisted Windows apps|Wait for sync on sign in| - |Settings import notification|IT contact URL|Wait for sync timeout| - |Settings storage path|IT contact descriptive text|Settings template catalog path| - |Sync enablement|Tray icon enabled|Start/Stop UE-V agent service| - |Sync method|First use notification|Define which Windows apps will roam settings| - |Sync timeout||| - -- Verify compliance by confirming that UE-V is running. - -## Generate a UE-V service policy configuration item - -All UE-V service policy and configuration is distributed through a single configuration item that is generated using the UevAgentPolicyGenerator.exe tool. This tool reads the desired configuration from an XML configuration file and creates a CI containing the discovery and remediation settings needed to bring the machine into compliance. - -The UE-V service policy configuration item CAB file is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> -- PolicyName <name> Optional: Defaults to "UE-V Agent Policy" if not present -- PolicyDescription <description> Optional: A description is provided if not present -- CabFilePath <full path to configuration item .CAB file> -- ConfigurationFile <full path to agent configuration XML file> - -> [!NOTE] -> It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console: - -1. Select **Administration > Client Settings > Properties** -1. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** - -**Create the first UE-V policy configuration item** - -1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: - - ```cmd - C:\Program Files (x86)\Windows Kits\10\Microsoft User Experience Virtualization\Management\AgentConfiguration.xml - ``` - - The default configuration file contains five sections: - - **Computer Policy** - - All UE-V machine level settings. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - **Clear** to remove the setting - - **Unmanaged** to have the configuration item left at its current state - - Don't remove lines from this section. Instead, set the DesiredState to `Unmanaged` if you don't want Configuration Manager to alter current or default values. - - **CurrentComputerUserPolicy** - - All UE-V user level settings. These entries override the machine settings for a user. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - **Clear** to remove the setting - - **Unmanaged** to have the configuration item left at its current state - - Don't remove lines from this section. Instead, set the DesiredState to 'Unmanaged' if you don't want Configuration Manager to alter current or default values. - - **Services** - - Entries in this section control service operation. The default configuration file contains a single entry for the UevAgentService. The DesiredState attribute can be set to **Running** or **Stopped**. - - **Windows8AppsComputerPolicy** - - All machine level Windows app synchronization settings. Each PackageFamilyName listed in this section can be assigned a DesiredState of - - - **Enabled** to have settings roam - - **Disabled** to prevent settings from roaming - - **Cleared** to have the entry removed from UE-V control - - More lines can be added to this section based on the list of installed Windows apps that can be viewed using the PowerShell cmdlet GetAppxPackage. - - **Windows8AppsCurrentComputerUserPolicy** - - Identical to the Windows8AppsComputerPolicy with settings that override machine settings for an individual user. - -1. Edit the configuration file by changing the desired state and value fields. -1. Run this command on a machine running the ConfigMgr Admin Console: - ```cmd - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe -Site ABC -CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" -ConfigurationFile "c:\AgentConfiguration.xml" - ``` -1. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem - -**Update a UE-V Policy Configuration Item** - -1. Edit the configuration file by changing the desired state and value fields. -1. Run the command from Step 3 in [Create the First UE-V Policy Configuration Item](#create). If you changed the name with the PolicyName parameter, make sure you enter the same name. -1. Reimport the CAB file. The version in ConfigMgr will be updated. - -## Generate a UE-V Template Baseline - -UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. - -The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> -- BaselineName <name> (Optional: defaults to "UE-V Template Distribution Baseline" if not present) -- BaselineDescription <description> (Optional: a description is provided if not present) -- TemplateFolder <UE-V template folder> -- Register <comma separated template file list> -- Unregister <comma separated template list> -- CabFilePath <Full path to baseline CAB file to generate> - -The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. - -### Create the First UE-V Template Baseline - -1. Create a "master" set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they're pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. -1. Create a text.bat file where you can add the template generator command. This step is optional, but will make regeneration simpler if you save the command parameters -1. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: - ```cmd - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe -Site "ABC" -TemplateFolder "C:\ProductionUevTemplates" -Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" -CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" - ``` -1. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager - -### Update a UE-V Template Baseline - -The template generator uses the template version to determine if a template should be updated. If you make a template change and update the version, the baseline generator compares the template in your master folder with the template contained in the CI on the ConfigMgr server. If a difference is found, the generated baseline and modified CI versions are updated. - -To distribute a new Notepad template, you would perform these steps: - -1. Update the template and template version located in the <Version> element of the template -1. Copy the template to your master template directory -1. Run the command in the .bat file that you created in Step 3 in [Create the First UE-V Template Baseline](#create2) -1. Import the generated CAB file into ConfigMgr using the console or PowerShell Import-CMBaseline - -## Related articles - -[Manage Configurations for UE-V](uev-manage-configurations.md) diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md deleted file mode 100644 index a349f9b2a3..0000000000 --- a/windows/configuration/ue-v/uev-deploy-required-features.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Deploy required UE-V features -description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example, a network share that stores and retrieves user settings. -ms.date: 1/25/2024 -ms.topic: article ---- - -# Deploy required UE-V features - -To get up and running with User Experience Virtualization (UE-V), install and configure the following features. - -- [Deploy a settings storage location](#deploy-a-ue-v-settings-storage-location) that is accessible to end users. - This feature is a standard network share that stores and retrieves user settings. -- [Choose the configuration method for UE-V](#choose-the-configuration-method-for-ue-v) - You can deploy and configure UE-V with common management tools including group policy, Configuration Manager, or Windows Management Infrastructure and PowerShell. -- [Enable the UE-V service](#enable-the-ue-v-service) on user devices. - With Windows 10, version 1607, UE-V is installed automatically. You need to enable the UE-V service on each user device you want to include in your UE-V environment. - -The articles in this section describe how to deploy these features. - -## Deploy a UE-V Settings Storage Location - -UE-V requires a location in which to store user settings in settings package files. You can configure this settings storage location in one of these ways: - -- Create your own settings storage location -- Use existing Active Directory for your settings storage location - -> [!NOTE] -> As a matter of [performance and capacity planning](uev-prepare-for-deployment.md#performance-and-capacity-planning) and to reduce problems with network latency, create settings storage locations on the same local networks where the users' devices reside. We recommend 20 MB of disk space per user for the settings storage location. - -### Create a UE-V Settings Storage Location - -Before you define the settings storage location, you must create a root directory with read/write permissions for users who store settings on the share. The UE-V service creates user-specific folders under this root directory. - -The settings storage location is defined by setting the SettingsStoragePath configuration option, which you can configure by using one of these methods: - -- Through [Group Policy](uev-configuring-uev-with-group-policy-objects.md) settings -- With the [Configuration Manager Pack](uev-configuring-uev-with-system-center-configuration-manager.md) for UE-V -- With [Windows PowerShell or Windows Management Instrumentation (WMI)](uev-administering-uev-with-windows-powershell-and-wmi.md) - - The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\Server\Settingsshare\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the %username%\%computername% variables to preserve the end user settings experience in these scenarios: - -- End users that use multiple physical devices in your enterprise -- Enterprise computers that are used by multiple end users - -The UE-V service dynamically creates a user-specific settings storage path, with a hidden system folder named **SettingsPackages**, based on the configuration setting of **SettingsStoragePath**. The service reads and writes settings to this location as defined by the registered UE-V settings location templates. - -**UE-V settings are determined by a "Last write wins" rule:** If the settings storage location is the same for a user with multiple managed computers, one UE-V service reads and writes to the settings location independently of services running on other computers. The last written settings and values are the ones applied when the service next reads from the settings storage location. - -**Deploy the settings storage location:** Follow these steps to define the settings storage location rather than using your existing Active Directory agent. You should limit access to the settings storage share to those users that require it, as shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. -1. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. -1. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | - |------------------------------|-----------------------------| - | Everyone | No permissions | - | Security group of UE-V users | Full control | - -1. Set the following NTFS file system permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | **Folder** | - |------------------------------|---------------------------------------------------|---------------------------| - | Creator/owner | Full control | Subfolders and files only | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - -With this configuration, the UE-V service creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users can't access it. - -> [!NOTE] -> If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this extra security, specify this setting in the Windows Server Registry Editor: -> -> 1. Add a **REG_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration** -> 1. Set the registry key value to *1* - -### Use Active Directory with UE-V - -The UE-V service uses Active Directory (AD) by default if you don't define a settings storage location. In these cases, the UE-V service dynamically creates the settings storage folder under the root of the AD home directory of each user. However, if a custom directory setting is configured in AD, then that directory is used instead. - -## Choose the Configuration Method for UE-V - -You'll need to decide which configuration method you'll use to manage UE-V after deployment since this configuration method is the one you'll use to deploy the UE-V Agent. Typically, this configuration method is the one that you already use in your environment, such as Windows PowerShell or Configuration Manager. - -You can configure UE-V before, during, or after you enable the UE-V service on user devices, depending on the configuration method that you use. - -- [**Group Policy**](uev-configuring-uev-with-group-policy-objects.md) You can use your existing Group Policy infrastructure to configure UE-V before or after you enable the UE-V service. The UE-V Group Policy ADMX template enables the central management of common UE-V service configuration options and includes settings to configure UE-V synchronization. - - > [!NOTE] - > Starting with Windows 10, version 1607, UE-V ADMX templates are installed automatically. - - Group Policy ADMX templates configure the synchronization settings for the UE-V service and enable the central management of common UE-V service configuration settings by using an existing Group Policy infrastructure. - Supported operating systems for the domain controller that deploys the Group Policy Objects include: - Windows Server 2012 and Windows Server 2012 R2 - -- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of Microsoft Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. -- [**Windows PowerShell and WMI**](uev-administering-uev-with-windows-powershell-and-wmi.md) You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify the configuration of the UE-V service. - -> [!NOTE] -> Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods. - -## Enable the UE-V service - -The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. - -Before enabling the UE-V service, you need to register the UE-V templates for first time use. In a PowerShell window, type **register-<TemplateName>** where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. - -> [!NOTE] -> With Windows 10, version 1607, you must register UE-V templates for all inbox and custom templates. This provides flexibility for only deploying the required templates. - -With Windows 10, version 1607 and later, the UE-V service is installed on user devices. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. - -**To enable the UE-V service with Group Policy** - -1. Open the device's **Group Policy Editor** -1. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization** -1. Run **Enable UEV** -1. Restart the device - -**To enable the UE-V service with Windows PowerShell** - -1. In a PowerShell window, type **Enable-UEV** and press ENTER -1. Restart the device -1. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled - -## Related articles - -[Prepare a UE-V deployment](uev-prepare-for-deployment.md) -[Deploy UE-V for use with custom applications](uev-deploy-uev-for-custom-applications.md) -[Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md deleted file mode 100644 index 6018becc89..0000000000 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: Use UE-V with custom applications -description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator. -ms.date: 1/25/2024 -ms.topic: article ---- - -# Use UE-V with custom applications - -User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those settings included in the default templates, you can create your own custom settings location templates with the UE-V template generator. - -After you've reviewed [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) and decided that you want to synchronize settings for custom applications (for example, third-party, line-of-business), you'll need to deploy the features of UE-V described in this topic. - -To start, here are the main steps required to synchronize settings for custom applications: - -- [Install the UE-V template generator](#install-the-uev-template-generator) - Use the UEV template generator to create custom XML settings location templates. -- [Configure a UE-V settings template catalog](#deploy-a-settings-template-catalog) - You can define this path where custom settings location templates are stored. -- [Create custom settings location templates](#create-custom-settings-location-templates) - These custom templates let users sync settings for custom applications. -- [Deploy the custom settings location templates](#deploy-the-custom-settings-location-templates) - -After you test the custom template to ensure that settings are synced correctly, you can deploy these templates in one of these ways: - -- With your existing electronic software distribution solution, such as Configuration Manager -- With Group Policy preferences -- With a UE-V settings template catalog - -> [!NOTE] -> Templates that are deployed with electronic software distribution methods or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. - -## Prepare to deploy UE-V for custom applications - -Before you start deploying the UE-V features that handle custom applications, review the following important information. - -### The UE-V template generator - -Use the UE-V template generator to monitor, discover, and capture the locations where Win32 applications store settings. The template generator doesn't create settings location templates for the following types of applications: - -- Virtualized applications -- Applications that are offered through Terminal Services -- Java applications -- Windows applications - -> [!NOTE] -> UE-V settings location templates can't be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V template generator. For more information about synchronizing settings for virtual applications, see [Using UE-V with virtual applications](uev-using-uev-with-application-virtualization-applications.md). - -**Excluded Locations:** The discovery process excludes locations that commonly store application software files that don't synchronize settings well between user computers or computing environments. By default, these files are excluded: - -- HKEY_CURRENT_USER registry keys and files to which the signed-in user can't write values -- HKEY_CURRENT_USER registry keys and files that are associated with the core functionality of the Windows operating system -- All registry keys that are located in the HKEY_LOCAL_MACHINE hive -- Files that are located in Program Files directories -- Files that are located in Users \ [User name] \ AppData \ LocalLow -- Windows operating system files that are located in %Systemroot% - -If registry keys and files that are stored in excluded locations are required to synchronize application settings, you can manually add the locations to the settings location template during the template creation process. - -### Replace the default Microsoft templates - -A default group of settings location templates for common Microsoft applications and Windows settings is included with Windows 10, version 1601. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V service can be configured to use a settings template catalog to store the templates. In this case, you'll need to include the default templates with the custom templates in the settings template catalog. - -> [!IMPORTANT] -> After you enable the UE-V service, you'll need to register the settings location templates using the `Register-UevTemplate` cmdlet in Windows PowerShell. - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed with Windows 10, version 1607 are deleted and only the templates that are located in the settings template catalog are used. - -> [!NOTE] -> If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, the Microsoft templates are ignored. - -You can replace the default templates by using the UE-V Windows PowerShell features. To replace the default Microsoft template with Windows PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages aren't read by the UE-V service, but neither are they automatically deleted. - -### Install the UEV template generator - -Use the UE-V template generator to create custom settings location templates that you can then distribute to user devices. You can also use the template generator to edit an existing template or validate a template that was created with another XML editor. - -The UE-V template generator is included in the Windows Assessment and Deployment Kit (ADK) for Windows 10. - -Install the UE-V template generator on a computer that you can use to create a custom settings location template. This computer should have the applications installed for which custom settings location templates need to be generated. - -> [!IMPORTANT] -> UE-V for Windows 10, version 1607 includes a new template generator. If you are upgrading from an existing UE-V installation, you'll need to use the new generator to create settings location templates. Templates created with previous versions of the UE-V template generator will continue to work. - -To install the UE-V template generator: - -1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) to access the ADK. -1. Select the **Get Windows ADK for Windows 10** button on this page to start the ADK installer. On the window pictured below, select **Microsoft User Experience Virtualization (UE-V) Template Generator** and then select Install. - - - - - -1. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. -1. See [Working with Custom UE-V Templates and the UE-V Template Generator](uev-working-with-custom-templates-and-the-uev-generator.md) for information about how to use the template generator. - -### Deploy a settings template catalog - -The UE-V settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V service checks this location one time each day and updates its synchronization behavior, based on the templates in this folder. - -The UE-V service checks this folder for templates that were added, updated, or removed. It registers new and changed templates and unregisters removed templates. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the Task Scheduler and at system startup. To customize the frequency of this scheduled task, see [Changing the frequency of UE-V scheduled tasks](uev-changing-the-frequency-of-scheduled-tasks.md). - -You can configure the settings template catalog path with command-line options, Group Policy, WMI, or Windows PowerShell. Templates stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. - -To configure the settings template catalog for UE-V: - -1. Create a new folder on the computer that stores the UE-V settings template catalog. -1. Set the following share-level (SMB) permissions for the settings template catalog folder. - - | **User account** | **Recommended permissions** | - |------------------|------------------------------| - | Everyone | No Permissions | - | Domain Computers | Read Permission Levels | - | Administrators | Read/Write Permission Levels | - -1. Set the following NTFS file system permissions for the settings template catalog folder. - - | **User account** | **Recommended permissions** | **Apply to** | - |------------------|-------------------------------|-----------------------------------| - | Creator/Owner | Full Control | This Folder, Subfolders and Files | - | Domain Computers | List Folder Contents and Read | This Folder, Subfolders and Files | - | Everyone | No Permissions | No Permissions | - | Administrators | Full Control | This Folder, Subfolders and Files | - -1. Click **OK** to close the dialog boxes. - -At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who are to manage the stored templates. - -### Create custom settings location templates - -Use the UE-V template generator to create settings location templates for line-of-business applications or other custom applications. After you create the template for an application, deploy it to computers to synchronize settings for that application. - -To create a UE-V settings location template with the UE-V template generator: - -1. Click **Start** > **All Programs** > **Microsoft User Experience Virtualization** > **Microsoft User Experience Virtualization template generator**. -1. Click **Create a settings location template**. -1. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command-line arguments, if any, and working directory, if any. -1. Click **Next** to continue. - - >**Note** Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - -1. After the application starts, close the application. The UE-V template generator records the locations where the application stores its settings. -1. After the process is completed, click **Next** to continue. - -1. Review and select the appropriate registry settings locations and settings file locations to synchronize for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY_CURRENT_USER keys or in the file folders under \ **Users** \ [User name] \ **AppData** \ **Roaming**. The UE-V template generator includes these settings by default. - - **Nonstandard**: Application settings that are stored outside the locations are specified in the best practices for settings data storage (optional). These include files and folders under **Users** \ [User name] \ **AppData** \ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - -1. Click **Next** to continue. -1. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name that is written in the description of the program files properties. - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the product. - - **File version**: The file version number of the .exe file of the application. This property, in conjunction with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - **template author name** (optional): The name of the settings location template author. - - **template author email** (optional): The email address of the settings location template author. - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by using the **Tasks** drop-down menu. Tasks enable you to add new keys, edit the name or scope of existing keys, delete keys, and browse the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations enable you to add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. -1. Click **Create**, and then click **Save** to save the settings location template on the computer. -1. Click **Close** to close the settings template wizard. Exit the UE-V template generator application. -1. After you've created the settings location template for an application, test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -See [Application template schema reference for UE-V](uev-application-template-schema-reference.md) for details about the XML structure of the UE-V settings location template and for guidance about editing these files. - -### Deploy the Custom Settings Location templates - -After you create a settings location template with the UE-V template generator, you should test it to ensure that the application settings are synchronized correctly. You can then safely deploy the settings location template to user devices in the enterprise. - -You can deploy settings location templates using of these methods: - -- An electronic software distribution (ESD) system such as Microsoft Configuration Manager -- Group Policy preferences -- A UE-V settings template catalog - -Templates that are deployed by using an ESD system or Group Policy objects must be registered using UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V service. - -To deploy UE-V settings location templates with a settings template catalog path: - -1. Browse to the network share folder that you defined as the settings template catalog. -1. Add, remove, or update settings location templates in the settings template catalog to reflect the UE-V service template configuration that you want for UE-V computers. - > [!NOTE] - > Templates on computers are updated daily. The update is based on changes to the settings template catalog. -1. To manually update templates on a computer that runs the UE-V service, open an elevated command prompt, and browse to **Program Files\Microsoft User Experience Virtualization \ Agent \ <x86 or x64 >**, and then run **ApplySettingstemplateCatalog.exe**. - > [!NOTE] - > This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog. - -## Related topics - -- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) -- [Deploy Required UE-V Features](uev-deploy-required-features.md) diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md deleted file mode 100644 index e65d123596..0000000000 --- a/windows/configuration/ue-v/uev-for-windows.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: User Experience Virtualization for Windows 10, version 1607 -description: Overview of User Experience Virtualization for Windows 10, version 1607 -ms.date: 1/25/2024 -ms.topic: article ---- - -# User Experience Virtualization (UE-V) for Windows 10 overview - -Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Microsoft Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options. - -With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to. - -**With UE-V you can…** - -- Specify which application and Windows settings synchronize across user devices -- Deliver the settings anytime and anywhere users work throughout the enterprise -- Create custom templates for your third-party or line-of-business applications -- Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state - -With the release of Windows 10, version 1607, UE-V is included with the Windows 10 for Enterprise edition. If you are new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you'll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. - -## Components of UE-V - -The diagram below illustrates how UE-V components work together to synchronize user settings. - -
-
-
-
-| **Component** | **Function** |
-|--|--|
-| **UE-V service** | Enabled on every device that needs to synchronize settings, the **UE-V service** monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. |
-| **Settings packages** | Application settings and Windows settings are stored in **settings packages** created by the UE-V service. Settings packages are built, locally stored, and copied to the settings storage location.The setting values for **desktop applications** are stored when the user closes the application.
Values for **Windows settings** are stored when the user logs off, when the computer is locked, or when the user disconnects remotely from a computer.
The sync provider determines when the application or operating system settings are read from the **Settings Packages** and synchronized. | -| **Settings storage location** | This is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings. | -| **Settings location templates** | UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by [managing settings synchronization for custom applications](#manage-settings-synchronization-for-custom-applications).
**Note** Settings location templates are not required for Windows applications. | -| **Universal Windows applications list** | Settings for Windows applications are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications.
You can add or remove applications in the Windows app list by following the procedures in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). | - -## Manage settings synchronization for custom applications - -Use these UE-V components to create and manage custom templates for your third-party or line-of-business applications. - -| Component | Description | -|--|--| -| **UE-V template generator** | Use the **UE-V template generator** to create custom settings location templates that you can then distribute to user computers. The UE-V template generator also lets you edit an existing template or validate a template that was created with a different XML editor.
With the Windows 10, version 1607 release, the UE-V template generator is installed with the [Windows Assessment and Deployment kit for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) (Windows ADK).
If you are upgrading from an existing UE-V installation, you'll need to use the new generator to create new settings location templates. Application templates created with previous versions of the UE-V template generator are still supported, however. | -| **Settings template catalog** | The **settings template catalog** is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V service checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.
If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Deploy a UE-V settings template catalog](uev-deploy-uev-for-custom-applications.md). | - - - - - -## Settings synchronized by default - -UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](uev-prepare-for-deployment.md). - -- Microsoft Office 2016, 2013, and 2010 -- Internet Explorer 11 and 10 -- Many Windows applications, such as Xbox -- Many Windows desktop applications, such as Notepad -- Many Windows settings, such as desktop background or wallpaper - -> [!NOTE] -> You can also [customize UE-V to synchronize settings](uev-deploy-uev-for-custom-applications.md) for applications other than those synchronized by default. - -## Other resources for this feature - -- [Get Started with UE-V for Windows 10](uev-getting-started.md) -- [UE-V for Windows 10 Release Notes](uev-release-notes-1607.md) -- [Prepare to deploy UE-V for Windows 10](uev-prepare-for-deployment.md) -- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) -- [Administer UE-V for Windows 10](uev-administering-uev.md) -- [Technical Reference for UE-V for Windows 10](uev-technical-reference.md) - -For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md deleted file mode 100644 index 03d142d4b2..0000000000 --- a/windows/configuration/ue-v/uev-getting-started.md +++ /dev/null @@ -1,132 +0,0 @@ ---- -title: Get Started with UE-V -description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment. -ms.date: 1/25/2024 -ms.topic: article ---- - -# Get Started with UE-V - ->[!NOTE] ->This documentation is for the most recent version of UE-V. If you're looking for information about UE-V 2.x, which was included in the Microsoft Desktop Optimization Pack (MDOP), see [Get Started with UE-V 2.x](/microsoft-desktop-optimization-pack/uev-v2/get-started-with-ue-v-2x-new-uevv2). - -Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it's the right solution to manage user settings across multiple devices within your enterprise. - ->[!NOTE] ->The information in this section is explained in greater detail throughout the rest of the documentation. If you've already determined that UE-V is the right solution and you don't need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md). - -The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows applications settings. For best results, ensure that your test environment includes two or more user computers that share network access. - -- [Step 1: Confirm prerequisites](#step-1-confirm-prerequisites). Review the supported configurations in this section to verify that your environment is able to run UE-V. -- [Step 2: Deploy the settings storage location](#step-2-deploy-the-settings-storage-location). Explains how to deploy a settings storage location. All UE-V deployments require a location to store settings packages that contain the synchronized setting values. -- [Step 3: Enable and configure the UE-V service](#step-3-enable-and-configure-the-ue-v-service-on-user-devices). Explains how to enable to UE-V service on user devices and configure the storage path. To synchronize settings using UE-V, devices must have the UE-V service enabled and running. -- [Step 4: Test Your UE-V evaluation deployment](#step-4-test-your-ue-v-evaluation-deployment). Run a few tests on two computers with the UE-V service enabled to see how UE-V works and if it meets your organization's needs. -- Step 5: Deploy UE-V for custom applications (optional). If you want to evaluate how your third-party and line-of-business applications work with UE-V, follow the steps in [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). Following this link takes you to another topic. Use your browser's **Back** button to return to this topic. - -## Step 1: Confirm prerequisites - -Before you proceed, ensure that your environment meets the following requirements for running UE-V. - -| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** | -|--|--|--|--|--|--| -| Windows 10, version 1607 | Windows 10 Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4 or higher | -| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | -| Windows Server 2012 or Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 | - -## Step 2: Deploy the settings storage location - -You'll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. For more information, see [Deploy a UE-V Settings Storage Location](uev-deploy-required-features.md#deploy-a-ue-v-settings-storage-location). - -**Create a network share** - -1. Create a new security group and add UE-V users to the group. -1. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. -1. Assign UE-V users permission to create a directory when they connect. Grant full permission to all subdirectories of that directory, but block access to anything above. -1. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | - |--|--| - | Everyone | No permissions | - | Security group of UE-V users | Full control | - -1. Set the following NTFS file system permissions for the settings storage location folder. - - | **User account** | **Recommended permissions** | **Folder** | - |--|--|--| - | Creator/owner | Full control | Subfolders and files only | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - -**Security Note** If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. -1. Set the registry key value to *1*. - -## Step 3: Enable and configure the UE-V service on user devices - -For evaluation purposes, enable the service on at least two devices that belong to the same user in your test environment. - -The UE-V service is the client-side component that captures user-personalized application and Windows settings and saves them in settings packages. Settings packages are built, locally stored, and copied to the settings storage location. - -Before enabling the UE-V service, you'll need to register the UE-V templates for first use. In a PowerShell window, type `Register-UevTemplate [TemplateName]` where **TemplateName** is the name of the UE-V template you want to register, and press ENTER. For instance, to register all built-in UE-V templates, use the following PowerShell Command: -`Get-childItem c:\programdata\Microsoft\UEV\InboxTemplates\*.xml|% {Register-UevTemplate $_.Fullname}` - -A storage path must be configured on the client-side to tell where the personalized settings are stored. - -**To set the storage path for UE-V with Group Policy** - -1. Open the device's **Group Policy Editor**. -1. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. -1. Double click **Settings storage path**. -1. Select **Enabled**, fill in the **Settings storage path**, and click **OK**. - - - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. - -**To set the storage path for UE-V with PowerShell** - -1. In a PowerShell window, type **Set-uevConfiguration -SettingsStoragePath [StoragePath]** where **[StoragePath]** is the path to the location created in step 2 followed by **\%username%**. - - - Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder. - -With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. - -**To enable the UE-V service with Group Policy** - -1. Open the device's **Group Policy Editor**. -1. Navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft** **User Experience Virtualization**. -1. Double click **Use User Experience Virtualization (UE-V)**. -1. Select **Enabled** and click **OK**. -1. Restart the device. - -**To enable the UE-V service with Windows PowerShell** - -1. In a PowerShell window, type **Enable-UEV** and press ENTER. -1. Restart the device. -1. In a PowerShell window, type **Get-UEVStatus** and press ENTER to verify that the UE-V service was successfully enabled. - -## Step 4: Test your UE-V evaluation deployment - -You're ready to run a few tests on your UE-V evaluation deployment to see how UE-V works. - -1. On the first device (Computer A), make one or more of these changes: - - Open Windows Desktop and move the taskbar to a different location in the window. - - Change the default fonts. - - Open Notepad and set format -> word wrap **on**. - - Change the behavior of any Windows application, as detailed in [Managing UE-V settings location templates using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md). - - - Disable Microsoft Account settings synchronization and roaming profiles. - -1. Log off Computer A. Settings are saved in a UE-V settings package when users lock, logoff, exit an application, or when the sync provider runs (every 30 minutes by default). -1. Log in to the second device (Computer B) as the same user as Computer A. -1. Open Windows Desktop and verify that the taskbar location matches that of Computer A. Verify that the default fonts match and that NotePad is set to **word wrap on**. Also verify the change you made to any Windows applications. -1. You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. - -For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). - -## Other resources for this feature - -- [User Experience Virtualization overview](uev-for-windows.md) -- [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) -- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md) -- [Administering UE-V](uev-administering-uev.md) -- [Troubleshooting UE-V](uev-troubleshooting.md) -- [Technical Reference for UE-V](uev-technical-reference.md) diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md deleted file mode 100644 index 48e3c7c959..0000000000 --- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Manage Administrative Backup and Restore in UE-V -description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state. -ms.date: 1/25/2024 -ms.topic: article ---- - -# Manage Administrative Backup and Restore in UE-V - -As an administrator of User Experience Virtualization (UE-V), you can restore application and Windows settings to their original state. You can also restore more settings when a user adopts a new device. - -## Restore Settings in UE-V when a User Adopts a New Device - -To restore settings when a user adopts a new device, you can put a settings location template in a **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This setup lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To back up settings for a template, use the following cmdlet in Windows PowerShell: - -```powershell -Set-UevTemplateProfile -ID
Use the DisableSettingsImportNotify parameter to disable notification.| - |`Set-UevConfiguration -CurrentComputerUser -EnableSettingsImportNotify`|Configures the UE-V service to notify the current user when settings synchronization is delayed.
Use the DisableSettingsImportNotify parameter to disable notification.| - |`Set-UevConfiguration -Computer -EnableSyncUnlistedWindows8Apps`|Configures the UE-V service to synchronize all Windows apps that aren't explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.| - |`Set-UevConfiguration -CurrentComputerUser - EnableSyncUnlistedWindows8Apps`|Configures the UE-V service to synchronize all Windows apps that aren't explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.| - |`Set-UevConfiguration -Computer -DisableSync`|Disables UE-V for all the users on the computer.
Use the EnableSync parameter to enable or re-enable.| - |`Set-UevConfiguration -CurrentComputerUser -DisableSync`|Disables UE-V for the current user on the computer.
Use the EnableSync parameter to enable or re-enable.| - |`Set-UevConfiguration -Computer -EnableTrayIcon`|Enables the UE-V icon in the notification area for all users of the computer.
Use the DisableTrayIcon parameter to disable the icon.|
- |`Set-UevConfiguration -Computer -MaxPackageSizeInBytes The `Export` cmdlet exports all UE-V service settings that are configurable with the Computer parameter.|
- |`Import-UevConfiguration `$config.SettingsStoragePath = `$config.Put()`|Defines a per-computer settings storage location.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration` `$config.SettingsStoragePath = `$config.Put()`|Defines a per-user settings storage location.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config.SyncTimeoutInMilliseconds = `$config.Put()`|Sets the synchronization time-out in milliseconds for all users of the computer.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config.MaxPackageSizeInBytes = `$config.Put()`|Configures the UE-V service to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config.SyncMethod = `$config.Put()`|Sets the synchronization method for all users of the computer: SyncProvider or None.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config. `$config.Put()`|To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config. `$config.Put()`|To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config. `$config.Put()`|Updates a specific per-computer setting. To clear the setting, use $null as the setting value.|
- |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration` `$config. `$config.Put()`|Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.|
-
-When you're finished configuring the UE-V service with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations.
-
-`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration`
-`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration`
-
-## To export UE-V package settings and repair UE-V templates by using WMI
-
-1. UE-V provides the following set of WMI commands. Administrators can use this interface to export a package or repair UE-V templates.
-1. Use the following WMI commands.
-
- |WMI command|Description|
- |--- |--- |
- |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name ExportPackage -ArgumentList Apply cached Windows settings|Download and apply asynchronous windows settings from settings storage location|
-|**Windows Disconnect (RDP) / Lock**|Store asynchronous Windows settings changes to the local cache. Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available|Store asynchronous Windows settings changes to the settings storage location|
-|**Application start**|Apply application settings from local cache as the application starts|Apply application settings from settings storage location as the application starts|
-|**Application closes**|Store any application settings changes to the local cache and copy settings to settings storage location, if available|Store any application settings changes to settings storage location|
-|**Sync Controller Scheduled Task**|Application and Windows settings are synchronized between the settings storage location and the local cache. For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous). Settings are applied in these cases: MicrosoftOffice2016Win64.xml MicrosoftSkypeForBusiness2016Win32.xml MicrosoftSkypeForBusiness2016Win64.xml|MicrosoftOffice2013Win32.xml MicrosoftOffice2013Win64.xml MicrosoftLync2013Win32.xml MicrosoftLync2013Win64.xml|MicrosoftOffice2010Win32.xml MicrosoftOffice2010Win64.xml MicrosoftLync2010.xml|
-
-### Microsoft Office Applications supported by the UE-V templates
-
-|2016|2013|2010|
-|--- |--- |--- |
-|Microsoft Access 2016 Microsoft Lync 2016 Microsoft Excel 2016 Microsoft OneNote 2016 Microsoft Outlook 2016 Microsoft PowerPoint 2016 Microsoft Project 2016 Microsoft Publisher 2016 Microsoft SharePoint Designer 2013 (not updated for 2016) Microsoft Visio 2016 Microsoft Word 2016 Microsoft Office Upload Manager|Microsoft Access 2013 Microsoft Lync 2013 Microsoft Excel 2013 Microsoft InfoPath 2013 Microsoft OneNote 2013 Microsoft Outlook 2013 Microsoft PowerPoint 2013 Microsoft Project 2013 Microsoft Publisher 2013 Microsoft SharePoint Designer 2013 Microsoft Visio 2013 Microsoft Word 2013 Microsoft Office Upload Manager|Microsoft Access 2010 Microsoft Lync 2010 Microsoft Excel 2010 Microsoft InfoPath 2010 Microsoft OneNote 2010 Microsoft Outlook 2010 Microsoft PowerPoint 2010 Microsoft Project 2010 Microsoft Publisher 2010 Microsoft SharePoint Designer 2010 Microsoft Visio 2010 Microsoft Word 2010|
-
-## Deploying Office templates
-
-You can deploy UE-V settings location template with the following methods:
-
-- **Registering template with PowerShell**. If you use Windows PowerShell to manage computers, run the following Windows PowerShell command as Administrator to register this settings location template:
- ```powershell
- Register-UevTemplate -Path
Microsoft Lync 2016
Microsoft Excel 2016
Microsoft OneNote 2016
Microsoft Outlook 2016
Microsoft PowerPoint 2016
Microsoft Project 2016
Microsoft Publisher 2016
Microsoft SharePoint Designer 2013 (not updated for 2016)
Microsoft Visio 2016
Microsoft Word 2016
Microsoft Office Upload Manager
Microsoft Infopath has been removed (deprecated) from the Office 2016 suite |
-| Microsoft Office 2013 applications
[Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367) | Microsoft Word 2013
Microsoft Excel 2013
Microsoft Outlook 2013
Microsoft Access 2013
Microsoft Project 2013
Microsoft PowerPoint 2013
Microsoft Publisher 2013
Microsoft Visio 2013
Microsoft InfoPath 2013
Microsoft Lync 2013
Microsoft OneNote 2013
Microsoft SharePoint Designer 2013
Microsoft Office 2013 Upload Center
Microsoft OneDrive for Business 2013 |
-| Microsoft Office 2010 applications
[Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367) | Microsoft Word 2010
Microsoft Excel 2010
Microsoft Outlook 2010
Microsoft Access 2010
Microsoft Project 2010
Microsoft PowerPoint 2010
Microsoft Publisher 2010
Microsoft Visio 2010
Microsoft SharePoint Workspace 2010
Microsoft InfoPath 2010
Microsoft Lync 2010
Microsoft OneNote 2010
Microsoft SharePoint Designer 2010 |
-| Browser options: Internet Explorer 11 and 10 | Synchronize favorites, home page, tabs, and toolbars.
**Note**
UE-V doesn't roam settings for Internet Explorer cookies. |
-| Windows accessories | Microsoft NotePad, WordPad |
-
-> [!NOTE]
-> - An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
-> - UE-V doesn't synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems.
-
-### Windows settings synchronized by default
-
-UE-V includes settings location templates that capture settings values for these Windows settings.
-
-| Windows settings | Description | Apply on | Export on | Default state |
-|--|--|--|--|--|
-| Desktop background | Currently active desktop background or wallpaper | Log on, unlock, remote connect, Scheduled Task events | Log off, lock, remote disconnect, or scheduled task interval | Enabled |
-| Ease of Access | Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard | Log on only | Log off or scheduled task interval | Enabled |
-| Desktop settings | Start menu and Taskbar settings, folder options, default desktop icons, more clocks, and region and language settings | Log on only | Log off or scheduled task | Enabled |
-
-> [!IMPORTANT]
-> UE-V roams taskbar settings between Windows 10 devices. However, UE-V doesn't synchronize taskbar settings between Windows 10 devices and devices running previous operating systems versions.
-
-| Settings group | Category | Capture | Apply |
-|--|--|--|--|
-| **Application Settings** | Windows applications | Close application
Windows application settings change event | Start the UE-V App Monitor at startup
Open app
Windows application settings change event
Arrival of a settings package |
-| | Desktop applications | Application closes | Application opens and closes |
-| **Desktop settings** | Desktop background | Lock or log off | Log on, unlock, remote connect, notification of new package arrival, or scheduled task runs |
-| | Ease of Access (Common - Accessibility, Narrator, Magnifier, On-Screen-Keyboard) | Lock or Log off | Log on |
-| | Ease of Access (Shell - Audio, Accessibility, Keyboard, Mouse) | Lock or log off | Log on, unlock, remote connect, notification of new package arrival, or scheduled task runs |
-| | Desktop settings | Lock or log off | Log on |
-
-### UE-V-support for Windows applications
-
-For Windows applications, the application developer specifies which user settings are synchronized. You can specify which Windows apps are enabled for settings synchronization.
-
-To display a list of Windows applications that can synchronize settings with their package family name, enabled status, and enabled source, open a Windows PowerShell window, type Get-UevAppxPackage, and press ENTER.
-
-> [!NOTE]
-> Starting in Windows 10, version 1607, you can configure UE-V to not synchronize Windows applications settings if the device is configured to use Enterprise State Roaming.
-
-### UE-V-support for roaming printers
-
-Users can print to their saved network printers, including their default network printer, from any network device.
-
-Printer roaming in UE-V requires one of these scenarios:
-
-- The print server can download the required driver when it roams to a new device.
-- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer.
-- The printer driver can be imported from Windows Update.
-
-> [!NOTE]
-> The UE-V printer roaming feature doesn't roam printer settings or preferences, such as printing double-sided.
-
-### Determine whether you need settings synchronized for other applications
-
-After you've reviewed the settings that are synchronized automatically in a UE-V deployment, you'll need to decide whether to synchronize settings for other applications as your decision will determine how you deploy UE-V throughout your enterprise.
-
-As an administrator, when you consider which desktop applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all desktop applications have settings that can be customized or that are routinely customized by users. In addition, not all desktop applications settings can be synchronized safely across multiple devices or environments.
-
-In general, you can synchronize settings that meet the following criteria:
-
-- Settings that are stored in user-accessible locations. For example, don't synchronize settings that are stored in System32 or outside the HKEY\_CURRENT\_USER (HKCU) section of the registry.
-- Settings that aren't specific to the particular device. For example, exclude network shortcuts or hardware configurations.
-- Settings that can be synchronized between computers without risk of corrupted data. For example, don't use settings that are stored in a database file.
-
-### Checklist for evaluating custom applications
-
-If you've decided that you need to synchronize settings for custom applications, use this checklist to determine which applications you'll include.
-
-| | Description |
-|-------|--------------------------|
-|  | Does this application contain settings that the user can customize? |
-|  | Is it important for the user that these settings are synchronized? |
-|  | Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application startup and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings sharing solutions, users might experience inconsistency across synchronized settings. |
-|  | Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations don't consistently synchronize across sessions and can cause a poor application experience. |
-|  | Does the application store settings in the Program Files directory or in the file directory that is located in the **Users**\ \[User name\] \**AppData**\**LocalLow** directory? Application data that is stored in either of these locations usually shouldn't synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize. |
-|  | Does the application store any settings in a file that contains other application data that shouldn't synchronize? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this extra data can cause a poor application experience.|
-|  | How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can affect the performance of settings synchronization. |
-
-## Other considerations when preparing a UE-V deployment
-
-You should also consider these things when you're preparing to deploy UE-V:
-
-- [Managing credentials synchronization](#managing-credentials-synchronization-in-ue-v)
-- [Windows applications settings synchronization](#windows-applications-settings-synchronization)
-- [Custom UE-V settings location templates](#custom-ue-v-settings-location-templates)
-- [Unintentional user settings configurations](#prevent-unintentional-user-settings-configuration)
-- [Performance and capacity](#performance-and-capacity-planning)
-- [High availability](#high-availability-for-ue-v)
-- [Computer clock synchronization](#synchronize-computer-clocks-for-ue-v-settings-synchronization)
-
-### Managing credentials synchronization in UE-V
-
-Many enterprise applications, including Microsoft Outlook, Lync, and Skype for Business prompt users for their domain credentials when they log in. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid reentering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V.
-
-> [!IMPORTANT]
-> Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization after you enable the UE-V service to implement this feature.
-
-UE-V can synchronize enterprise credentials, but doesn't roam credentials intended only for use on the local device.
-
-Credentials are synchronous settings, meaning that they're applied to users' profiles the first time they sign in to their devices after UE-V synchronizes.
-
-Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings.
-
-> [!IMPORTANT]
-> If you're using Active Directory Credential Roaming in your environment, we recommend that you do not enable the UE-V credential roaming template. Instead, use PowerShell or Group Policy to enable credentials synchronization. Note that credentials are encrypted during synchronization.
-
-[PowerShell](uev-administering-uev-with-windows-powershell-and-wmi.md)**:** Enter this PowerShell cmdlet to enable credential synchronization:
-
-```powershell
-Enable-UevTemplate RoamingCredentialSettings
-
-Copy
-```
-
-Use this PowerShell cmdlet to disable credential synchronization:
-
-```powershell
-Disable-UevTemplate RoamingCredentialSettings
-
-Copy
-```
-
-
-
-[Group Policy](uev-configuring-uev-with-group-policy-objects.md)**:** You must edit the Group Policy administrative template for UE-V, which is included in Windows 10, version 1607, to enable credential synchronization through group policy. Credentials synchronization is managed in Windows settings. To manage this feature with Group Policy, enable the **Synchronize Windows** settings policy.
-
-1. Open Group Policy Editor and navigate to **User Configuration > Administrative Templates > Windows Components > Microsoft User Experience Virtualization**.
-1. Double-click **Synchronize Windows settings**.
-1. If this policy is enabled, you can enable credentials synchronization by checking the **Roaming Credentials** check box, or disable credentials synchronization by unchecking it.
-1. Select **OK**.
-
-### Credential locations synchronized by UE-V
-
-Credential files saved by applications into the following locations are synchronized:
-
-- %UserProfile%\AppData\Roaming\Microsoft\Credentials\
-- %UserProfile%\AppData\Roaming\Microsoft\Crypto\
-- %UserProfile%\AppData\Roaming\Microsoft\Protect\
-- %UserProfile%\AppData\Roaming\Microsoft\SystemCertificates\
-
-Credentials saved to other locations aren't synchronized by UE-V.
-
-### Windows applications settings synchronization
-
-UE-V manages Windows application settings synchronization in three ways:
-
-- **Sync Windows applications:** Allow or deny any Windows application synchronization
-- **Windows applications list:** Synchronize a list of Windows applications
-- **Unlisted default sync behavior:** Determine the synchronization behavior of Windows applications that aren't in the Windows applications list.
-
-For more information, see the [Windows Application List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist).
-
-### Custom UE-V settings location templates
-
-If you're deploying UE-V to synchronize settings for custom applications, you'll use the UE-V template generator to create custom settings location templates for those desktop applications. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to user devices.
-
-Custom settings location templates must be deployed with an existing deployment infrastructure, such as an enterprise software distribution method, including Microsoft Configuration Manager, with preferences, or by configuring a UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered using UE-V WMI or Windows PowerShell.
-
-For more information about custom settings location templates, see [Deploy UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V with Microsoft Configuration Manager](uev-configuring-uev-with-system-center-configuration-manager.md).
-
-### Prevent unintentional user settings configuration
-
-UE-V downloads new user settings information from a settings storage location and applies the settings to the local device in these instances:
-
-- Each time an application is started that has a registered UE-V template
-- When a user signs in to a device
-- When a user unlocks a device
-- When a connection is made to a remote desktop device running UE-V
-- When the Sync Controller Application scheduled task is run
-
-If UE-V is installed on computer A and computer B, and the settings that you want for the application are on computer A, then computer A should open and close the application first. If the application is opened and closed on computer B first, then the application settings on computer A are configured to the application settings on computer B. Settings are synchronized between computers on per-application basis. Over time, settings become consistent between computers as they're opened and closed with preferred settings.
-
-This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should log on and log off computer A first.
-
-If the user settings that the user wants are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Manage Administrative Backup and Restore in UE-V](uev-manage-administrative-backup-and-restore.md).
-
-### Performance and capacity planning
-
-Specify your requirements for UE-V with standard disk capacity and network health monitoring.
-
-UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for each application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks.
-
-To reduce problems with network latency, create settings storage locations on the same local networks where the users' computers reside. We recommend 20 MB of disk space per user for the settings storage location.
-
-By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy objects](uev-configuring-uev-with-group-policy-objects.md).
-
-### High availability for UE-V
-
-The UE-V settings storage location and settings template catalog support storing user data on any writable share. To ensure high availability, follow these criteria:
-
-- Format the storage volume with an NTFS file system.
-- The share can use Distributed File System (DFS) replication, but Distributed File System Replication (DFSR) isn't supported. Distributed File System Namespaces (DFSN) are supported. For detailed information, see:
- - [Deploying Roaming User Profiles](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles)
- - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](/troubleshoot/windows-server/networking/support-policy-for-dfsr-dfsn-deployment)
-
- In addition, because SYSVOL uses DFSR for replication, SYSVOL can't be used for UE-V data file replication.
-
-- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the settings storage location for UE-V](uev-deploy-required-features.md).
-- Use file server clustering along with the UE-V service to provide access to copies of user state data if communications failures occur.
-- You can store the settings storage path data (user data) and settings template catalog templates on clustered shares, on DFSN shares, or on both.
-
-### Synchronize computer clocks for UE-V settings synchronization
-
-Computers that run the UE-V service must use a time server to maintain a consistent settings experience. UE-V uses time stamps to determine if settings must be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location.
-
-## Confirm prerequisites and supported configurations for UE-V
-
-Before you proceed, ensure that your environment meets these requirements for using UE-V.
-
-| Operating system | Edition | Service pack | System architecture | Windows PowerShell | Microsoft .NET Framework |
-|--|--|--|--|--|--|
-| Windows 10, version 1607 | Windows 10 for Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
-| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
-| Windows Server 2012 and Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
-
-> [!NOTE]
-> - Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
-> - The "Delete Roaming Cache" policy for mandatory profiles isn't supported with UE-V and shouldn't be used.
-
-There are no special random access memory (RAM) requirements specific to UE-V.
-
-### Synchronization of settings through the Sync Provider
-
-Sync Provider is the default setting for users and synchronizes a local cache with the settings storage location in these instances:
-
-- Log on/log off
-- Lock/unlock
-- Remote desktop connect/disconnect
-- Application open/close
-
-A scheduled task manages this synchronization of settings every 30 minutes or through trigger events for certain applications. For more information, see [Changing the frequency of UE-V scheduled tasks](uev-changing-the-frequency-of-scheduled-tasks.md).
-
-The UE-V service synchronizes user settings for devices that aren't always connected to the enterprise network (remote devices and laptops) and devices that are always connected to the network (devices that run Windows Server and host virtual desktop interface (VDI) sessions).
-
-**Synchronization for computers with always-available connections** When you use UE-V on devices that are always connected to the network, you must configure the UE-V service to synchronize settings by using the *SyncMethod=None* parameter, which treats the settings storage server as a standard network share. In this configuration, the UE-V service can be configured to notify if the import of the application settings is delayed.
-
-Enable this configuration using one of these methods:
-
-- After you enable the UE-V service, use the Settings Management feature in Microsoft Configuration Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration.
-- Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the SyncMethod = None configuration.
-
-Restart the device to allow the settings to synchronize.
-
-> [!NOTE]
-> These methods do not work for pooled virtual desktop infrastructure (VDI) environments.
-
-> [!NOTE]
-> If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
-
-**Synchronization for external sync engines** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user device, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different devices that users access.
-
-**Support for shared VDI sessions** UE-V supports VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
-
-> [!NOTE]
-> If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md).
-
-The VDI template is provided with UE-V and is typically available here after installation: C:\ProgramData\Microsoft\UEV\InboxTemplates
-
-### Prerequisites for UE-V template generator support
-
-Install the UE-V template generator on the device that is used to create custom settings location templates. This device should be able to run the applications that you want to synchronize settings for. You must be a member of the Administrators group on the device that runs the UE-V template generator software.
-
-The UE-V template generator must be installed on a device that uses an NTFS file system. The UE-V template generator software requires .NET Framework 1. For more information, see [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md).
-
-## Other resources for this feature
-
-- [User Experience Virtualization overview](uev-for-windows.md)
-- [Get started with UE-V](uev-getting-started.md)
-- [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md)
-- [Administering UE-V](uev-administering-uev.md)
-- [Troubleshooting UE-V](uev-troubleshooting.md)
-- [Technical Reference for UE-V](uev-technical-reference.md)
diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md
deleted file mode 100644
index b59b289e49..0000000000
--- a/windows/configuration/ue-v/uev-release-notes-1607.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: User Experience Virtualization (UE-V) Release Notes
-description: Read the latest information required to successfully install and use User Experience Virtualization (UE-V) that isn't included in the UE-V documentation.
-ms.date: 1/25/2024
-ms.topic: article
----
-
-# User Experience Virtualization (UE-V) Release Notes
-
-This topic includes information required to successfully install and use UE-V that isn't included in the User Experience Virtualization (UE-V) documentation. If there are differences between the information in this topic and other UE-V topics, the latest change should be considered authoritative.
-
-### Company Settings Center removed in UE-V for Windows 10, version 1607
-
-In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues.
-
-With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings.
-
-Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell.
-
-> [!NOTE]
-> With the removal of the Company Settings Center, the following group policies are no longer applicable:
->
-> - Contact IT Link Text
-> - Contact IT URL
-> - Tray Icon
-
-### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked
-
-Version 1.0 of UE-V used Offline Files (Client-Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607.
-
-WORKAROUND: Remove the UE-V 1.0 sync folder from the Offline Files configuration and then upgrade to the in-box version of UE-V for Windows, version 1607 release.
-
-### UE-V settings location templates for Skype cause Skype to crash
-
-When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log.
-
-WORKAROUND: Remove or unregister the Skype template to allow Skype to work again.
-
-### Registry settings don't synchronize between App-V and native applications on the same device
-
-When a device has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings don't synchronize between the technologies.
-
-WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both.
-
-### Unpredictable results when both Office 2010 and Office 2013 are installed on the same device
-
-When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This roaming could cause the Office 2010 package size to be large or result in unpredictable conflicts with 2013, particularly if Office 365 is used.
-
-WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V.
-
-### Uninstallation and reinstallation of Windows 8 applications reverts settings to initial state
-
-While UE-V settings synchronization is being used for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application's settings revert to their default values. This result happens because the uninstall removes the local (cached) copy of the application's settings but doesn't remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gathers the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications.
-
-WORKAROUND: None.
-
-### UE-V doesn't support roaming settings between 32-bit and 64-bit versions of Microsoft Office
-
-We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click [here](
This default setting is the gold standard for computers. This option attempts to synchronize the setting and times out after a short delay to ensure that the application or operating system startup isn't delayed for a long period of time.
This functionality is also tied to the Scheduled task - Sync Controller Application. The administrator controls the frequency of the Scheduled task. By default, computers synchronize their settings every 30 min after logging on. |
-| External | This configuration method specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. |
-| None | This configuration setting is designed for the Virtual Desktop Infrastructure (VDI) and Streamed Application experience primarily. This setting should be used on computers running the Windows Server operating system in a datacenter, where the connection will always be available.
Any settings changes are saved directly to the server. If the network connection to the settings storage path isn't available, then the settings changes are cached on the device and are synchronized the next time that the Sync Provider runs. If the settings storage path isn't found and the user profile is removed from a pooled VDI environment on sign out, then these settings changes are lost, and the user must reapply the change when the computer can again reach the settings storage path.
Apps and OS will wait indefinitely for the location to be present. This waiting period could cause App load or OS sign-in time to dramatically increase if the location isn't found. |
-
-You can configure the sync method in these ways:
-
-- Through [Group Policy](uev-configuring-uev-with-group-policy-objects.md) settings
-- With the [Configuration Manager Pack](uev-configuring-uev-with-system-center-configuration-manager.md) for UE-V
-- With [Windows PowerShell or Windows Management Instrumentation (WMI)](uev-administering-uev-with-windows-powershell-and-wmi.md)
diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md
deleted file mode 100644
index a7347846ca..0000000000
--- a/windows/configuration/ue-v/uev-sync-trigger-events.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-title: Sync Trigger Events for UE-V
-description: Learn how User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices.
-ms.date: 1/25/2024
-ms.topic: article
----
-
-# Sync Trigger Events for UE-V
-
-User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. *Sync trigger events* define when the UE-V service synchronizes those settings with the settings storage location. For more information about Sync Method configuration, see [Sync Methods for UE-V](uev-sync-methods.md).
-
-## UE-V Sync Trigger Events
-
-The following table explains the trigger events for classic applications and Windows settings.
-
-|UE-V Trigger Event|SyncMethod=SyncProvider|SyncMethod=None|
-|--- |--- |--- |
-|**Windows Logon**|
geo-prod.do.dsp.mp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com | 443 | Geo | Service used to identify the location of the device in order to direct it to the nearest data center. | **Profile**: The device type (for example, PC or Xbox)
**doClientVersion**: The version of the DoSvc client
**groupID**: Group the device belongs to (set with DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies)
-| kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services and device configs. | **countryCode**: The country or region the client is connected from
**doClientVersion**: The version of the DoSvc client
**Profile**: The device type (for example, PC or Xbox)
**eId**: Client grouping ID
**CacheHost**: Cache host ID
-| cp\*.prod.do.dsp.mp.microsoft.com
| 443 | Content Policy | Provides content specific policies and as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox)
**ContentId**: The content identifier
**doClientVersion**: The version of the DoSvc client
**countryCode**: The country the client is connected from
**altCatalogID**: If ContentID isn't available, use the download URL instead
**eID**: Client grouping ID
**CacheHost**: Cache host ID
-| disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupID and external IP. | **Profile**: The device type (for example, PC or Xbox)
**ContentID**: The content identifier
**doClientVersion**: The version of the DoSvc client
**partitionID**: Client partitioning hint
**altCatalogID**: If ContentID isn't available, use the download URL instead
**eID**: Client grouping ID
-| array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox)
**ContentID**: The content identifier
**doClientVersion**: The version of the DoSvc client
**altCatalogID**: If ContentID isn't available, use the download URL instead
**PeerID**: Identity of the device running DO client
**ReportedIp**: The internal / private IP Address
**IsBackground**: Is the download interactive or background
**Uploaded**: Total bytes uploaded to peers
**Downloaded**: Total bytes downloaded from peers
**DownloadedCdn**: Total bytes downloaded from CDN
**Left**: Bytes left to download
**Peers Wanted**: Total number of peers wanted
**Group ID**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies)
**Scope**: The Download mode
**UploadedBPS**: The upload speed in bytes per second
**DownloadBPS**: The download speed in Bytes per second
**eID**: Client grouping ID
-| dl.delivery.mp.microsoft.com
emdl.ws.microsoft.com
download.windowsupdate.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer.
+|--------------------------------------------|--------|---------------|-----------------------|------------------------|
+| geover-prod.do.dsp.mp.microsoft.com
geo-prod.do.dsp.mp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com | 443 | Geo | Service used to identify the location of the device in order to direct it to the nearest data center. | **Profile**: The device type (for example, PC or Xbox)
**doClientVersion**: The version of the DoSvc client
**groupID**: Group the device belongs to (set with DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies) |
+| kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services and device configs. | **countryCode**: The country or region the client is connected from
**doClientVersion**: The version of the DoSvc client
**Profile**: The device type (for example, PC or Xbox)
**eId**: Client grouping ID
**CacheHost**: Cache host ID |
+| cp\*.prod.do.dsp.mp.microsoft.com
| 443 | Content Policy | Provides content specific policies and as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox)
**ContentId**: The content identifier
**doClientVersion**: The version of the DoSvc client
**countryCode**: The country the client is connected from
**altCatalogID**: If ContentID isn't available, use the download URL instead
**eID**: Client grouping ID
**CacheHost**: Cache host ID |
+| disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupID and external IP. | **Profile**: The device type (for example, PC or Xbox)
**ContentID**: The content identifier
**doClientVersion**: The version of the DoSvc client
**partitionID**: Client partitioning hint
**altCatalogID**: If ContentID isn't available, use the download URL instead
**eID**: Client grouping ID |
+| array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox)
**ContentID**: The content identifier
**doClientVersion**: The version of the DoSvc client
**altCatalogID**: If ContentID isn't available, use the download URL instead
**PeerID**: Identity of the device running DO client
**ReportedIp**: The internal / private IP Address
**IsBackground**: Is the download interactive or background
**Uploaded**: Total bytes uploaded to peers
**Downloaded**: Total bytes downloaded from peers
**DownloadedCdn**: Total bytes downloaded from CDN
**Left**: Bytes left to download
**Peers Wanted**: Total number of peers wanted
**Group ID**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies)
**Scope**: The Download mode
**UploadedBPS**: The upload speed in bytes per second
**DownloadBPS**: The download speed in Bytes per second
**eID**: Client grouping ID |
+| dl.delivery.mp.microsoft.com
download.windowsupdate.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer. |
diff --git a/windows/deployment/update/media/37063317-admin-center-software-updates.png b/windows/deployment/update/media/37063317-admin-center-software-updates.png
index f31988b83d..0fd829bdf2 100644
Binary files a/windows/deployment/update/media/37063317-admin-center-software-updates.png and b/windows/deployment/update/media/37063317-admin-center-software-updates.png differ
diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md
index a9af4519db..732aab35e3 100644
--- a/windows/deployment/update/prepare-deploy-windows.md
+++ b/windows/deployment/update/prepare-deploy-windows.md
@@ -105,7 +105,6 @@ Ensure that devices can reach necessary Windows Update endpoints through the fir
|Protocol |Endpoint URL |
|---------|---------|
|TLS 1.2 | `*.prod.do.dsp.mp.microsoft.com` |
-|HTTP | `emdl.ws.microsoft.com` |
|HTTP | `*.dl.delivery.mp.microsoft.com` |
|HTTP | `*.windowsupdate.com` |
|HTTPS | `*.delivery.mp.microsoft.com` |
diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md
index 25fff01d83..68e010805d 100644
--- a/windows/deployment/update/waas-manage-updates-wufb.md
+++ b/windows/deployment/update/waas-manage-updates-wufb.md
@@ -14,7 +14,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 11/07/2023
+ms.date: 05/16/2024
---
# What is Windows Update for Business?
@@ -112,7 +112,7 @@ Windows Update for Business provides controls to help meet your organization's s
#### Recommended experience settings
-Features like the smart busy check (which ensure updates don't happen when a user is signed in) and active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features:
+Features like active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features:
1. Automatically download, install, and restart (default if no restart policies are set up or enabled).
1. Use the default notifications.
diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md
index 6fd7172197..0170408476 100644
--- a/windows/deployment/update/waas-restart.md
+++ b/windows/deployment/update/waas-restart.md
@@ -113,7 +113,7 @@ Starting in Windows 10 version 1809, you can define which Windows Update notific
To configure this behavior through MDM, use [**Update/UpdateNotificationLevel**](/windows/client-management/mdm/policy-configuration-service-provider#update-updatenotificationlevel).
-Starting in Windows 11, version 22H2, **Apply only during active hours** was added as an additional option for **Display options for update notifications**. When **Apply only during active hours** is selected, the notifications will only be disabled during active hours when options `1` or `2` are used. To ensure that the device stays updated, a notification will still be shown during active hours if **Apply only during active hours** is selected, and once a deadline has been reached when [Specify deadlines for automatic updates and restarts](wufb-compliancedeadlines.md) is configured.
+Starting in Windows 11, version 22H2, **Apply only during active hours** was added as an additional option for **Display options for update notifications**. When **Apply only during active hours** is selected, the notifications will only be disabled during active hours when options `1` or `2` are used. To ensure that the device stays updated, a notification will still be shown during active hours if **Apply only during active hours** is selected, and once a deadline has been reached when [Specify deadlines for automatic updates and restarts](wufb-compliancedeadlines.md) is configured.
To configure this behavior through MDM, use [**Update/UpdateNotificationLevel**](/windows/client-management/mdm/policy-csp-update#update-NoUpdateNotificationDuringActiveHours).
diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md
index 23e561ea09..0ab9c7324e 100644
--- a/windows/deployment/update/waas-wufb-csp-mdm.md
+++ b/windows/deployment/update/waas-wufb-csp-mdm.md
@@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 01/18/2024
+ms.date: 05/16/2024
---
# Walkthrough: Use CSPs and MDMs to configure Windows Update for Business
@@ -39,9 +39,9 @@ You can control when updates are applied, for example by deferring when an updat
Both feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device.
-To enable Microsoft Updates, use [Update/AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update#update-allowmuupdateservice).
+To enable Microsoft Updates, use [Update/AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update#allowmuupdateservice).
-Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to be updated on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use Update/[ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#update-excludewudriversinqualityupdate).
+Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to be updated on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use Update/[ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#excludewudriversinqualityupdate).
We also recommend that you allow Microsoft product updates as discussed previously.
@@ -51,20 +51,20 @@ Drivers are automatically enabled because they're beneficial to device systems.
1. Ensure that you're enrolled in the Windows Insider Program for Business. Windows Insider is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates.
-1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set the option to **Enable preview builds**.
+1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#managepreviewbuilds). Set the option to **Enable preview builds**.
-1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation.
+1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation.
-1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
+1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
#### I want to manage which released feature update my devices receive
A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you don't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify.
-- To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays)
-- To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdatesstarttime)
-- To defer a quality update: [Update/DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays)
-- To pause a quality update: [Update/PauseQualityUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausequalityupdatesstarttime)
+- To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferfeatureupdatesperiodindays)
+- To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#pausefeatureupdatesstarttime)
+- To defer a quality update: [Update/DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferqualityupdatesperiodindays)
+- To pause a quality update: [Update/PauseQualityUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#pausequalityupdatesstarttime)
#### Example
@@ -103,42 +103,42 @@ Now all devices are paused from updating for 35 days. When the pause is removed,
#### I want to stay on a specific version
-If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the [Update/TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion) (or Deploy Feature Updates Preview in Intune) instead of using feature update deferrals. When you use this policy, specify the version that you want your device(s) to move to or stay on (for example, "1909"). You can find version information at the [Windows 10 Release Information Page](/windows/release-health/release-information).
+If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the [Update/TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#targetreleaseversion) (or Deploy Feature Updates Preview in Intune) instead of using feature update deferrals. When you use this policy, specify the version that you want your device(s) to move to or stay on (for example, "1909"). You can find version information at the [Windows 10 Release Information Page](/windows/release-health/release-information).
### Manage how users experience updates
#### I want to manage when devices download, install, and restart after updates
-We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check.
+We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours.
-For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart).
+For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#activehoursstart).
It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours.
-To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan:
+To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan:
-- [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday)
-- [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek)
-- [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek)
-- [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek)
-- [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek)
-- [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek)
-- [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime)
+- [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#scheduledinstallday)
+- [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstalleveryweek)
+- [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfirstweek)
+- [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfourthweek)
+- [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallsecondweek)
+- [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallthirdweek)
+- [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#scheduledinstalltime)
When you set these policies, installation happens automatically at the specified time and the device will restart 15 minutes after installation is complete (unless it's interrupted by the user).
-If you don't want to allow any automatic updates prior to the deadline, set [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) to Option 5, which turns off automatic updates.
+If you don't want to allow any automatic updates prior to the deadline, set [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) to Option 5, which turns off automatic updates.
#### I want to keep devices secure and compliant with update deadlines
We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. Deadlines work by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings:
-- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates)
-- [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates)
-- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod)
+- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlineforfeatureupdates)
+- [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#configuredeadlineforqualityupdates)
+- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiod)
- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates)
-- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot)
+- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#configuredeadlinenoautoreboot)
These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point, the device automatically schedules a restart regardless of active hours.
@@ -168,11 +168,37 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window
+#### End user settings for notifications
+
+*Applies to:*
+- Windows 11, version 23H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
+- Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
+
+Users can set a preference for notifications about pending restarts for updates under **Settings** > **Windows Update** > **Advanced options** > **Notify me when a restart is required to finish updating**. This setting is end-user controlled and not controlled or configurable by IT administrators.
+
+Users have the following options for the **Notify me when a restart is required to finish updating** setting:
+
+- **Off** (default): Once the device enters a pending reboot state for updates, restart notifications are suppressed for 24 hours. During the first 24 hours, automatic restarts can still occur outside of active hours. Typically, users receive fewer notifications about upcoming restarts while the deadline is approaching.
+ - When the deadline is set for 1 day, users only receive a notification about the deadline and a final nondismissable notification 15 minutes before a forced restart.
+
+- **On**: Users immediately receive a toast notification when the device enters a reboot pending state for updates. Automatic restarts for updates are blocked for 24 hours after the initial notification to give these users time to prepare for a restart. After 24 hours have passed, automatic restarts can occur. This setting is recommended for users who want to be notified about upcoming restarts.
+ - When the deadline is set for 1 day, an initial notification occurs, automatic restart is blocked for 24 hours, and users receive another notification before the deadline and a final nondismissable notification 15 minutes before a forced restart.
+
+When a deadline is set for 0 days, no matter which option is selected, the only notification users receive is a final nondismissable notification 15 minutes before a forced restart.
+
+The user preference for notifications applies when the following policies for [compliance deadlines](wufb-compliancedeadlines.md) are used:
+
+- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates)
+- [Update/ConfigureDeadlineForQualityUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates)
+- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod)
+- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates (Windows 11, version 22H2 or later)](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates)
+- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot)
+
#### I want to manage the notifications a user sees
There are additional settings that affect the notifications.
-We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values:
+We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/NoUpdateNotificationsDuringActiveHours](/windows/client-management/mdm/policy-csp-update#NoUpdateNotificationsDuringActiveHours) policy with these values:
**0** (default) - Use the default Windows Update notifications
**1** - Turn off all notifications, excluding restart warnings
@@ -181,16 +207,18 @@ We recommend that you use the default notifications as they aim to provide the b
> [!NOTE]
> Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled.
-Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications.
+Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications.
#### I want to manage the update settings a user can access
Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users.
-Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#update-setdisablepauseuxaccess).
+Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#setdisablepauseuxaccess).
When you disable this setting, users see **Some settings are managed by your organization** and the update pause settings are greyed out.
-If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess).
+If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#setdisableuxwuaccess).
+
+
#### I want to enable features introduced via servicing that are off by default
diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md
index a039f0c714..f78cd0d3e4 100644
--- a/windows/deployment/update/waas-wufb-group-policy.md
+++ b/windows/deployment/update/waas-wufb-group-policy.md
@@ -17,7 +17,7 @@ appliesto:
- ✅ Windows Server 2022
- ✅ Windows Server 2019
- ✅ Windows Server 2016
-ms.date: 02/27/2024
+ms.date: 05/16/2024
---
# Walkthrough: Use Group Policy to configure Windows Update for Business
@@ -132,7 +132,7 @@ When you set the target version policy, if you specify a feature update version
#### I want to manage when devices download, install, and restart after updates
-We recommend that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check.
+We recommend that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours.
For more granular control, you can set the maximum period of active hours the user can set with **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify active hours range for auto restart**.
@@ -174,6 +174,28 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window
+
+#### End user settings for notifications
+
+*Applies to:*
+- Windows 11, version 23H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
+- Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
+
+Users can set a preference for notifications about pending restarts for updates under **Settings** > **Windows Update** > **Advanced options** > **Notify me when a restart is required to finish updating**. This setting is end-user controlled and not controlled or configurable by IT administrators.
+
+Users have the following options for the **Notify me when a restart is required to finish updating** setting:
+
+- **Off** (default): Once the device enters a pending reboot state for updates, restart notifications are suppressed for 24 hours. During the first 24 hours, automatic restarts can still occur outside of active hours. Typically, users receive fewer notifications about upcoming restarts while the deadline is approaching.
+ - When the deadline is set for 1 day, users only receive a notification about the deadline and a final nondismissable notification 15 minutes before a forced restart.
+
+- **On**: Users immediately receive a toast notification when the device enters a reboot pending state for updates. Automatic restarts for updates are blocked for 24 hours after the initial notification to give these users time to prepare for a restart. After 24 hours have passed, automatic restarts can occur. This setting is recommended for users who want to be notified about upcoming restarts.
+ - When the deadline is set for 1 day, an initial notification occurs, automatic restart is blocked for 24 hours, and users receive another notification before the deadline and a final nondismissable notification 15 minutes before a forced restart.
+
+When a deadline is set for 0 days, no matter which option is selected, the only notification users receive is a final nondismissable notification 15 minutes before a forced restart.
+
+The user preference for notifications applies when [compliance deadlines](wufb-compliancedeadlines.md) are used. The policy for compliance deadlines is under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify deadlines for automatic updates and restarts**.
+
+
#### I want to manage the notifications a user sees
There are additional settings that affect the notifications.
diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md
index 390117afd2..0a90bb71ad 100644
--- a/windows/deployment/update/wufb-compliancedeadlines.md
+++ b/windows/deployment/update/wufb-compliancedeadlines.md
@@ -12,7 +12,7 @@ manager: aaroncz
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 10/10/2023
+ms.date: 05/16/2024
---
# Enforcing compliance deadlines for updates
@@ -46,6 +46,7 @@ The deadline calculation for both quality and feature updates is based off the t
The grace period for both quality and feature updates starts its countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, users are able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) Grace periods are useful for users who may be coming back from vacation, or other extended time away from their device, to ensure a forced reboot doesn't occur immediately after they return.
> [!NOTE]
+> - When these policies are used, [user settings for notifications](waas-wufb-csp-mdm.md#user-settings-for-notifications) are also used on clients running Windows 11, version 22H2 and later.
> - When **Specify deadlines for automatic updates and restarts** is used, updates will be downloaded and installed as soon as they are offered.
> - When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored.
diff --git a/windows/deployment/update/wufb-reports-admin-center.md b/windows/deployment/update/wufb-reports-admin-center.md
index 9d93702ea9..37d01729ad 100644
--- a/windows/deployment/update/wufb-reports-admin-center.md
+++ b/windows/deployment/update/wufb-reports-admin-center.md
@@ -14,7 +14,7 @@ appliesto:
- ✅ Windows 10
- ✅ Windows Update for Business reports
- ✅ Microsoft 365 admin center
-ms.date: 04/26/2023
+ms.date: 05/08/2024
---
# Microsoft 365 admin center software updates page
diff --git a/windows/deployment/update/wufb-reports-faq.yml b/windows/deployment/update/wufb-reports-faq.yml
index 99fee1bb21..6bb4fce480 100644
--- a/windows/deployment/update/wufb-reports-faq.yml
+++ b/windows/deployment/update/wufb-reports-faq.yml
@@ -9,7 +9,7 @@ metadata:
manager: aaroncz
author: mestew
ms.author: mstewart
- ms.date: 01/26/2024
+ ms.date: 05/07/2024
title: Frequently Asked Questions about Windows Update for Business reports
summary: |
This article answers frequently asked questions about Windows Update for Business reports.
@@ -20,7 +20,7 @@ summary: |
- [Is Windows Update for Business reports free?](#is-windows-update-for-business-reports-free)
- [What Windows versions are supported?](#what-windows-versions-are-supported)
- **Setup questions**:
+ **Set up questions**:
- [How do you set up Windows Update for Business reports?](#how-do-you-set-up-windows-update-for-business-reports)
- [Why is "Waiting for Windows Update for Business reports data" displayed on the page](#why-is--waiting-for-windows-update-for-business-reports-data--displayed-on-the-page)
@@ -64,6 +64,8 @@ sections:
- question: What Windows versions are supported?
answer: |
Windows Update for Business reports supports clients running a [supported version of Windows 10 or Windows 11](/windows/release-health/supported-versions-windows-client) Professional, Education, Enterprise, and Enterprise multi-session editions. Windows Update for Business reports only provides data for the standard Desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions.
+ > [!Important]
+ > Currently there is a known issue where Windows Update for Business reports doesn't display data for Enterprise multi-session edition devices.
- name: Setup questions
questions:
@@ -103,7 +105,7 @@ sections:
answer: |
Here are some reasons why you may not be seeing devices in reports:
- - **The device isn't enrolled with Azure Active Directory**: A [prerequisite](wufb-reports-prerequisites.md#azure-and-azure-active-directory) for devices is that they're either [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
+ - **The device isn't enrolled with Microsoft Entra**: A [prerequisite](wufb-reports-prerequisites.md#azure-and-azure-active-directory) for devices is that they're either [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
- **The device isn't sending data**: It's possible devices aren't sharing data due to a policy being incorrectly configured or a proxy or firewall configuration. Try using the [configuration script](wufb-reports-configuration-script.md) on devices to ensure they're configured properly.
- **The device isn't active enough**: Clients must be active and connected to the internet to scan against Microsoft Update. Ensure devices are powered on and have been active at least once in the past 28 days.
- **The workbook has limited the results**: The default limit for rows in Azure workbooks is set to 1000. This limit is to avoid any delay in the load time for the interface. If you noticed that you can't find a specific device, you can export the output in Excel, or open the results in the logs view for the full result by selecting the three dots beside each component.
@@ -115,13 +117,13 @@ sections:
An unknown client state is displayed if there isn't an update record for the device. This state can happen for many reasons, like the device not being active, not being able to scan Windows Update, or it doesn't currently have any update related activity occurring.
- question: What is the difference between OS version and target version?
answer: |
- The word *target* in data labels refers to the update version, build or KB the client intends to update to. Typically, the fields starting with *OS*, such as OSbuild and OSversion, represents what the device is currently running.
+ The word *target* in data labels refers to the update version, build, or KB the client intends to update to. Typically, the fields starting with *OS*, such as OSbuild and OSversion, represents what the device is currently running.
- question: When should I use the UCClient, UCClientUpdateStatus, or UCUpdateAlert tables?
answer: |
These tables can be used for the following information:
- **UCClient**: Represents an individual device's record. It contains data such as the device's name, currently installed build, and the OS Edition. Each device has one record in this table. Use this table to get the overall compliance status of your devices.
- - To display information for a specific device by Azure AD device ID:
+ - To display information for a specific device by Microsoft Entra device ID:
`UCClient where AzureADDeviceId contains "01234567-89ab-cdef-0123-456789abcdef"`
- To display all device records for devices running any Windows 11 OS version:
`UCClient | where OSVersion contains "Windows 11"`
@@ -132,7 +134,7 @@ sections:
- To display devices that are in the restart required substate:
`UCClientUpdateStatus |where ClientSubstate =="RestartRequired"`
- - **UCUpdateAlert**: Use this table to understand update failures and act on devices through alert recommendations. This table contains information that needs attention, relative to one device, one update and one deployment (if relevant).
+ - **UCUpdateAlert**: Use this table to understand update failures and act on devices through alert recommendations. This table contains information that needs attention, relative to one device, one update, and one deployment (if relevant).
- To display information about an error code:
`UCUpdateAlert|where ErrorCode =="0X8024000b"`
- To display a count of devices with active alerts by subtype:
diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md
index 30f7ecac00..ea7fb94cbb 100644
--- a/windows/deployment/update/wufb-reports-prerequisites.md
+++ b/windows/deployment/update/wufb-reports-prerequisites.md
@@ -11,7 +11,7 @@ manager: aaroncz
appliesto:
- ✅ Windows 11
- ✅ Windows 10
-ms.date: 12/15/2023
+ms.date: 05/07/2024
---
# Windows Update for Business reports prerequisites
@@ -35,11 +35,14 @@ Before you begin the process of adding Windows Update for Business reports to yo
## Operating systems and editions
-- Windows 11 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions
-- Windows 10 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions
+- Windows 11 Professional, Education, Enterprise, and Enterprise multi-session editions
+- Windows 10 Professional, Education, Enterprise, and Enterprise multi-session editions
Windows Update for Business reports only provides data for the standard desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions.
+> [!Important]
+> Currently there is a known issue where Windows Update for Business reports doesn't display data for Enterprise multi-session edition devices.
+
## Windows client servicing channels
Windows Update for Business reports supports Windows client devices on the following channels:
diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md
index 520ba1010a..c13a48e0c7 100644
--- a/windows/deployment/usmt/usmt-loadstate-syntax.md
+++ b/windows/deployment/usmt/usmt-loadstate-syntax.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/09/2024
+ms.date: 04/30/2024
ms.topic: article
ms.subservice: itpro-deploy
appliesto:
@@ -127,33 +127,33 @@ The `/uel`, `/ue` and `/ui` options can be used together to migrate only the use
## Incompatible command-line options
-The following table indicates which command-line options aren't compatible with the `LoadState.exe` command. If the table entry for a particular combination has a ✔️, the options are compatible, and they can be used together. The ❌ symbol means that the options aren't compatible. For example, the `/nocompress` option can't be used with the `/encrypt` option.
+The following table indicates which command-line options aren't compatible with the `LoadState.exe` command. If the table entry for a particular combination has a ✅, the options are compatible, and they can be used together. The ❌ symbol means that the options aren't compatible. For example, the `/nocompress` option can't be used with the `/encrypt` option.
| Command-Line Option | /keyfile | /nocompress | /genconfig | /all |
|--- |--- |--- |--- |--- |
-| **/i** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/v** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/nocompress** | ✔️ | N/A | ❌ | ✔️ |
-| **/key** | ❌ | ✔️ | ❌ | ✔️ |
-| **/decrypt** | Required* | ❌ | ❌ | ✔️ |
-| **/keyfile** | N/A | ✔️ | ❌ | ✔️ |
-| **/l** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/progress** | ✔️ | ✔️ | ❌ | ✔️ |
-| **/r** | ✔️ | ✔️ | ❌ | ✔️ |
-| **/w** | ✔️ | ✔️ | ❌ | ✔️ |
-| **/c** | ✔️ | ✔️ | ❌ | ✔️ |
-| **/p** | ✔️ | ✔️ | ❌ | N/A |
-| **/all** | ✔️ | ✔️ | ❌ | ✔️ |
-| **/ui** | ✔️ | ✔️ | ❌ | ❌ |
-| **/ue** | ✔️ | ✔️ | ❌ | ❌ |
-| **/uel** | ✔️ | ✔️ | ❌ | ❌ |
-| **/genconfig** | ✔️ | ✔️ | N/A | ✔️ |
-| **/config** | ✔️ | ✔️ | ❌ | ✔️ |
-| *StorePath* | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/md** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/mu** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/lae** | ✔️ | ✔️ | ✔️ | ✔️ |
-| **/lac** | ✔️ | ✔️ | ✔️ | ✔️ |
+| **/i** | ✅ | ✅ | ✅ | ✅ |
+| **/v** | ✅ | ✅ | ✅ | ✅ |
+| **/nocompress** | ✅ | N/A | ❌ | ✅ |
+| **/key** | ❌ | ✅ | ❌ | ✅ |
+| **/decrypt** | Required* | ❌ | ❌ | ✅ |
+| **/keyfile** | N/A | ✅ | ❌ | ✅ |
+| **/l** | ✅ | ✅ | ✅ | ✅ |
+| **/progress** | ✅ | ✅ | ❌ | ✅ |
+| **/r** | ✅ | ✅ | ❌ | ✅ |
+| **/w** | ✅ | ✅ | ❌ | ✅ |
+| **/c** | ✅ | ✅ | ❌ | ✅ |
+| **/p** | ✅ | ✅ | ❌ | N/A |
+| **/all** | ✅ | ✅ | ❌ | ✅ |
+| **/ui** | ✅ | ✅ | ❌ | ❌ |
+| **/ue** | ✅ | ✅ | ❌ | ❌ |
+| **/uel** | ✅ | ✅ | ❌ | ❌ |
+| **/genconfig** | ✅ | ✅ | N/A | ✅ |
+| **/config** | ✅ | ✅ | ❌ | ✅ |
+| *StorePath* | ✅ | ✅ | ✅ | ✅ |
+| **/md** | ✅ | ✅ | ✅ | ✅ |
+| **/mu** | ✅ | ✅ | ✅ | ✅ |
+| **/lae** | ✅ | ✅ | ✅ | ✅ |
+| **/lac** | ✅ | ✅ | ✅ | ✅ |
> [!NOTE]
>
diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md
index 1ed79eb022..cdb3d41096 100644
--- a/windows/deployment/usmt/usmt-requirements.md
+++ b/windows/deployment/usmt/usmt-requirements.md
@@ -6,7 +6,7 @@ manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
-ms.date: 01/18/2024
+ms.date: 04/30/2024
ms.topic: article
ms.subservice: itpro-deploy
appliesto:
@@ -24,10 +24,10 @@ The following table lists the operating systems supported in USMT.
| Operating
Systems | ScanState
(Source
Device)| LoadState
(Destination
Device)|
|--- |--- |--- |
-|Windows 7|✔️|❌|
-|Windows 8|✔️|❌|
-|Windows 10|✔️|✔️|
-|Windows 11|✔️|✔️|
+|Windows 7|✅|❌|
+|Windows 8|✅|❌|
+|Windows 10|✅|✅|
+|Windows 11|✅|✅|
> [!NOTE]
>
@@ -79,7 +79,7 @@ To open an elevated command prompt:
### Specify the `/c` option and \
Device Guard protects in the following ways:
For more information, see [Introduction to Device Guard](/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).|
|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.
For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).|
|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.
For more information, see [Getting started with App-V for Windows client](/windows/application-management/app-v/appv-getting-started).|
-|User Experience Virtualization (UE-V)|With this feature, user-customized Windows and application settings can be captured and stored on a centrally managed network file share.
When users sign in, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they sign into.
UE-V provides the following features:
For more information, see [User Experience Virtualization (UE-V) overview](/windows/configuration/ue-v/uev-for-windows).|
+|User Experience Virtualization (UE-V)|With this feature, user-customized Windows and application settings can be captured and stored on a centrally managed network file share.
When users sign in, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they sign into.
UE-V provides the following features:
For more information, see [User Experience Virtualization (UE-V) overview](/microsoft-desktop-optimization-pack/ue-v/uev-for-windows).|
|Managed User Experience|This feature helps customize and lock down a Windows device's user interface to restrict it to a specific task. For example, a device can be configured for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. Access to services such as the Windows Store can also be restricted. For Windows 10, Start layout options can also be managed, such as:
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)|
+||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps can't be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*|
+||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps can't be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net|
+|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or isn't trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they didn't receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)|
|||HTTP|ctldl.windowsupdate.com|
|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)|
-||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*|
+||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you'll block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*|
|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)|
-||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.|HTTPS|dmd.metaservices.microsoft.com|
-|Diagnostic Data|The following endpoints are used by the Windows Diagnostic Data, Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
+||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata won't be updated for the device.|HTTPS|dmd.metaservices.microsoft.com|
+|Diagnostic Data|The following endpoints are used by the Windows Diagnostic Data, Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft improve our products and services, won't be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
|||TLSv1.2|v10.events.data.microsoft.com|
-||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com|
+||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information won't be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com|
|||TLS v1.2|watson.*.microsoft.com|
|Font Streaming|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)|
-||The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand. |HTTPS|fs.microsoft.com*|
+||The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you won't be able to download fonts on demand. |HTTPS|fs.microsoft.com*|
|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)|
|||HTTPS|*licensing.mp.microsoft.com|
|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)|
-||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2|*maps.windows.com|
+||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps won't be updated.|TLSv1.2|*maps.windows.com|
|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)|
-||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2|*login.live.com|
+||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users can't sign in with Microsoft accounts. |TLSv1.2|*login.live.com|
|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com|
|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
-||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2/HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net|
+||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps can't be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2/HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net|
||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2|*.wns.windows.com|
-||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2|storecatalogrevocation.storequality.microsoft.com|
-||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|HTTPS|*displaycatalog.mp.microsoft.com|
+||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps can't be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2|storecatalogrevocation.storequality.microsoft.com|
+||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps can't be installed or updated from the Microsoft Store.|HTTPS|*displaycatalog.mp.microsoft.com|
|||HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2|manage.devcenter.microsoft.com|
|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)|
@@ -89,25 +89,24 @@ The following methodology was used to derive these network endpoints:
|||HTTPS| logincdn.msauth.net|
|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
|||TLSv1.2|settings-win.data.microsoft.com|
-|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)|
+|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps can't be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)|
|||HTTPS|*.pipe.aria.microsoft.com|
|||HTTPS|config.edge.skype.com|
|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
|||TLSv1.2|config.teams.microsoft.com|
-|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)|
+|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device won't use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)|
|||TLSv1.2|wdcp.microsoft.com|
|||HTTPS|go.microsoft.com|
-||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com|
+||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications won't appear.|HTTPS|*smartscreen-prod.microsoft.com|
|||HTTPS|*smartscreen.microsoft.com |
|||HTTPS|checkappexec.microsoft.com|
-|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)|
+|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips won't be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)|
|||TLSv1.2|arc.msn.com|
-|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
+|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
|||TLSv1.2|*.prod.do.dsp.mp.microsoft.com|
-|||HTTP|emdl.ws.microsoft.com|
-||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com|
+||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device won't be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com|
|||HTTP|*.windowsupdate.com|
-||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com|
+||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device won't be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device won't be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com|
|||TLSv1.2|*.update.microsoft.com|
||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com|
||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|TLSv1.2|tsfe.trafficshaping.dsp.mp.microsoft.com|
diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md
index 3b17ebda7d..24cc4f16d4 100644
--- a/windows/privacy/manage-windows-20H2-endpoints.md
+++ b/windows/privacy/manage-windows-20H2-endpoints.md
@@ -117,7 +117,6 @@ The following methodology was used to derive these network endpoints:
|||HTTPS|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||HTTP|emdl.ws.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device won't be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
|||HTTP|*.windowsupdate.com|
||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device won't be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device won't be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md
index cc6b1a5407..3e0d4e7336 100644
--- a/windows/privacy/manage-windows-21H1-endpoints.md
+++ b/windows/privacy/manage-windows-21H1-endpoints.md
@@ -117,7 +117,6 @@ The following methodology was used to derive these network endpoints:
|||HTTPS|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||HTTP|emdl.ws.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device won't be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
|||HTTP|*.windowsupdate.com|
||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device won't be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device won't be able to acquire and update apps from the Microsoft Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/privacy/manage-windows-21h2-endpoints.md b/windows/privacy/manage-windows-21h2-endpoints.md
index 52a3f761ae..458536998a 100644
--- a/windows/privacy/manage-windows-21h2-endpoints.md
+++ b/windows/privacy/manage-windows-21h2-endpoints.md
@@ -115,7 +115,6 @@ The following methodology was used to derive these network endpoints:
|||HTTPS|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads won't be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network won't use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||HTTP|emdl.ws.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device won't be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
|||HTTP|*.windowsupdate.com|
||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device won't be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device won't be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md
index 386320c5f8..2ced47d282 100644
--- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md
+++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md
@@ -102,7 +102,6 @@ The following methodology was used to derive the network endpoints:
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*ris.api.iris.microsoft.com|
|||HTTPS|mucp.api.account.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -227,7 +226,6 @@ The following methodology was used to derive the network endpoints:
|||TLSv1.2/HTTP|www.msn.com|
|Windows Update||TLSv1.2|definitionupdates.microsoft.com|
||The following endpoints are used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -288,7 +286,6 @@ The following methodology was used to derive the network endpoints:
|||TLSv1.2/HTTP|checkappexec.microsoft.com|
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
index aebe78e618..8c40861d08 100644
--- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
@@ -46,7 +46,6 @@ We used the following methodology to derive these network endpoints:
|\*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting.
|\*cdn.onenote.net* | HTTP | OneNote related traffic
|\*displaycatalog.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store.
-|\*emdl.ws.microsoft.com\* | HTTP | Windows Update related traffic
|\*geo-prod.do.dsp.mp.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update.
|\*hwcdn.net* | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates.
|\*img-prod-cms-rt-microsoft-com.akamaized.net* | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
@@ -136,7 +135,6 @@ We used the following methodology to derive these network endpoints:
| cy2.settings.data.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store. |
| displaycatalog.mp.microsoft.com/* | HTTPS | Used to communicate with Microsoft Store. |
| download.windowsupdate.com/* | HTTPS | Enables connections to Windows Update. |
-| emdl.ws.microsoft.com/* | HTTP | Used to download apps from the Microsoft Store. |
| fe2.update.microsoft.com/* | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
| fe3.delivery.mp.microsoft.com/* | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md
index 3640d0e89a..b0e4bb1468 100644
--- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md
@@ -53,7 +53,6 @@ The following methodology was used to derive the network endpoints:
| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting
| \*cdn.onenote.net\* | HTTP | OneNote
| \*displaycatalog.\*mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store
-| \*emdl.ws.microsoft.com\* | HTTP | Windows Update
| \*geo-prod.do.dsp.mp.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update
| \*hwcdn.net\* | HTTP | Highwinds Content Delivery Network / Windows updates
| \*img-prod-cms-rt-microsoft-com\* | HTTPS | Microsoft Store or Inbox MSN Apps image download
@@ -230,7 +229,6 @@ The following methodology was used to derive the network endpoints:
| displaycatalog.mp.microsoft.com/\* | HTTPS | Microsoft Store
| dmd.metaservices.microsoft.com\* | HTTP | Device Authentication
| download.windowsupdate.com\* | HTTPS | Windows Update
-| emdl.ws.microsoft.com/\* | HTTP | Used to download apps from the Microsoft Store
| evoke-windowsservices-tas.msedge.net | HTTPS | Photo app
| fe2.update.microsoft.com\* | HTTPS | Windows Update, Microsoft Update, Microsoft Store services
| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Windows Update, Microsoft Update, Microsoft Store services
diff --git a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md
index efebab8e60..25290f4d99 100644
--- a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md
@@ -55,7 +55,6 @@ The following methodology was used to derive the network endpoints:
|go.microsoft.com|HTTP|Windows Defender and/or Microsoft forward link redirection service (FWLink)
|g.live.com|HTTP|OneDrive
|checkappexec.microsoft.com|HTTPS|Used for Windows Defender Smartscreen reporting and notifications
-|emdl.ws.microsoft.com|HTTP|Windows Update
|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update
|*.au.download.windowsupdate.com|HTTP|Windows Update
|download.windowsupdate.com|HTTP|Windows Update
@@ -117,7 +116,6 @@ The following methodology was used to derive the network endpoints:
|config.teams.microsoft.com|HTTPS|Used for Microsoft Teams application
|ctldl.windowsupdate.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available
|displaycatalog.mp.microsoft.com*|HTTP/TLS v1.2|Microsoft Store
-|emdl.ws.microsoft.com|HTTP|Windows Update
|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update
|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Windows Update
|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update
@@ -187,7 +185,6 @@ The following methodology was used to derive the network endpoints:
|iecvlist.microsoft.com|HTTP|Microsoft Edge
|download.windowsupdate.com|HTTP|Windows Update
|checkappexec.microsoft.com|HTTPS|Windows Defender
-|emdl.ws.microsoft.com|HTTP|Windows Update
|evoke-windowsservices-tas.msedge.net|HTTPS/TLS v1.2|Photos app
|g.live.com|TLS v1.2|OneDrive
|go.microsoft.com|HTTP|Windows Defender
diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md
index 8836b64032..2f3dc02c9e 100644
--- a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md
@@ -112,7 +112,6 @@ The following methodology was used to derive the network endpoints:
|displaycatalog.mp.microsoft.com|HTTPS|Microsoft Store
|dlassets-ssl.xboxlive.com|HTTPS|Xbox Live
|dmd.metaservices.microsoft.com|HTTP|Device Authentication
-|emdl.ws.microsoft.com|HTTP|Windows Update
|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app
|fp.msedge.net|HTTPS|Cortana and Live Tiles
|fs.microsoft.com|TLSv1.2|Maps application
@@ -169,7 +168,6 @@ The following methodology was used to derive the network endpoints:
|ctldl.windowsupdate.com|HTTP|Certificate Trust List
|da.xboxservices.com|HTTPS|Microsoft Edge
|dmd.metaservices.microsoft.com|HTTP|Device Authentication
-|emdl.ws.microsoft.com|HTTP|Windows Update
|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app
|fp.msedge.net|HTTPS|Cortana and Live Tiles
|fs.microsoft.com|TLSv1.2|Maps application
diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md
index c57c257926..2f2d8eb8f3 100644
--- a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md
@@ -111,7 +111,6 @@ The following methodology was used to derive the network endpoints:
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|||HTTPS|mucp.api.account.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -182,7 +181,6 @@ The following methodology was used to derive the network endpoints:
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*|
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -247,7 +245,6 @@ The following methodology was used to derive the network endpoints:
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*|
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md
index 01a9f50103..d6d6383582 100644
--- a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md
@@ -109,7 +109,6 @@ The following methodology was used to derive the network endpoints:
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|||HTTPS|mucp.api.account.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -178,7 +177,6 @@ The following methodology was used to derive the network endpoints:
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*|
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
@@ -241,7 +239,6 @@ The following methodology was used to derive the network endpoints:
|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*|
|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com|
|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com|
-|||TLSv1.2/HTTP|emdl.ws.microsoft.com|
|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com|
||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com|
|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com|
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md
index 624889e5e4..7c3eabc52d 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/create-code-signing-cert-for-wdac.md
@@ -21,7 +21,6 @@ If you have an internal CA, complete these steps to create a code signing certif
> - All policies, including base and supplemental, must be signed according to the [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652).
> - Use RSA keys with 2K, 3K, or 4K key size only. ECDSA isn't supported.
> - You can use SHA-256, SHA-384, or SHA-512 as the digest algorithm on Windows 11, as well as Windows 10 and Windows Server 2019 and above after applying the November 2022 cumulative security update. All other devices only support SHA256.
-> - Don't use UTF-8 encoding for certificate fields, like 'subject common name' and 'issuer common name'. These strings must be encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING.
1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA.
diff --git a/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering.md b/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering.md
index 72139cebfa..a7f4170ab2 100644
--- a/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering.md
+++ b/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering.md
@@ -21,7 +21,6 @@ If you don't currently have a code signing certificate you can use to sign your
> - All policies, including base and supplemental, must be signed according to the [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652).
> - Use RSA keys with 2K, 3K, or 4K key size only. ECDSA isn't supported.
> - You can use SHA-256, SHA-384, or SHA-512 as the digest algorithm on Windows 11, as well as Windows 10 and Windows Server 2019 and above after applying the November 2022 cumulative security update. All other devices only support SHA-256.
-> - Don't use UTF-8 encoding for certificate fields, like 'subject common name' and 'issuer common name'. These strings must be encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING.
Before you attempt to deploy a signed policy, you should first deploy an unsigned version of the policy to uncover any issues with the policy rules. We also recommend you enable rule options **9 - Enabled:Advanced Boot Options Menu** and **10 - Enabled:Boot Audit on Failure** to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath
|
|
+| Enforceable file types |
|
|
| [Application ID (AppId) Tagging](/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/windows-defender-application-control-appid-tagging-guide) | Available on Windows 10, version 20H1 and later, and Windows 11. | Not available. |
diff --git a/windows/security/book/application-security-application-and-driver-control.md b/windows/security/book/application-security-application-and-driver-control.md
new file mode 100644
index 0000000000..462cf9cf11
--- /dev/null
+++ b/windows/security/book/application-security-application-and-driver-control.md
@@ -0,0 +1,68 @@
+---
+title: Application and driver control
+description: Windows 11 security book - Application and driver control.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Application and driver control
+
+:::image type="content" source="images/application-security.png" alt-text="Diagram of containing a list of application security features." lightbox="images/application-security.png" border="false":::
+
+Windows 11 offers a rich application platform with layers of security like isolation and code integrity that help protect your valuable data. Developers can also take advantage of these
+capabilities to build in security from the ground up to protect against breaches and malware.
+
+## Smart App Control
+
+Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run if they are predicted to be safe based on existing and new intelligence updated daily.
+
+Smart App Control builds on top of the same cloud-based AI used in App Control for Business to predict the safety of an application so that users can be confident that their applications are safe and reliable on their new Windows devices. Additionally, Smart App Control blocks unknown script files and macros from the web are blocked, greatly improving security for everyday users.
+Smart App Control will ship with new devices with Windows 11, version 22H2 installed.
+
+Devices running previous versions of Windows 11 will have to be reset with a clean installation of Windows 11, version 22H2 to take advantage of this feature. Smart App Control will be disabled on devices enrolled in enterprise management. We suggest enterprises running line-of-business applications continue to leverage App Control for Business.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Smart App Control](/windows/apps/develop/smart-app-control/overview)
+
+## App Control for Business
+
+Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means of defending against executable file-based malware.
+
+Windows 10 and above include App Control for Business (previously called Windows Defender Application Control) as well as AppLocker. App Control for Business is the next-generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to App Control for Business for stronger protection.
+
+Customers using Microsoft Intune[\[9\]](conclusion.md#footnote9) to manage their devices are now able to configure App Control for Business in the admin console, including setting up Intune as a managed installer.
+
+Customers can use some built-in options for App Control for Business or upload their own policy as an XML file for Intune to package and deploy.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Application Control for Windows](/windows/security/application-security/application-control/windows-defender-application-control/wdac)
+
+## User Account Control
+
+User Account Control (UAC) helps prevent malware from damaging a PC and enables organizations to deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.
+
+Organizations can use a modern device management (MDM) solution like Microsoft Intune[\[9\]](conclusion.md#footnote9) to remotely configure UAC settings. Organizations without MDM can change settings directly
+on the device.
+
+Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized
+apps and prevent inadvertent changes to system settings.
+
+Users with standard accounts, or those using administrative accounts with UAC enabled, run most programs with limited access rights. This includes the Windows shell and any apps started from the shell, such as Windows Explorer, a web browser, productivity suite, graphics programs, or games.
+
+Some apps require additional permissions and will not work properly (or at all) when running with limited permissions. When an app needs to run with more than standard user rights, UAC allows users to run apps with a "full" administrator token (with administrative groups and privileges) instead of their default user access token. Users continue to operate in the standard user security context while enabling certain executables to run with elevated privileges if needed.
+
+:::image type="content" source="images/uac-settings.png" alt-text="Screenshot of the UAC settings." border="false":::
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How User Account Control works](/windows/security/identity-protection/user-account-control/how-user-account-control-works)
+
+## Microsoft vulnerable driver blocklist
+
+The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to the Windows 11 2022 Update, Windows enforced a block policy when hypervisor-protected code integrity (HVCI) was enabled to prevent vulnerable versions of drivers from running. Beginning with the Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs, and users can opt in to enforce the policy from the Windows Security app.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Microsoft recommended driver block rules](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules)
diff --git a/windows/security/book/application-security-application-isolation.md b/windows/security/book/application-security-application-isolation.md
new file mode 100644
index 0000000000..603d0138a4
--- /dev/null
+++ b/windows/security/book/application-security-application-isolation.md
@@ -0,0 +1,53 @@
+---
+title: Application isolation
+description: Windows 11 security book - Application isolation.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Application isolation
+
+:::image type="content" source="images/application-security.png" alt-text="Diagram of containing a list of application security features." lightbox="images/application-security.png" border="false":::
+
+## Win32 app isolation
+
+Win32 app isolation is a new security feature in public preview designed to be the default isolation standard on Windows clients. It's built on [AppContainer](/windows/win32/secauthz/implementing-an-appcontainer), and offers several added security features to help the Windows platform defend against attacks that leverage vulnerabilities in applications or third-party libraries. To isolate their apps, developers can update their applications using the tools provided by Microsoft.
+
+Win32 app isolation follows a two-step process. In the first step, the Win32 application is launched as a low-integrity process using AppContainer, which is recognized as a security boundary by Microsoft. Consequently, the process is limited to a specific set of Windows APIs by default and is unable to inject code into any process operating at a higher integrity level.
+
+In the second step, least privilege is enforced by granting authorized access to Windows securable objects. This access is determined by capabilities that are added to the application manifest through MSIX packaging. Securable objects in this context refer to Windows resources whose access is safeguarded by capabilities. These capabilities enable the implantation of a [Discretionary Access Control List](/windows/win32/secauthz/access-control-lists) on Windows.
+
+To help ensure that isolated applications run smoothly, developers must define the access requirements for the application via access capability declarations in the application package manifest. The Application Capability Profiler (ACP) simplifies the entire process by allowing the application to run in "learn mode" with low privileges. Instead of denying access if the capability is not present, ACP allows access and logs additional capabilities required for access if the application were to run isolated. For more information on ACP, please refer to the [GitHub documentation page](https://github.com/microsoft/win32-app-isolation/blob/main/docs/profiler/application-capability-profiler.md#stack-tracing---acp-stacktracewpaprofile).
+
+To create a smooth user experience that aligns with nonisolated, native Win32 applications, two key factors should be taken into consideration:
+
+- Approaches for accessing data and privacy information
+- Integrating Win32 apps for compatibility with other Windows interfaces
+
+The first factor relates to implementing methods to manage access to files and privacy information within and outside the isolation boundary ([AppContainer](/windows/win32/secauthz/implementing-an-appcontainer)). The second factor involves integrating Win32 apps with other Windows interfaces in a way that helps enable seamless functionality without causing perplexing user consent prompts.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Win32 app isolation](https://github.com/microsoft/win32-app-isolation)
+
+## Windows Sandbox
+
+Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation using the same hardware-based Hyper-V virtualization technology without fear of lasting impact to the PC. Any untrusted Win32 app installed in Windows Sandbox stays only in the sandbox and can't affect the host.
+
+Once Windows Sandbox is closed, nothing persists on the device. All the software with all its files and state are permanently deleted after the untrusted Win32 application is closed.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Sandbox](/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview)
+- [Windows Sandbox is a new lightweight desktop environment tailored for safely
+running applications in isolation](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/windows-sandbox/ba-p/301849)
+
+## App containers
+
+In addition to Windows Sandbox for Win32 apps, Universal Windows Platform (UWP) applications run in Windows containers known as *app containers*. App containers act as process and resource isolation boundaries, but unlike Docker containers, these are special containers designed to run Windows applications.
+
+Processes that run in app containers operate at a low integrity level, meaning they have limited access to resources they don't own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the file system, registry, and other resources. The app container also enforces restrictions on network connectivity. For example, access to a local host isn't allowed. As a result, malware or infected apps have limited footprint for escape.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows and app container](/windows/apps/windows-app-sdk/migrate-to-windows-app-sdk/feature-mapping-table?source=recommendations)
diff --git a/windows/security/book/application-security.md b/windows/security/book/application-security.md
new file mode 100644
index 0000000000..5b8a5238ab
--- /dev/null
+++ b/windows/security/book/application-security.md
@@ -0,0 +1,16 @@
+---
+title: Application security
+description: Windows 11 security book - Application security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Application security
+
+:::image type="content" source="images/application-security-cover.png" alt-text="Cover of the application security chapter." border="false":::
+
+:::image type="content" source="images/application-security-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/application-security.png" border="false":::
+
+Cybercriminals can take advantage of poorly secured applications to access valuable resources. With Windows 11, IT admins can combat common application attacks from the moment a device is provisioned. For example, IT can remove local admin rights from user accounts so that PCs run with the least amount of privileges to prevent malicious applications from accessing sensitive resources.
+
+In addition, organizations can control which applications run on their devices with App Control for Business (previously called Windows Defender Application Control - WDAC).
diff --git a/windows/security/book/cloud-services-protect-your-personal-information.md b/windows/security/book/cloud-services-protect-your-personal-information.md
new file mode 100644
index 0000000000..39b189a20f
--- /dev/null
+++ b/windows/security/book/cloud-services-protect-your-personal-information.md
@@ -0,0 +1,58 @@
+---
+title: Cloud services - Protect your personal information
+description: Windows 11 security book - Cloud services chapter - Protect your personal information.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Protect your personal information
+
+:::image type="content" source="images/cloud-security.png" alt-text="Diagram of containing a list of security features for cloud security." lightbox="images/cloud-security.png" border="false":::
+
+## Microsoft Account
+
+Your Microsoft Account (MSA) gives you access to Microsoft products and services with just one login, allowing you to manage everything all in one place. Keep tabs on your subscriptions and order history, update your privacy and security settings, track the health and safety of your devices, and get rewards. Everything stays with you in the cloud, across devices, and between OS ecosystems, including iOS and Android.
+
+You can even go passwordless with your Microsoft Account by removing the password from your MSA and using the Microsoft Authenticator app on your mobile Android or iOS phone.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [What is a Microsoft account?](https://support.microsoft.com/windows/what-is-a-microsoft-account-4a7c48e9-ff5a-e9c6-5a5c-1a57d66c3bfa)
+
+## User reauthentication before password disablement
+
+Windows provides greater flexibility for users to balance ease of use with security. Users can choose the interval that the machine remains idle before it automatically signs the user out. To avoid a security breach and prevent users from accidentally making settings changes, Windows reauthenticates the user before they are allowed to change the setting to not sign out the user even after the device remains idle indefinitely.
+
+This setting is available on the Sign-in options page in Settings and is available on Windows 11 and onward for MSA users worldwide.
+
+## Find my device
+
+When location services and Find my device settings are turned on, basic system services like time zone and Find my device will be allowed to use the device's location. When enabled, Find my device can be used by the admin on the device to help recover lost or stolen Windows devices to reduce security threats that rely on physical access.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How to set up, find, and lock a lost Windows device using a Microsoft Account](https://support.microsoft.com/account-billing/find-and-lock-a-lost-windows-device-890bf25e-b8ba-d3fe-8253-e98a12f26316)
+
+## OneDrive for personal
+
+Microsoft OneDrive17 for personal provides additional security, backup, and restore options for important personal files. OneDrive stores and protects files in the cloud, allowing users to access them from laptops, desktops, and mobile devices. Plus, OneDrive provides an excellent solution for backing up folders. If a device is lost or stolen, the user can quickly recover all their important files from the cloud.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [OneDrive](/onedrive/plan-onedrive-enterprise)
+
+In the event of a ransomware attack, OneDrive can enable recovery. And if backups are configured in OneDrive, users have additional options to mitigate and recover from a ransomware attack.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How to recover from a ransomware attack using Microsoft 365](/microsoft-365/security/office-365-security/recover-from-ransomware)
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How to restore from OneDrive](https://support.microsoft.com/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15)
+
+## OneDrive Personal Vault
+
+OneDrive Personal Vault[\[9\]](conclusion.md#footnote9) also provides protection for the most important or sensitive files and photos without sacrificing the convenience of anywhere access. Protect digital copies of important documents in OneDrive Personal Vault. Files will be secured by identity verification yet are still easily accessible across devices.
+
+Learn how to [set up a Personal Vault](https://support.microsoft.com/office/protect-your-onedrive-files-in-personal-vault-6540ef37-e9bf-4121-a773-56f98dce78c4) with a strong authentication method or a second step of identity verification, such as fingerprint, face, PIN, or a code sent via email or SMS.
diff --git a/windows/security/book/cloud-services-protect-your-work-information.md b/windows/security/book/cloud-services-protect-your-work-information.md
new file mode 100644
index 0000000000..789ac396b8
--- /dev/null
+++ b/windows/security/book/cloud-services-protect-your-work-information.md
@@ -0,0 +1,269 @@
+---
+title: Cloud services - Protect your work information
+description: Windows 11 security book - Cloud services chapter - Protect your work information.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Protect your work information
+
+:::image type="content" source="images/cloud-security.png" alt-text="Diagram of containing a list of security features for cloud security." lightbox="images/cloud-security.png" border="false":::
+
+## Microsoft Entra ID
+
+Microsoft Entra ID, formerly Azure Active Directory is a comprehensive cloud-based identity management solution that helps enable secure access to applications, networks, and other resources and guard against threats. Microsoft Entra ID can also be used with Windows Autopilot for zero-touch provisioning of devices preconfigured with corporate security policies.
+
+Organizations can deploy Microsoft Entra ID joined devices to enable access to both cloud and on-premises apps and resources. Access to resources can be controlled based on the Microsoft Entra ID account and Conditional Access policies applied to the device. By registering devices with Microsoft Entra ID - also called Workplace joined - IT admins can support users in bring your own device (BYOD) or mobile device scenarios. Credentials are authenticated and bound to the joined device and cannot be copied to another device without explicit reverification.
+
+To provide more security and control for IT and a seamless experience for end users, Microsoft Entra ID works with apps and services, including on-premises software and thousands of software-as-a-service (SaaS) applications. Microsoft Entra ID protections include single sign-on, multifactor authentication, conditional access policies, identity protection, identity governance, and privileged identity management.
+
+Windows 11 works with Microsoft Entra ID to provide secure access, identity management, and single sign-on to apps and services from anywhere. Windows has built-in settings to add work or school accounts by syncing the device configuration to an Active Directory domain or Microsoft Entra ID tenant.
+
+:::image type="content" source="images/access-work-or-school.png" alt-text="Screenshot of the add work or school account in Settings." border="false":::
+
+When a device is Microsoft Entra ID joined and managed with Microsoft Intune[\[9\]](conclusion.md#footnote9), it receives the following security benefits:
+
+- Default managed user and device settings and policies
+- Single sign-in to all Microsoft Online Services
+- Full suite of authentication management capabilities using Windows Hello for Business
+- Single sign-on (SSO) to enterprise and SaaS applications
+- No use of consumer Microsoft Account identity
+
+Organizations and users can join or register their Windows devices with Microsoft Entra ID to get a seamless experience to both native and web applications. In addition, users can setup Windows Hello for Business or FIDO2 security keys with Microsoft Entra ID and benefit from greater security with passwordless authentication.
+
+In combination with Microsoft Intune, Microsoft Entra ID offers powerful security control through Conditional Access to restrict access to organizational resources to healthy and compliant devices. Note that Microsoft Entra ID is only supported on Windows Pro and Enterprise editions.
+
+Every Windows device has a built-in local administrator account that must be secured and protected to mitigate any Pass-the-Hash (PtH) and lateral traversal attacks. Many customers have been using our standalone, on-premises Windows Local Administrator Password Solution (LAPS) to manage their domain-joined Windows machines. We heard from many customers that LAPS support was needed as they modernized their Windows environment to join directly to Microsoft Entra ID.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Local Administrator Password Solution with Microsoft Entra (Azure AD)](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487)
+- [Microsoft Entra plans and pricing](https://www.microsoft.com/security/business/microsoft-entra-pricing?rtc=1)
+
+## Modern device management through (MDM)
+
+Windows 11 supports modern device management through mobile device management (MDM) protocols so that IT professionals can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions like Microsoft Intune[\[9\]](conclusion.md#footnote9), IT can manage Windows 11 using industry standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client.
+
+Windows 11 built-in management features include:
+
+- The enrollment client, which enrolls and configures the device to securely communicate with the enterprise device management server
+- The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Mobile device management overview](/windows/client-management/mdm-overview)
+
+## Microsoft security baselines
+
+Every organization faces security threats. However, different organizations can be concerned with different types of security threats. For example, an e-commerce company may focus on protecting its internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization.
+
+A security baseline is a group of Microsoft-recommended configuration settings that explains their security implications. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows security baselines you can deploy with Microsoft Intune](/mem/intune/protect/security-baselines)
+
+## MDM security baseline
+
+Windows 11 can be configured with Microsoft's MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices.
+
+The security baseline includes policies for:
+
+- Microsoft inbox security technology such as BitLocker, Microsoft Defender SmartScreen, virtualization-based security, Exploit Guard, Microsoft Defender Antivirus, and Windows Firewall
+- Restricting remote access to devices
+- Setting credential requirements for passwords and PINs
+- Restricting use of legacy technology
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [MDM security baseline](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)
+
+## Microsoft Intune
+
+Microsoft Intune15 is a comprehensive endpoint management solution that helps secure, deploy, and manage users, apps, and devices. Intune brings together technologies like Microsoft Configuration Manager and Windows Autopilot to simplify provisioning, configuration management, and software updates across the organization.
+
+Intune works with Microsoft Entra ID to manage security features and processes, including multifactor authentication.
+
+Organizations can cut costs while securing and managing remote PCs through the cloud in compliance with company policies.16 For example, organizations save time and money by provisioning preconfigured devices to remote employees using Windows Autopilot for zerotouch deployment.
+
+Windows 11 enables IT professionals to move to the cloud while consistently enforcing security policies. Windows 11 provides expanded support for Group Policy administrative templates (ADMX-backed policies) in MDM solutions like Microsoft Intune, enabling IT professionals to easily apply the same security policies to both on-premises and remote devices.
+
+### Endpoint Privilege Management (EPM)
+
+Intune Endpoint Privilege Management supports organizations' Zero Trust journeys by helping them achieve a broad user base running with least privilege, while still permitting users to run tasks allowed by the organization to remain productive.
+
+### Local Administrator Password (LAPs)
+
+Local Administrator Password solution was a key consideration for many customers when deciding to make the transition from on-premises to cloud-managed devices using Intune. With LAPS (available in preview), organizations can automatically manage and back up the password of a local administrator account on Microsoft Entra ID joined or hybrid Microsoft Entra ID joined devices.
+
+### Mobile Application Management (MAM)
+
+With Intune, organizations can also extend MAM App Config, MAM App Protection, and App Protection Conditional Access capabilities to Windows. This enables people to access protected organizational content without having the device managed by IT. The first application to support MAM for Windows is Microsoft Edge.
+
+Customers have asked for App Control for Business (previously called Windows Defender Application Control) to manage Installer support for a long time. Now customers will be able to enable allowlisting of Win32 apps within their enterprise to proactively reduce the number of malware infections.
+
+Finally, Config Refresh helps organizations move to cloud from on-premises by protecting against settings deviating from the admin's intent.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows LAPS overview](/windows-server/identity/laps/laps-overview)
+
+Microsoft Intune also has policies and settings to configure and manage the flow of operating system updates to devices, working with WUfB and WUfB-DS and giving admins great control over their deployments
+
+With Intune, organizations can also extend MAM App Config, MAM App Protection, and App Protection Conditional Access capabilities to Windows. This enables people to access protected organizational content without having the device managed by IT. The first application to support MAM for Windows is Microsoft Edge.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune)
+
+## Remote Wipe
+
+When a device is lost or stolen, IT administrators might want to remotely wipe data stored in memory and hard disks. A helpdesk agent might also want to reset devices to fix issues encountered by remote workers. A remote wipe can also be used to prepare a previously used device for a new user.
+
+Windows 11 supports the Remote Wipe configuration service provider (CSP) so that MDM Solutions[\[9\]](conclusion.md#footnote9) can remotely initiate any of the following operations:
+
+- Reset the device and remove user accounts and data
+- Reset the device and clean the drive
+- Reset the device but persist user accounts and data
+
+Learn More: [Remote Wipe CSP](/windows/client-management/mdm/remotewipe-csp)
+
+## Microsoft Azure Attestation Service
+
+Remote attestation helps ensure that devices are compliant with security policies and are operating in a trusted state before they are allowed to access resources. Microsoft Intune[\[9\]](conclusion.md#footnote9) integrates with [Microsoft Azure Attestation Service](/azure/attestation/overview) to review Windows device health comprehensively and connect this information with Microsoft Entra ID[\[9\]](conclusion.md#footnote9) Conditional Access.
+
+**Attestation policies are configured in the Microsoft Azure Attestation Service which can then:**
+
+- Verify the integrity of evidence provided by the Windows Attestation component by validating the signature and ensuring the Platform Configuration Registers (PCRs) match the values recomputed by replaying the measured boot log
+- Verify that the TPM has a valid Attestation Identity Key issued by the authenticated TPM
+- Verify that security features are in the expected states
+
+Once this verification is complete, the attestation service returns a signed report with the security features state to the relying party - such as Microsoft Intune - to assess the trustworthiness of the platform relative to the admin-configured device compliance specifications. Conditional access is then granted or denied based on the device's compliance.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Azure Attestation overview](/azure/attestation/overview)
+
+## Windows Update for Business deployment service
+
+The Windows Update for Business deployment service, a core component of the Windows Update for Business product family, is a cloud-based solution that transforms the way update management is handled. Complementing existing [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb) policies and [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), the service provides control over the approval, scheduling, and safeguarding of updates - delivered straight from Windows Update to managed devices.
+
+The Windows Update for Business deployment service powers Windows Update management via Microsoft Intune[\[9\]](conclusion.md#footnote9) and Autopatch. The deployment services currently allows the management of [drivers and firmware](/graph/windowsupdates-manage-driver-update), expedited [quality updates](/graph/windowsupdates-deploy-expedited-update) and [feature updates](/graph/windowsupdates-deploy-update).
+
+For an in-depth understanding of this service, including its benefits and prerequisites for use, practical guides on specific capabilities, Microsoft Graph training, and a behind-the-scenes look at how the deployment service functions, read [here](/windows/deployment/update/waas-manage-updates-wufb)[.](/windows/deployment/update/waas-manage-updates-wufb)
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Update for Business - Windows Deployment](/windows/deployment/update/waas-manage-updates-wufb)
+
+## Windows Autopatch
+
+Cybercriminals often target outdated or unpatched software to gain access to networks. Keeping endpoints up to date is critical in closing existing vulnerabilities, but planning, monitoring, and reporting on update compliance can take IT resources away from other important tasks.
+
+Available as part of Windows Enterprise E3 and E5, Windows Autopatch automates update management for Windows, drivers, firmware, Microsoft 365, Edge, and Teams apps. The service can even manage the upgrade to Windows 11. While the service is designed to be simple by default, admins can customize the service to reflect their business organization with Autopatch groups. This allows custom content or deployment schedules to be applied to different populations of devices.
+
+From a technical standpoint, Windows Autopatch configures the policies and deployment service of Windows Update for Business to deliver updates, all within Microsoft Intune.[\[9\]](conclusion.md#footnote9) The results for IT admins: up-to-date endpoints and detailed reports to demonstrate compliance or help identify issues. The goal is to help IT teams be more secure and update more efficiently with less effort.
+
+There's a lot more to learn about Windows Autopatch:
+
+- This [Forrester study](https://aka.ms/AutopatchProductivity) commissioned by Microsoft, analyzes the impact of Windows Autopatch on real customers
+- [IT pro blogs](https://aka.ms/MoreAboutAutopatch) provide updates and background on Autopatch features and the future of the service
+- The [Windows Autopatch community](https://aka.ms/AutopatchCommunity) allows IT professionals to get answers to questions from their peers and the Autopatch team
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Autopatch documentation](https://aka.ms/Autopatchdocs)
+
+## Windows Autopilot and zero-touch deployment
+
+Traditionally, IT professionals spend significant time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach with a collection of technologies used to set up and preconfigure new devices, getting them ready for productive use and ensuring they are delivered locked down and compliant with corporate security policies.
+
+- From a user perspective, it only takes a few simple operations to get their device ready for use
+- From an IT professional perspective, the only interaction required from the end user is to connect to a network and verify their credentials. Setup is automated after that point
+
+Windows Autopilot enables you to:
+
+- Automatically join devices to Microsoft Entra ID[\[9\]](conclusion.md#footnote9) or Active Directory via hybrid Microsoft Entra ID Join. For more information about the differences between these two join options, see [Introduction to device management in Microsoft Entra ID](/azure/active-directory/device-management-introduction).
+- Auto-enroll devices into MDM services such as Microsoft Intune (requires an Microsoft Entra ID Premium subscription for configuration)
+- Automatic upgrade to Enterprise Edition if required
+- Restrict administrator account creation
+- Create and auto-assign devices to configuration groups based on a device's profile
+- Customize Out of Box Experience (OOBE) content specific to the organization
+
+Existing devices can also be quickly prepared for a new user with [Windows Autopilot Reset](/mem/autopilot/windows-autopilot-reset). The reset capability is also useful in break/fix scenarios to quickly bring a device back to a business-ready state.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Autopilot](https://aka.ms/WindowsAutopilot)
+
+## Enterprise State Roaming with Azure
+
+Available to any organization with a Microsoft Entra ID Premium[\[9\]](conclusion.md#footnote9) or Enterprise Mobility + Security (EMS)[\[9\]](conclusion.md#footnote9) license, Enterprise State Roaming provides users with a unified Windows Settings experience across their Windows devices and reduces the time needed for configuring a new device.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Enterprise State Roaming FAQ](/azure/active-directory/devices/enterprise-state-roaming-faqs)
+
+## Universal Print
+
+Universal Print eliminates the need for on-premises print servers. It also eliminates the need for print drivers from the users' Windows devices and makes the devices secure, reducing the malware attacks that typically exploit vulnerabilities in driver model. It enables Universal Print-ready printers (with native support) to connect directly to the Microsoft Cloud. All major printer OEMs have these [models](/universal-print/fundamentals/universal-print-partner-integrations). It also supports existing printers by using the connector software that comes with Universal Print.
+
+Unlike traditional print solutions that rely on Windows print servers, Universal Print is a Microsoft-hosted cloud subscription service that supports a Zero Trust security model when using the Universal Print-ready printers. Customers can enable network isolation of printers, including the Universal Print connector software, from the rest of the organization's resources. Users and their devices do not need to be on the same local network as the printers or the Universal Print connector.
+
+Universal Print supports Zero Trust security by requiring that:
+
+- Each connection and API call to Universal Print cloud service requires authentication validated by Microsoft Entra ID[\[9\]](conclusion.md#footnote9). A hacker would have to have knowledge of the right credentials to successfully connect to the Universal Print service
+- Every connection established by the user's device (client), the printer, or another cloud service to the Universal Print cloud service uses SSL with TLS 1.2 protection. This protects network snooping of traffic to gain access to sensitive data
+- Each printer registered with Universal Print is created as a device object in the customer's Microsoft Entra ID tenant and issued its own device certificate. Every connection from the printer is authenticated using this certificate. The printer can access only its own data and no other device's data
+- Applications can connect to Universal Print using either user, device, or application authentication. To ensure data security, it is highly recommended that only cloud applications use application authentication
+- Each acting application must register with Microsoft Entra ID and specify the set of permission scopes it requires. Microsoft's own acting applications - for example, the Universal Print connector - are registered with the Microsoft Entra ID service. Customer administrators need to provide their consent to the required permission scopes as part of onboarding the application to their tenant
+- Each authentication with Microsoft Entra ID from an acting application cannot extend the permission scope as defined by the acting client app. This prevents the app from requesting additional permissions if the app is breached
+
+Additionally, Windows 11 and Windows 10 include MDM support to simplify printer setup for users. With initial support from Microsoft Intune[\[9\]](conclusion.md#footnote9), admins can now configure policies to provision specific printers onto the user's Windows devices.
+
+Universal Print stores the print data in cloud securely in Office Storage, the same storage used by other Microsoft Office products.
+
+More information about handling of Microsoft 365 data (this includes Universal Print data) can be found [here](/microsoft-365/enterprise/m365-dr-overview).
+
+The Universal Print secure release platform ensures user privacy, secures organizational data, and reduces print wastage. It eliminates the need for people to rush to a shared printer as soon as they send a print job to ensure that no one sees the private or confidential content. Sometimes, printed documents are picked up by another person or not picked up at all and discarded. Detailed support and configuration information can be found [here](/universal-print/fundamentals/universal-print-qrcode).
+
+Universal Print has integrated with Administrative Units in Microsoft Entra ID to enable customers to assign a Printer Administrator role to their local IT team in the same way customers assign User Administrator or Groups Administrator roles. The local IT team can configure only the printers that are part of the same Administrative Unit.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Universal Print](https://www.microsoft.com/microsoft-365/windows/universal-print)
+- [Data storage in Universal Print](/universal-print/fundamentals/universal-print-encryption)
+- [Delegate Printer Administration with Administrative Units](/universal-print/portal/delegated-admin)
+
+For customers who want to stay on Print Servers, we recommend using the Microsoft IPP Print driver. For features beyond what's covered in the standard IPP driver, use Print Support Applications (PSA) for Windows from the respective printer OEM.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Print support app design guide](/windows-hardware/drivers/devapps/print-support-app-design-guide)
+
+## OneDrive for work or school
+
+Data in OneDrive for work or school is protected both in transit and at rest.
+
+When data transits either into the service from clients or between datacenters, it's protected using transport layer security (TLS) encryption. OneDrive only permits secure access.
+
+Authenticated connections are not allowed over HTTP and instead redirect to HTTPS.
+
+There are several ways that OneDrive for work or school is protected at rest:
+
+- Physical protection: Microsoft understands the importance of protecting customer data and is committed to securing the datacenters that contain it. Microsoft datacenters are designed, built, and operated to strictly limit physical access to the areas where customer data is stored. Physical security at datacenters is in alignment with the defense-in-depth principle. Multiple security measures are implemented to reduce the risk of unauthorized users accessing data and other datacenter resources. Learn more [here](/compliance/assurance/assurance-datacenter-physical-access-security)
+- Network protection: The networks and identities are isolated from the corporate network. Firewalls limit traffic into the environment from unauthorized locations
+- Application security: Engineers who build features follow the security development lifecycle. Automated and manual analyses help identify possible vulnerabilities. The [Microsoft Security Response Center](https://technet.microsoft.com/security/dn440717.aspx) helps triage incoming vulnerability reports and evaluate mitigations. Through the [Microsoft Cloud Bug Bounty Terms](https://technet.microsoft.com/dn800983), people across the world can earn money by reporting vulnerabilities
+- Content protection: Each file is encrypted at rest with a unique AES-256 key. These unique keys are encrypted with a set of master keys that are stored in Azure Key Vault
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How OneDrive safeguards data in the cloud](https://support.microsoft.com/office/how-onedrive-safeguards-your-data-in-the-cloud-23c6ea94-3608-48d7-8bf0-80e142edd1e1)
+
+## MDM enrollment certificate attestation
+
+When a device is enrolled into device management, the administrator assumes that the device will enroll and receive appropriate policies to secure and manage the PC as they expect. In some circumstances, enrollment certificates can be removed by malicious actors and then used on unmanaged PCs to appear as though they are enrolled, but without the security and management policies the administrator intended. With MDM enrollment certificate attestation, the certificate and keys are bound to a specific machine through the use of the Trusted Platform Module (TPM) to ensure that they can't be lifted from one device and applied to another. This capability has existed for physical PCs since Windows 11 22H2 and is now being extended to Windows 11-based Cloud PCs and Azure Virtual Desktop VMs.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Configuration Service Provider - Windows Client Management](/windows/client-management/mdm/)
diff --git a/windows/security/book/cloud-services.md b/windows/security/book/cloud-services.md
new file mode 100644
index 0000000000..9c78f4867b
--- /dev/null
+++ b/windows/security/book/cloud-services.md
@@ -0,0 +1,16 @@
+---
+title: Cloud services
+description: Windows 11 security book - Cloud services chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Cloud services
+
+:::image type="content" source="images/cloud-services-cover.png" alt-text="Cover of the cloud services chapter." border="false":::
+
+:::image type="content" source="images/cloud-security-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/cloud-security.png" border="false":::
+
+Today's workforce has more freedom and mobility than ever before, but the risk of data exposure is also at its highest. At Microsoft, we are focused on getting customers to the cloud to benefit from modern hybrid workstyles while improving security management. Built on Zero Trust principles, Windows 11 works with Microsoft cloud services to safeguard sensitive information while controlling access and mitigating threats.
+
+From identity and device management to Office apps and data storage, Windows 11 and integrated cloud services can help improve productivity, security, and resilience anywhere.
diff --git a/windows/security/book/conclusion.md b/windows/security/book/conclusion.md
new file mode 100644
index 0000000000..c8137e0758
--- /dev/null
+++ b/windows/security/book/conclusion.md
@@ -0,0 +1,92 @@
+---
+title: Conclusion
+description: Conclusion
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Conclusion
+
+We will continue to bring you new features to protect against evolving threats, simplify management, and securely enable new workstyles. With Windows 11 devices, organizations of all sizes can benefit from the security and performance to thrive anywhere.
+
+:::image type="content" source="images/chip-to-cloud.png" alt-text="Diagram of chip-to-cloud containing a list of security features." lightbox="images/chip-to-cloud.png" border="false":::
+
+## What's new
+
+New:
+
+- Config Refresh
+- 5G and eSIM
+- Win32 apps in isolation (public preview)
+- Passkey
+- Sign-in Session Token Protection
+- Windows Local Administrator Password Solution (LAPS) (public preview)
+- Microsoft Intune Suite Endpoint Privilège Management (EPM)
+- Microsoft Intune Suite Endpoint Privilege Management (EPM)
+
+Enhanced:
+
+- Hardware security user experience
+- BitLocker to go
+- Device encryption
+- Windows Firewall
+- Server Message Block direct
+- Smart App Control (SAC) going into Enforcement mode
+- Application Control for Business
+- Enhanced Sign-in security (ESS)
+- Windows Hello for Business
+- Presence Detection
+- Wake on approach, lock on leave
+- Universal Print
+- Lockout policies for local admin
+- Enhanced Phishing protection
+
+## Document revision history
+
+| Date | Summary |
+|-|-|
+|November 2021 |Link updates and formatting.|
+|February 2022 |Revisions to Hardware root-of-trust, Virus and threat protection, and Windows Hello for Business content.|
+|April 2022| Added Upcoming features section.|
+| September 2022| Updates with Windows 11 2022 Update features and enhancements.|
+|April 2023| Minor edits and updates to edition availability.|
+|September 2023| Updates with Windows 11 2023 Update features and enhancement.|
+|May 2024| Move form PDF format to web format.|
+
+## Endnotes
+
+1 "2023 Data Breach Investigations Report" - Verizon, 2023.\
+2 "Microsoft Digital Defense Report 2022" - Microsoft, 2022.\
+3 Compared to Windows 10 devices. "Improve your day-to-day experience with Windows 11 Pro laptops" - Principled Technologies, February 2023.\
+4 Based on Monthly Active Device data. "Earnings Release FY23 Q3" - Microsoft, April 2023.\
+5 Windows 11 results are in comparison with Windows 10 devices. "Windows 11 Survey Report," Techaisle, February 2022.\
+6 Requires developer enablement.\
+7 Requires Microsoft Entra ID and Microsoft Intune, or other modern device management solution product required; sold separately.\
+8 Commissioned study delivered by Forrester Consulting. "The Total Economic Impact™ of Windows 11 Pro Devices", December 2022. Note: quantified benefits reflect results over three years combined into a single composite organization that generates $1 billion in annual revenue, has 2,000 employees, refreshes hardware on a four-year cycle, and migrates the entirety of its workforce to Windows 11 devices.\
+9 Sold separately.\
+10 Email encryption is supported on products such as Microsoft Exchange Server and Microsoft Exchange Online.\
+11 Microsoft internal data.\
+12 Microsoft Entra ID Basic is included with Microsoft Azure and Microsoft 365 subscriptions, and other commercial services subscriptions.\
+13 Requires Microsoft Entra ID (formerly AAD) Premium; sold separately.\
+14 Hardware dependent.\
+15 Microsoft 365 E3 or E5 required; sold separately.\
+16 The Total Economic Impact™ of Windows Pro Device, Forrester study commissioned by Microsoft, June 2020.\
+17 All users with a Microsoft Account get 5GB of OneDrive storage free, and all Microsoft 365 subscriptions include 1TB of OneDrive storage. Additional OneDrive storage is sold separately.
+
+---
+
+> The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
+>
+> This paper is for informational purposes only. Microsoft makes no warranties, express or implied, in this document.
+>
+> Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
+>
+> Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
+>
+> © 2024 Microsoft Corporation. All rights reserved.
+>
+> Microsoft, list Microsoft trademarks used in your white paper alphabetically are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
+>
+> The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
+>
+> Part No. May 2024
diff --git a/windows/security/book/hardware-security-hardware-root-of-trust.md b/windows/security/book/hardware-security-hardware-root-of-trust.md
new file mode 100644
index 0000000000..871680e2f4
--- /dev/null
+++ b/windows/security/book/hardware-security-hardware-root-of-trust.md
@@ -0,0 +1,35 @@
+---
+title: Hardware root-of-trust
+description: Windows 11 security book - Hardware root-of-trust.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Hardware root-of-trust
+
+:::image type="content" source="images/hardware.png" alt-text="Diagram of containing a list of security features." lightbox="images/hardware.png" border="false":::
+
+## Trusted Platform Module (TPM)
+
+Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, System Guard (previously called Windows Defender System Guard), and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. These capabilities in turn help organizations strengthen the protection of their identities and data. The 2.0 version of TPM includes support for newer algorithms, which provides improvements like support for stronger cryptography. To upgrade to Windows 11, existing Windows 10 devices much meet minimum system requirements for CPU, RAM, storage, firmware, TPM, and more. All new Windows 11 devices come with TPM 2.0 built in. With Windows 11, both new and upgraded devices must have TPM 2.0. The requirement strengthens the security posture across all Windows 11 devices and helps ensure that these devices can benefit from future security capabilities that depend on a hardware root-of-trust.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows 11 TPM specifications](https://www.microsoft.com/windows/windows-11-specifications)
+- [Enabling TPM 2.0 on your PC](https://support.microsoft.com/windows/enable-tpm-2-0-on-your-pc-1fd5a332-360d-4f46-a1e7-ae6b0c90645c)
+- [Trusted Platform Module Technology Overview](../hardware-security/tpm/trusted-platform-module-overview.md)
+
+## Microsoft Pluton security processor
+
+The Microsoft Pluton security processor is the result of Microsoft's close partnership with silicon partners. Pluton enhances the protection of Windows 11 devices, including Secured-core PCs, with a hardware security processor that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface by integrating the security chip directly into the processor. It can be used as a TPM 2.0 or as a standalone security processor. When a security processor is located on a separate, discrete chip on the motherboard, the communication path between the hardware root-of-trust and the CPU can be vulnerable to physical attack. Embedding Pluton into the CPU makes it harder to exploit the communication path.
+
+Pluton supports the TPM 2.0 industry standard, allowing customers to immediately benefit from enhanced security for Windows features that rely on TPMs, including BitLocker, Windows Hello, and System Guard. Pluton can also support other security functionality beyond what is possible with the TPM 2.0 specification. This extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update.
+
+As with other TPMs, credentials, encryption keys, and other sensitive information cannot be easily extracted from Pluton even if an attacker has installed malware or has complete physical possession of the PC. Storing sensitive data like encryption keys securely within the Pluton processor, which is isolated from the rest of the system, helps ensure that attackers cannot access sensitive data - even if attackers use emerging techniques like speculative execution.
+
+Pluton also solves the major security challenge of keeping its own security processor firmware up to date across the entire PC ecosystem. Today customers receive updates to their security firmware from a variety of different sources, which may make it difficult for customers to get alerts about security updates, keeping systems in a vulnerable state. Pluton provides a flexible, updateable platform for its firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. Pluton is integrated with the Windows Update service, benefiting from over a decade of operational experience in reliably delivering updates across over a billion endpoint systems. Microsoft Pluton is available with select new Windows PCs.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Meet the Microsoft Pluton processor - The security chip designed for the future of Windows PCs](https://www.microsoft.com/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs/)
+- [Microsoft Pluton security processor](../hardware-security/pluton/microsoft-pluton-security-processor.md)
diff --git a/windows/security/book/hardware-security-silicon-assisted-security.md b/windows/security/book/hardware-security-silicon-assisted-security.md
new file mode 100644
index 0000000000..8be924910a
--- /dev/null
+++ b/windows/security/book/hardware-security-silicon-assisted-security.md
@@ -0,0 +1,82 @@
+---
+title: Silicon assisted security
+description: Windows 11 security book - Silicon assisted security.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Silicon assisted security
+
+:::image type="content" source="images/hardware.png" alt-text="Diagram of containing a list of security features." lightbox="images/hardware.png" border="false":::
+
+In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats by protecting the boot process, safeguarding the integrity of memory, isolating security-sensitive compute logic, and more.
+
+## Secured kernel
+
+To secure the kernel we have two key features: virtualization-based security (VBS) and hypervisor-protected code integrity (HVCI). All Windows 11 devices will support HVCI and most new devices will come with VBS and HVCI protection turned on by default.
+
+Virtualization-based security (VBS), also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. The isolated VBS environment protects processes, such as security solutions and credential managers, from other processes running in memory. Even if malware gains access to the main OS kernel, the hypervisor and virtualization hardware help prevent the malware from executing unauthorized code or accessing platform secrets in the VBS environment. VBS
+implements virtual trust level 1 (VTL1), which has higher privilege than the virtual trust level 0 (VTL0) implemented in the main kernel.
+
+Since more privileged VTLs can enforce their own memory protections, higher VTLs can effectively protect areas of memory from lower VTLs. In practice, this allows a lower VTL to protect isolated memory regions by securing them with a higher VTL. For example, VTL0 could store a secret in VTL1, at which point only VTL1 could access it. Even if VTL0 is compromised, the secret would be safe.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)
+
+Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel-mode code for things like drivers. The KMCI checks that all kernel code is properly signed and hasn't been tampered with before it is allowed to run. HVCI ensures that only validated code can be executed in kernel mode. The hypervisor leverages processor virtualization extensions to enforce memory protections that prevent kernel-mode software from executing code that has not been first validated by the code integrity subsystem. HVCI protects against common attacks like WannaCry that rely on the ability to inject malicious code into the kernel. HVCI can prevent injection of malicious kernel-mode code even when drivers and other kernel-mode software have bugs.
+
+With new installs of Windows 11, OS support for VBS and HVCI is turned on by default for all devices that meet prerequisites.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Enable virtualization-based protection of code integrity](../hardware-security/enable-virtualization-based-protection-of-code-integrity.md)
+- [Hypervisor-protected Code Integrity (HVCI)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)
+
+## Hardware-enforced stack protection
+
+Hardware-enforced stack protection integrates software and hardware for a modern defense against cyberthreats like memory corruption and zero-day exploits. Based on Control- flow Enforcement Technology (CET) from Intel and AMD Shadow Stacks, hardware-enforced stack protection is designed to protect against exploit techniques that try to hijack return addresses on the stack.
+
+Application code includes a program processing stack that hackers seek to corrupt or disrupt in a type of attack called stack smashing. When defenses like executable space protection began thwarting such attacks, hackers turned to new methods like return-oriented programming. Return-oriented programming, a form of advanced stack smashing, can bypass defenses, hijack the data stack, and ultimately force a device to perform harmful operations. To guard against these control-flow hijacking attacks, the Windows kernel creates a separate "shadow stack" for return addresses. Windows 11 extends stack protection capabilities to provide both user mode and kernel mode support.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Understanding Hardware-enforced Stack Protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)
+- [Developer Guidance for Hardware-enforced Stack Protection](https://techcommunity.microsoft.com/t5/windows-kernel-internals/developer-guidance-for-hardware-enforced-stack-protection/ba-p/2163340)
+
+## Kernel Direct Memory Access (DMA) protection
+
+Windows 11 protects against physical threats such as drive-by Direct Memory Access (DMA) attacks. Peripheral Component Interconnect Express (PCIe) hot-pluggable devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot-plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. Memory access protection (also known as Kernel DMA Protection) protects against these attacks by preventing external peripherals from gaining unauthorized access to memory. Drive-by DMA attacks typically happen quickly while the system owner isn't present. The attacks are performed using simple to moderate attacking tools created with affordable, off-the-shelf hardware and software that do not require the disassembly of the PC. For example, a PC owner might leave a device for a quick coffee break. Meanwhile, an attacker plugs an external tool into a port to steal information or inject code that gives the attacker remote control over the PCs, including the ability to bypass the lock screen. With memory access protection built in and enabled, Windows 11 is protected against physical attack wherever people work.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Kernel Direct Memory Access (DMA) protection](/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt)
+
+## Secured-core PC
+
+The March 2021 Security Signals report found that more than 80% of enterprises have experienced at least one firmware attack in the past two years. For customers in data-sensitive industries like financial services, government, and healthcare, Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs (SCPCs). The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows.
+
+Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root-of-trust. Virtualization-based security comes enabled by default. With built-in hypervisor-protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all kernel executable code is signed only by known and approved authorities. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks with kernel DMA protection.
+
+Secured-core PCs provide multiple layers of robust protection against hardware and firmware attacks. Sophisticated malware attacks may commonly attempt to install "bootkits" or "rootkits" on the system to evade detection and achieve persistence. This malicious software may run at the firmware level prior to Windows being loaded or during the Windows boot process itself, enabling the system to start with the highest level of privilege. Because critical subsystems in Windows leverage virtualization-based security, protecting the hypervisor becomes increasingly important. To ensure that no unauthorized firmware or software can start before the Windows bootloader, Windows PCs rely on the Unified Extensible Firmware Interface (UEFI) Secure Boot standard, a baseline security feature of all Windows 11 PCs. Secure Boot helps ensure that only authorized firmware and software with trusted digital signatures can execute. In addition, measurements of all boot components are securely stored in the TPM to help establish a non-repudiable audit log of the boot called the Static Root of Trust for Measurement (SRTM).
+
+Thousands of PC vendors produce numerous device models with diverse UEFI firmware components, which in turn creates an incredibly large number of SRTM signatures and measurements at bootup. Because these signatures and measurements are inherently trusted by Secure Boot, it can be challenging to constrain trust to only what is needed to boot on any specific device. Traditionally, blocklists and allowlists were the two main techniques used to constrain trust, and they continue to expand if devices rely only on SRTM measurements.
+
+In Secured-core PCs, [System Guard Secure Launch](/windows/security/hardware-security/system-guard-secure-launch-and-smm-protection) protects bootup with a technology known as the Dynamic Root of Trust for Measurement (DRTM). With DRTM, the system initially follows the normal UEFI Secure Boot process. However, before launching, the system enters a hardware-controlled trusted state that forces the CPU(s) down a hardware-secured code path. If a malware rootkit or bootkit has bypassed UEFI Secure Boot and resides in memory, DRTM will prevent it from accessing secrets and critical code protected by the virtualization-based security environment. [Firmware Attack Surface Reduction (FASR) technology](/windows-hardware/drivers/bringup/firmware-attack-surface-reduction) can be used instead of DRTM on supported devices, such as Microsoft Surface.
+
+System Management Mode (SMM) isolation is an execution mode in x86-based processors that runs at a higher effective privilege than the hypervisor. SMM complements the protections provided by DRTM by helping to reduce the attack surface. Relying on capabilities provided by silicon providers like Intel and AMD, SMM isolation enforces policies that implement restrictions such as preventing SMM code from accessing OS memory. The SMM isolation policy is included as part of the DRTM measurements that can be sent to a verifier like Microsoft Azure Remote Attestation.
+
+:::image type="content" source="images/secure-launch.png" alt-text="Diagram of secure launch components." lightbox="images/secure-launch.png" border="false":::
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Dynamic Root of Trust measure and SMM isolation](https://www.microsoft.com/security/blog/2020/09/01/force-firmware-code-to-be-measured-and-attested-by-secure-launch-on-windows-10/)
+- [Secured-core PC firmware protection](/windows-hardware/design/device-experiences/oem-highly-secure-11)
+
+## Secured-core configuration lock
+
+In many organizations, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync, when configuration is reset with the mobile device management (MDM) solution. Secured-core configuration lock (config lock) is a Secured-core PC (SCPC) feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that are supported and reverts to the IT-desired SCPC state in seconds after detecting a drift.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows 11 with config lock](/windows/client-management/mdm/config-lock)
diff --git a/windows/security/book/hardware-security.md b/windows/security/book/hardware-security.md
new file mode 100644
index 0000000000..f6a8137aac
--- /dev/null
+++ b/windows/security/book/hardware-security.md
@@ -0,0 +1,16 @@
+---
+title: Hardware security
+description: Windows 11 security book - Hardware security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Hardware security
+
+:::image type="content" source="images/hardware-security-cover.png" alt-text="Cover of the hardware security chapter." border="false":::
+
+:::image type="content" source="images/hardware-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/hardware.png" border="false":::
+
+Today's ever-evolving threats require strong alignment between hardware and software technologies to keep users, data, and devices protected. The operating system alone cannot defend against the wide range of tools and techniques cybercriminals use to compromise a computer. Once they gain a foothold, intruders can be difficult to detect as they engage in multiple nefarious activities ranging from stealing important data and credentials to implanting malware into low-level device firmware. Once malware is installed in firmware, it becomes difficult to identify and remove. These new threats call for computing hardware that is secure down to the very core, including the hardware chips and processors that store sensitive business information. With hardware-based protection, we can enable strong mitigation against entire classes of vulnerabilities that are difficult to thwart with software alone. Hardware-based protection can also improve the system's overall security without measurably slowing performance, compared to implementing the same capability in software.
+
+With Windows 11, Microsoft has raised the hardware security bar to design the most secure version of Windows ever from chip to cloud. We have carefully chosen the hardware requirements and default security features based on threat intelligence, global regulatory requirements, and our own Microsoft Security team's expertise. We have worked with our chip and device manufacturing partners to integrate advanced security capabilities across software, firmware, and hardware. Through a powerful combination of hardware root-of-trust and silicon-assisted security, Windows 11 delivers built-in hardware protection out of the box.
diff --git a/windows/security/book/identity-protection-advanced-credential-protection.md b/windows/security/book/identity-protection-advanced-credential-protection.md
new file mode 100644
index 0000000000..f5b1e3d1a4
--- /dev/null
+++ b/windows/security/book/identity-protection-advanced-credential-protection.md
@@ -0,0 +1,96 @@
+---
+title: Identity protection - Advanced credential protection
+description: Windows 11 security book -Identity protection chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Advanced credential protection
+
+:::image type="content" source="images/identity-protection.png" alt-text="Diagram of containing a list of security features." lightbox="images/identity-protection.png" border="false":::
+
+In addition to adopting passwordless sign-in, organizations can strengthen security for user and domain credentials in Windows 11 with Credential Guard and Remote Credential Guard.
+
+## Enhanced phishing protection with Microsoft Defender SmartScreen
+
+As malware protection and other safeguards evolve, cybercriminals look for new ways to circumvent security measures. Phishing has emerged as a leading threat, with apps and websites designed to steal credentials by tricking people into voluntarily entering passwords. As a result, many organizations are transitioning to the ease and security of passwordless sign-in with Windows Hello or Windows Hello for Business.
+
+However, people who are still using passwords can also benefit from powerful credential protection in Windows 11. Microsoft Defender SmartScreen now includes enhanced phishing protection to automatically detect when a user's Microsoft password is entered into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Because the user is alerted at the moment of potential credential theft, they can take preemptive action before the password is used against them or their organization.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Enhanced phishing protection in Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection)
+
+## Local Security Authority (LSA) protection
+
+Windows has several critical processes to verify a user's identity. Verification processes include Local Security Authority (LSA), which is responsible for authenticating users and verifying Windows sign-ins. LSA handles tokens and credentials that are used for single sign-on to a Microsoft account and Azure services.
+
+To help keep these credentials safe, additional LSA protection will be enabled by default on new, enterprise-joined Windows 11 devices. By loading only trusted, signed code, LSA provides significant protection against credential theft. LSA protection also now supports configuration using Group Policy and modern device management.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Configuring additional LSA protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)
+
+## Credential Guard
+
+Enabled by default in Windows 11 Enterprise, Credential Guard uses hardware-backed, virtualization-based security (VBS) to protect against credential theft. With Credential Guard, the Local Security Authority (LSA) stores and protects Active Directory (AD) secrets in an isolated environment that isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.
+
+By protecting the LSA process with virtualization-based security, Credential Guard shields systems from credential theft attack techniques like Pass-the-Hash or Pass-the-Ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)
+
+## Remote Credential Guard
+
+Remote Credential Guard helps organizations protect credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.
+
+Administrator credentials are highly privileged and must be protected. When Remote Credential Guard is configured and enabled to connect during Remote Desktop sessions, the credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, the credentials aren't exposed.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Remote Credential Guard - Windows Security | Microsoft Learn](/windows/security/identity-protection/remote-credential-guard?tabs=intune)
+
+## Token protection
+
+Token protection attempts to reduce attacks using Microsoft Entra ID token theft. Token protection makes tokens usable only from their intended device by cryptographically binding a token with a device secret. When using the token, both the token and proof of the device secret must be provided. Conditional Access policies[\[9\]](conclusion.md#footnote9) can be configured to require token protection when using sign-in tokens for specific services.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Token protection in Entra ID Conditional Access](/azure/active-directory/conditional-access/concept-token-protection)
+
+## Sign-in session token protection policy
+
+At the inaugural Microsoft Secure event in March 2023, we announced the public preview of token protection for sign-ins. This feature allows applications and services to cryptographically bind security tokens to the device, restricting attackers' ability to impersonate users on a different device if tokens are stolen.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Conditional Access: Token protection (preview)](/azure/active-directory/conditional-access/concept-token-protection)
+
+## Account lockout policies
+
+New devices with Windows 11 installed will have account lockout policies that are secure by default. These policies will mitigate brute-force attacks such as hackers attempting to access Windows devices via the Remote Desktop Protocol (RDP).
+
+The account lockout threshold policy is now set to 10 failed sign-in attempts by default, with the account lockout duration set to 10 minutes. The Allow Administrator account lockout is now enabled by default. The Reset account lockout counter after is now set to 10 minutes by default as well.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Account lockout policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)
+
+## Access management and control
+
+Access control in Windows ensures that shared resources are available to users and groups other than the resource's owner and are protected from unauthorized use. IT administrators can manage users', groups', and computers' access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.
+
+Access Control Lists (ACLs) describe the permissions for a specific object and can also contain System Access Control Lists (SACLs). SACLs provide a way to audit specific system level events, such as when a user attempts to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack.
+
+IT administrators can refine the application and management of access to:
+
+- Protect a greater number and variety of network resources from misuse
+- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. Organizations can implement the principle of least-privilege access, which asserts that users should be granted access only to the data and operations they require to perform their jobs
+- Update users' ability to access resources on a regular basis as an organization's policies change or as users' jobs change
+- Support evolving workplace needs, including access from hybrid or remote locations, or from a rapidly expanding array of devices, including tablets and mobile phones
+- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Access control](/windows/security/identity-protection/access-control/access-control)
diff --git a/windows/security/book/identity-protection-passwordless-sign-in.md b/windows/security/book/identity-protection-passwordless-sign-in.md
new file mode 100644
index 0000000000..00ee61f822
--- /dev/null
+++ b/windows/security/book/identity-protection-passwordless-sign-in.md
@@ -0,0 +1,172 @@
+---
+title: Identity protection - Passwordless sign-in
+description: Windows 11 security book -Identity protection chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Passwordless sign-in
+
+:::image type="content" source="images/identity-protection.png" alt-text="Diagram of containing a list of security features." lightbox="images/identity-protection.png" border="false":::
+
+Passwords are inconvenient to use and prime targets for cybercriminals - and they've been an important part of digital security for years. That changes with the passwordless protection available with Windows 11. After a secure authorization process, credentials are protected behind layers of hardware and software security, giving users secure, passwordless access to their apps and cloud services.
+
+## Windows Hello
+
+Too often, passwords are weak, stolen, or forgotten. Organizations are moving toward passwordless sign-in to reduce the risk of breaches, lower the cost of managing passwords, and improve productivity and satisfaction for their employees and customers. Microsoft is committed to helping customers move toward a secure, passwordless future with Windows Hello, a cornerstone of Windows security and identity protection.
+
+[Windows Hello](/windows/security/identity-protection/hello-for-business/passwordless-strategy) can enable passwordless sign-in using biometric or PIN verification and provides built-in support for the FIDO2 passwordless industry standard. As a result, people no longer need to carry external hardware like a security key for authentication.
+
+The secure, convenient sign-in experience can augment or replace passwords with a stronger authentication model based on a PIN or biometric data such as facial or fingerprint recognition secured by the Trusted Platform Module (TPM). Step-by-step guidance makes setup easy.
+
+Using asymmetric keys provisioned in the TPM, Windows Hello protects authentication by binding a user's credentials to their device. Windows Hello validates the user based on either a PIN or biometrics match and only then allows the use of cryptographic keys bound to that user in the TPM.
+
+PIN and biometric data stay on the device and cannot be stored or accessed externally. Since the data cannot be accessed by anyone without physical access to the device, credentials are protected against replay attacks, phishing, and spoofing as well as password reuse and leaks.
+
+Windows Hello can authenticate users to a Microsoft account (MSA), identity provider services, or the relying parties that also implement the FIDO2 or WebAuthn standards.
+
+## Windows Hello for Business
+
+Windows Hello for Business extends Windows Hello to work with an organization's Active Directory and Microsoft Entra ID accounts. It provides single sign-on access to work or school resources such as OneDrive for Business, work email, and other business apps. Windows Hello for Business also give IT admins the ability to manage PIN and other sign-in requirements for devices connecting to work or school resources.
+
+## Windows Hello for Business Passwordless
+
+Windows 11 devices with Windows Hello for Business can protect user identities by removing the need to use passwords from day one.
+
+IT can now set a policy for Microsoft Entra ID joined machines so users no longer see the option to enter a password when accessing company resources.12 Once the policy is set, passwords are removed from the Windows user experience, both for device unlock as well as in-session authentication scenarios via CredUI. However, passwords are not eliminated from the identity directory yet. Users are expected to navigate through their core authentication scenarios using strong, phish-resistant, possession-based credentials like Windows Hello for Business and FIDO2 security keys. If necessary, users can leverage passwordless recovery mechanisms such as Windows Hello for Business PIN reset or Web Sign-in.
+
+During a device's lifecycle, a password may only need to be used once during the provisioning process. After that, people can use a PIN, face, or fingerprint to unlock credentials and sign into the device.
+
+Provisioning methods include:
+
+- Temporary Access Pass (TAP), a time-limited passcode with strong authentication requirements issued through Microsoft Entra ID
+- Existing multifactor authentication with Microsoft Entra ID, including authentication methods like the Microsoft Authenticator app
+
+Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometric data and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business depending on an organization's needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers.
+
+Organizations with hybrid scenarios can eliminate the need for on-premises domain controllers and simplify passwordless adoption by using Windows Hello for Business cloud Kerberos trust.13 This solution uses security keys and replaces on-premises domain controllers with a cloud-based root-of-trust. As a result, organizations can take advantage of Windows Hello for Business and deploy passwordless security keys with minimal additional setup or infrastructure.
+
+Users will authenticate directly with Microsoft Entra ID, helping speed access to on- premises applications and other resources.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Hello for Business overview](/windows/security/identity-protection/hello-for-business/)
+
+## Windows Hello PIN
+
+The Windows Hello PIN, which can only be entered by someone with physical access to the device, can be used for strong multifactor authentication. The PIN is protected by the TPM and, like biometric data, never leaves the device. When a user enters their PIN, an authentication key is unlocked and used to sign a request sent to the authenticating server.
+
+The TPM protects against threats including PIN brute-force attacks on lost or stolen devices. After too many incorrect guesses, the device locks. IT admins can set security policies for PINs, such as complexity, length, and expiration requirements.
+
+## Windows Hello biometric sign-in
+
+Windows Hello biometric sign-in enhances both security and productivity with a quick, convenient sign-in experience. There's no need to enter a password every time when a face or fingerprint is the credential.
+
+Windows devices that support biometric hardware such as fingerprint or facial recognition cameras integrate directly with Windows Hello, enabling access to Windows client resources and services. Biometric readers for both face and fingerprint must comply with [Microsoft](/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) [Windows Hello biometric requirements](/windows-hardware/design/device-experiences/windows-hello-biometric-requirements). Windows Hello facial recognition is designed to only authenticate from trusted cameras used at the time of enrollment.
+
+If a peripheral camera is attached to the device after enrollment, that camera will only be allowed for facial authentication after it has been validated by signing in with the internal camera. For additional security, external cameras can be disabled for use with Windows Hello facial recognition.
+
+## Windows Hello Enhanced Sign-in Security
+
+Windows Hello biometrics also supports Enhanced Sign-in Security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign-in.
+
+Enhanced Sign-in Security biometrics uses virtualization-based security (VBS) and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated.
+
+These specialized components protect against a class of attacks that includes biometric sample injection, replay, and tampering. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft-issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional attack classes.
+
+Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process and is most typically supported in Secured-core PCs. For facial recognition, Enhanced Sign-in Security is supported by specific silicon and camera combinations - please check with the specific device manufacturer. Fingerprint authentication is available across all processor types. Please reach out to specific OEMs for support details.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)
+
+## Windows Hello for Business multi-factor unlock
+
+For organizations that need an extra layer of sign-in security, multi-factor unlock enables IT admins to configure Windows by requiring a combination of two unique trusted signals to sign in. Trusted signal examples include a PIN or biometric data (face or fingerprint) combined with either a PIN, Bluetooth, IP configuration, or Wi-Fi.
+
+Multi-factor unlock is useful for organizations who need to prevent information workers from sharing credentials or need to comply with regulatory requirements for a two-factor authentication policy.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Multi-factor unlock](/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock)
+
+## Windows presence sensing
+
+Windows presence sensing14 provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to a user's presence to help them stay secure and productive, whether they're working at home, the office, or a public environment.
+
+Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to sign the user in hands-free and automatically locks the device when the user leaves. With adaptive dimming, the PC dims the screen when the user looks away on compatible devices with presence sensors. It's also easier than ever to configure presence sensors on devices, with easy enablement in the out-of-the-box experience and new links in Settings to help find presence sensing features. Device manufacturers will be able to customize and build extensions for the presence sensor.
+
+## Developer APIs and app privacy support for presence sensing
+
+Privacy is top of mind and more important than ever. Customers want to have greater transparency and control over the use of their information. We are pleased to announce new app privacy settings that enable users to allow or block access to their presence sensor information. Users can decide on these settings during the initial Windows 11 setup.
+
+Users can also take advantage of more granular settings to easily enable and disable differentiated presence sensing features like wake on approach, lock on leave, and adaptive dimming. We are also supporting developers with new APIs for presence sensing for thirdparty applications. Third-party applications can now access user presence information on devices with modern presence sensors.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Presence sensing](/windows-hardware/design/device-experiences/sensors-presence-sensing)
+- [Manage presence sensing settings in Windows 11](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)
+
+## FIDO support
+
+The FIDO Alliance, the Fast Identity Online industry standards body, was established to promote authentication technologies and standards that reduce reliance on passwords. FIDO Alliance and World Wide Web Consortium (W3C) have worked together to define the Client to Authenticator Protocol (CTAP2) and Web Authentication (WebAuthn) specifications, which are the industry standard for providing strong, phishing-resistant, user friendly, and privacy preserving authentication across the web and apps. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets.
+
+Windows 11 can also use passkeys from external FIDO2 security keys for authentication alongside or in addition to Windows Hello and Windows Hello for Business, which is also a FIDO2-certified passwordless solution. As a result, Windows 11 can be used as a FIDO authenticator for many popular identity management services.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Passwordless security key sign-in](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)
+
+## Passkeys
+
+Windows 11 makes it much harder for hackers who exploit stolen passwords via phishing attacks by empowering users to replace passwords with passkeys. Passkeys are the crossplatform future of secure sign-in. Microsoft and other technology leaders are supporting passkeys across their platforms and services.
+
+A passkey is a unique, unguessable cryptographic secret that is securely stored on the device. Instead of using a username and password to sign in to a website or application, Windows 11 users can create and use a passkey from Windows Hello, an external security provider, or their mobile device.
+
+Passkeys on Windows 11 are protected by Windows Hello or Windows Hello for Business. This enables users to sign in to the site or app using their face, fingerprint, or device PIN. Passkeys on Windows work in any browser or app that supports them for sign in. Users can manage passkeys on their device on Windows 11 account settings.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Passkeys (passkey authentication)](https://fidoalliance.org/passkeys/)
+
+## Microsoft Authenticator
+
+The Microsoft Authenticator app, which runs on iOS and Android devices, helps keep
+
+Windows 11 users secure and productive. Microsoft Authenticator can be used to bootstrap Windows Hello for Business, which removes the need for a password to get started on Windows 11.
+
+Microsoft Authenticator also enables easy, secure sign-in for all online accounts using multifactor authentication, passwordless phone sign-in, or password autofill. The accounts in the Authenticator app are secured with a public/private key pair in hardware-backed storage such as the Keychain in iOS and Keystore on Android. IT admins can leverage different tools to nudge their users to set up the Authenticator app, provide them with extra context about where the authentication is coming from, and ensure that they are actively using it.
+
+Individual users can back up their credentials to the cloud by enabling the encrypted backup option in settings. They can also see their sign-in history and security settings for Microsoft personal, work, or school accounts.
+
+Using this secure app for authentication and authorization enables people to be in control of how, where, and when their credentials are used. To keep up with an ever-changing security landscape, the app is constantly updated, and new capabilities are added to stay ahead of emerging threat vectors.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Microsoft Authenticator](/azure/active-directory/authentication/concept-authentication-authenticator-app)
+
+## Smart cards for Windows service
+
+Organizations also have the option of using smart cards, an authentication method that predates biometric authentication. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating users, signing code, securing e-mail, and signing in with Windows domain accounts.
+
+**Smart cards provide:**
+
+- Ease of use in scenarios such as healthcare where employees need to sign in and out quickly without using their hands or when sharing a workstation
+- Isolation of security-critical computations that involve authentication, digital signatures, and key exchange from other parts of the computer. These computations are performed on the smart card
+- Portability of credentials and other private information between computers at work, home, or on the road
+
+Smart cards can only be used to sign in to domain accounts or Microsoft Entra ID accounts.
+
+When a password is used to sign in to a domain account, Windows uses the Kerberos Version 5 (V5) protocol for authentication. If you use a smart card, the operating system uses Kerberos V5 authentication with X.509 V3 certificates. On Microsoft Entra ID joined devices, a smart card can be used with Entra ID certificate-based authentication. Smart cards cannot be used with local accounts.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Smart Card technical reference](/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference)
+
+## Federated sign-in
+
+Windows 11 supports federated sign-in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign-in through methods like QR codes or pictures. Additionally, we have added shared device support. It allows multiple students (one at a time) to use the device throughout the school day.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in)
diff --git a/windows/security/book/identity-protection.md b/windows/security/book/identity-protection.md
new file mode 100644
index 0000000000..d614925654
--- /dev/null
+++ b/windows/security/book/identity-protection.md
@@ -0,0 +1,16 @@
+---
+title: Identity protection
+description: Windows 11 security book -Identity protection chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Identity protection
+
+:::image type="content" source="images/identity-protection-cover.png" alt-text="Cover of the identity protection chapter." border="false":::
+
+:::image type="content" source="images/identity-protection-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/identity-protection.png" border="false":::
+
+Today's flexible workstyles and the security of your organization depend on secure access to corporate resources, including strong identity protection. Weak or reused passwords, password spraying, social engineering, and phishing are some of the top attack vectors. In the last 12 months, we saw an average of more than 4,000 password attacks per second.11 And phishing threats have increased, making identity a continuous battleground. As Bret Arsenault, Chief Information Security Officer at Microsoft says, *Hackers don't break in, they log in.*
+
+Because threats are constantly evolving and often difficult for employees to detect, organizations need proactive protection, including effortlessly secure authentication and features that defend users in real time while they work. Windows 11 is designed with powerful identity protection from chip to cloud, keeping identities and personal and business data safe anywhere people work.
diff --git a/windows/security/book/images/access-work-or-school.png b/windows/security/book/images/access-work-or-school.png
new file mode 100644
index 0000000000..4c256ca182
Binary files /dev/null and b/windows/security/book/images/access-work-or-school.png differ
diff --git a/windows/security/book/images/application-security-cover.png b/windows/security/book/images/application-security-cover.png
new file mode 100644
index 0000000000..3d8d9aa3d9
Binary files /dev/null and b/windows/security/book/images/application-security-cover.png differ
diff --git a/windows/security/book/images/application-security-on.png b/windows/security/book/images/application-security-on.png
new file mode 100644
index 0000000000..d15844943d
Binary files /dev/null and b/windows/security/book/images/application-security-on.png differ
diff --git a/windows/security/book/images/application-security.png b/windows/security/book/images/application-security.png
new file mode 100644
index 0000000000..bebbcf3891
Binary files /dev/null and b/windows/security/book/images/application-security.png differ
diff --git a/windows/security/book/images/chip-to-cloud.png b/windows/security/book/images/chip-to-cloud.png
new file mode 100644
index 0000000000..08f370e1f9
Binary files /dev/null and b/windows/security/book/images/chip-to-cloud.png differ
diff --git a/windows/security/book/images/cloud-security-on.png b/windows/security/book/images/cloud-security-on.png
new file mode 100644
index 0000000000..eb2666b9fa
Binary files /dev/null and b/windows/security/book/images/cloud-security-on.png differ
diff --git a/windows/security/book/images/cloud-security.png b/windows/security/book/images/cloud-security.png
new file mode 100644
index 0000000000..2d1b118594
Binary files /dev/null and b/windows/security/book/images/cloud-security.png differ
diff --git a/windows/security/book/images/cloud-services-cover.png b/windows/security/book/images/cloud-services-cover.png
new file mode 100644
index 0000000000..d5961c347e
Binary files /dev/null and b/windows/security/book/images/cloud-services-cover.png differ
diff --git a/windows/security/book/images/cover.png b/windows/security/book/images/cover.png
new file mode 100644
index 0000000000..4d5b549c44
Binary files /dev/null and b/windows/security/book/images/cover.png differ
diff --git a/windows/security/book/images/defender-antivirus.png b/windows/security/book/images/defender-antivirus.png
new file mode 100644
index 0000000000..e5b202db18
Binary files /dev/null and b/windows/security/book/images/defender-antivirus.png differ
diff --git a/windows/security/book/images/hardware-on.png b/windows/security/book/images/hardware-on.png
new file mode 100644
index 0000000000..89bc3c7a69
Binary files /dev/null and b/windows/security/book/images/hardware-on.png differ
diff --git a/windows/security/book/images/hardware-security-cover.png b/windows/security/book/images/hardware-security-cover.png
new file mode 100644
index 0000000000..5328456231
Binary files /dev/null and b/windows/security/book/images/hardware-security-cover.png differ
diff --git a/windows/security/book/images/hardware.png b/windows/security/book/images/hardware.png
new file mode 100644
index 0000000000..9f526775df
Binary files /dev/null and b/windows/security/book/images/hardware.png differ
diff --git a/windows/security/book/images/identity-protection-cover.png b/windows/security/book/images/identity-protection-cover.png
new file mode 100644
index 0000000000..6fe6084305
Binary files /dev/null and b/windows/security/book/images/identity-protection-cover.png differ
diff --git a/windows/security/book/images/identity-protection-on.png b/windows/security/book/images/identity-protection-on.png
new file mode 100644
index 0000000000..c099ebb82f
Binary files /dev/null and b/windows/security/book/images/identity-protection-on.png differ
diff --git a/windows/security/book/images/identity-protection.png b/windows/security/book/images/identity-protection.png
new file mode 100644
index 0000000000..300e3d89ef
Binary files /dev/null and b/windows/security/book/images/identity-protection.png differ
diff --git a/windows/security/book/images/learn-more.svg b/windows/security/book/images/learn-more.svg
new file mode 100644
index 0000000000..947593db41
--- /dev/null
+++ b/windows/security/book/images/learn-more.svg
@@ -0,0 +1,3 @@
+
diff --git a/windows/security/book/images/operating-system-on.png b/windows/security/book/images/operating-system-on.png
new file mode 100644
index 0000000000..d97bd2a9ba
Binary files /dev/null and b/windows/security/book/images/operating-system-on.png differ
diff --git a/windows/security/book/images/operating-system-security-cover.png b/windows/security/book/images/operating-system-security-cover.png
new file mode 100644
index 0000000000..955891f34d
Binary files /dev/null and b/windows/security/book/images/operating-system-security-cover.png differ
diff --git a/windows/security/book/images/operating-system.png b/windows/security/book/images/operating-system.png
new file mode 100644
index 0000000000..288e01fc73
Binary files /dev/null and b/windows/security/book/images/operating-system.png differ
diff --git a/windows/security/book/images/privacy-cover.png b/windows/security/book/images/privacy-cover.png
new file mode 100644
index 0000000000..09a4364bb0
Binary files /dev/null and b/windows/security/book/images/privacy-cover.png differ
diff --git a/windows/security/book/images/privacy-on.png b/windows/security/book/images/privacy-on.png
new file mode 100644
index 0000000000..83e4d59c8b
Binary files /dev/null and b/windows/security/book/images/privacy-on.png differ
diff --git a/windows/security/book/images/privacy.png b/windows/security/book/images/privacy.png
new file mode 100644
index 0000000000..f0772e28ba
Binary files /dev/null and b/windows/security/book/images/privacy.png differ
diff --git a/windows/security/book/images/secure-launch.png b/windows/security/book/images/secure-launch.png
new file mode 100644
index 0000000000..dd00cdc393
Binary files /dev/null and b/windows/security/book/images/secure-launch.png differ
diff --git a/windows/security/book/images/security-foundation-cover.png b/windows/security/book/images/security-foundation-cover.png
new file mode 100644
index 0000000000..5fdd9c7a92
Binary files /dev/null and b/windows/security/book/images/security-foundation-cover.png differ
diff --git a/windows/security/book/images/security-foundation-on.png b/windows/security/book/images/security-foundation-on.png
new file mode 100644
index 0000000000..d6ddf2af1f
Binary files /dev/null and b/windows/security/book/images/security-foundation-on.png differ
diff --git a/windows/security/book/images/security-foundation.png b/windows/security/book/images/security-foundation.png
new file mode 100644
index 0000000000..2810449234
Binary files /dev/null and b/windows/security/book/images/security-foundation.png differ
diff --git a/windows/security/book/images/uac-settings.png b/windows/security/book/images/uac-settings.png
new file mode 100644
index 0000000000..d4a8fc4bb0
Binary files /dev/null and b/windows/security/book/images/uac-settings.png differ
diff --git a/windows/security/book/index.md b/windows/security/book/index.md
new file mode 100644
index 0000000000..3fddf8be3c
--- /dev/null
+++ b/windows/security/book/index.md
@@ -0,0 +1,55 @@
+---
+title: Windows security book introduction
+description: Windows security book introduction
+ms.topic: overview
+ms.date: 04/09/2024
+ROBOTS:
+---
+
+# Windows 11 Security Book
+
+:::image type="content" source="images/cover.png" alt-text="Cover of the Windows 11 security book.":::
+
+## Introduction
+
+Emerging technologies and evolving business trends bring new opportunities and challenges for organizations of all sizes. As technology and workstyles transform, so does the threat landscape with growing numbers of increasingly sophisticated attacks on organizations and employees.
+
+To thrive, organizations need security to work anywhere. [Microsoft's 2022 Work Trend Index](https://www.microsoft.com/security/blog/2022/04/05/new-security-features-for-windows-11-will-help-protect-hybrid-work/) shows *cybersecurity issues and risks* are top concerns for business decision-makers, who worry about issues like malware, stolen credentials, devices that lack security updates, and physical attacks on lost or stolen devices.
+
+In the past, a corporate network and software-based security were the first lines of defense. With an increasingly distributed and mobile workforce, attention has shifted to hardware-based endpoint security. People are now the top target for cybercriminals, with 74% of all breaches due to human error, privilege misuses, stolen credentials, or social engineering. Most attacks are financially motivated, and credential theft, phishing, and exploitation of vulnerabilities are the primary attack vectors. Credential theft is the most prevalent attack vector, accounting for 50% of breaches [\[1\]](conclusion.md#footnote1).
+
+At Microsoft, we work hard to help organizations evolve and stay agile while protecting against modern threats. We're committed to helping businesses and their employees get secure, and stay secure. We [synthesize 43 trillion signals daily](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5bcRe?culture=en-us&country=us) to understand and protect against digital threats. We have more than 8,500 dedicated security professionals across 77 countries and over 15,000 partners in our security ecosystem striving to increase resilience for our customers [\[2\]](conclusion.md#footnote2).
+
+Businesses worldwide are moving toward [secure-by-design and secure-by-default strategies](https://www.cisa.gov/securebydesign). With these models, organizations choose products from manufacturers that consider security as a business requirement, not just a technical feature. With a secure-by-default strategy, businesses can proactively reduce risk and exposure to threats across their organization because products are shipped with security features already built in and enabled.
+
+To help businesses transform and thrive in a new era, we built Windows 11 to be secure by design and secure by default. Windows 11 devices arrive with more security features enabled out of the box. In contrast, Windows 10 devices came with many safeguards turned off unless enabled by IT or employees. The default security provided by Windows 11 elevates protection without needing to configure settings. In addition, Windows 11 devices have been shown to increase malware resistance without impacting performance [\[3\]](conclusion.md#footnote3). Windows 11 is the most secure Windows ever, built in deep partnership with original equipment manufacturers (OEMs) and silicon manufacturers. Discover why organizations of all sizes, including 90% of Fortune 500 companies, are taking advantage of the powerful default protection of Windows 11 [\[4\]](conclusion.md#footnote4).
+
+## Security priorities and benefits
+
+### Security by design and security by default
+
+Windows 11 is designed with layers of security enabled by default, so you can focus on your work, not your security settings. **Out-of-the-box features such as credential safeguards, malware shields, and application protection led to a reported 58% drop in security incidents, including a 3.1x reduction in firmware attacks** [\[5\]](conclusion.md#footnote5).
+
+In Windows 11, hardware and software work together to shrink the attack surface, protect system integrity, and shield valuable data. New and enhanced features are designed for security by default. For example, Win32 apps in isolation [\[6\]](conclusion.md#footnote6), token protection [\[6\]](conclusion.md#footnote6), and Microsoft Intune Endpoint Privilege Management [\[7\]](conclusion.md#footnote7) are some of the latest capabilities that help protect your organization and employees against attack. Windows Hello and Windows Hello for Business work with hardware-based features like TPM 2.0 and biometric scanners for credential protection and easier, secure sign-on. Existing security features like BitLocker encryption have also been enhanced to optimize both security and performance.
+
+### Protect employees against evolving threats
+
+With attackers targeting employees and their devices, organizations need stronger security against increasingly sophisticated cyberthreats. Windows 11 provides proactive protection against credential theft. Windows Hello and TPM 2.0 work together to shield identities. Secure biometric sign-in virtually eliminates the risk of lost or stolen passwords. And enhanced phishing protection increases safety. In fact, **businesses reported 2.8x fewer instances of identity theft with the hardware-backed protection in Windows 11** [\[5\]](conclusion.md#footnote5).
+
+### Gain mission-critical application safeguards
+
+Help keep business data secure and employees productive with robust safeguards and control for applications. Windows 11 has multiple layers of application security that shield critical data and code integrity. Application protection, privacy controls, and least-privilege principles enable developers to build in security by design. This integrated security protects against breaches and malware, helps keep data private, and gives IT administrators the controls they need. As a result, organizations and regulators can be confident that critical data is protected.
+
+### End-to-end protection with modern management
+
+Increase protection and efficiency with Windows 11 and chip-to-cloud security. Microsoft offers comprehensive cloud services for identity, storage, and access management. In addition, Microsoft also provides the tools needed to attest that Windows 11 devices connecting to your network or accessing your data and resources are trustworthy. You can also enforce compliance and conditional access with modern device management (MDM) solutions such as Microsoft Intune and Microsoft Entra ID. Security by default not only enables people to work securely anywhere, but it also simplifies IT. A streamlined, chip-to-cloud security solution based on Windows 11 has improved productivity for IT and security teams by a reported 25% [\[8\]](conclusion.md#footnote8).
+
+## Security by design and default
+
+In Windows 11, hardware and software work together to protect sensitive data from the core of your PC all the way to the cloud. Comprehensive protection helps keep your organization secure, no matter where people work. This simple diagram shows the layers of protection in Windows 11, while each chapter provides a layer-by-layer deep dive into features.
+
+:::image type="content" source="images/chip-to-cloud.png" alt-text="Diagram of chip-to-cloud containing a list of security features." lightbox="images/chip-to-cloud.png" border="false":::
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows security features licensing and edition requirements](/windows/security/licensing-and-edition-requirements?tabs=edition)
diff --git a/windows/security/book/operating-system-security-encryption-and-data-protection.md b/windows/security/book/operating-system-security-encryption-and-data-protection.md
new file mode 100644
index 0000000000..c574d203f1
--- /dev/null
+++ b/windows/security/book/operating-system-security-encryption-and-data-protection.md
@@ -0,0 +1,74 @@
+---
+title: Operating System security
+description: Windows 11 security book - Operating System security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Encryption and data protection
+
+:::image type="content" source="images/operating-system.png" alt-text="Diagram of containing a list of security features." lightbox="images/operating-system.png" border="false":::
+
+When people travel with their PCs, their confidential information travels with them. Wherever confidential data is stored, it must be protected against unauthorized access, whether through physical device theft or from malicious applications.
+
+## BitLocker
+
+BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses the AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure[\[9\]](conclusion.md#footnote9) can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune[\[6\]](conclusion.md#footnote6)> using a configuration service provider (CSP)[\[9\]](conclusion.md#footnote9). BitLocker provides encryption for the OS, fixed data, and removable data drives (BitLocker To Go), leveraging technologies like Hardware Security Test Interface (HSTI), Modern Standby, UEFI Secure Boot, and TPM. Windows consistently improves data protection by expanding existing options and providing new strategies.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [BitLocker overview](../operating-system-security/data-protection/bitlocker/index.md)
+
+## BitLocker To Go
+
+BitLocker To Go refers to BitLocker Drive Encryption on removable data drives. BitLocker To Go includes the encryption of USB flash drives, SD cards, and external hard disk drives. Drives can be unlocked using a password, certificate on a smart card, or recovery password.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [BitLocker FAQ](../operating-system-security/data-protection/bitlocker/faq.yml)
+
+## Device Encryption
+
+Device Encryption is consumer-level device encryption that can't be managed. Device Encryption is turned on by default for devices with the right hardware components (for example, TPM 2.0, UEFI Secure Boot, Hardware Security Test Interface, and Modern Standby). However, for a commercial scenario, it's possible for commercial customers to disable Device Encryption in favor of BitLocker Drive Encryption. BitLocker Drive Encryption is manageable through MDM.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Device encryption](../operating-system-security/data-protection/bitlocker/index.md#device-encryption)
+
+## Encrypted hard drive
+
+Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full-disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives.
+
+By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity.
+
+Encrypted hard drives enable:
+
+- Smooth performance: Encryption hardware integrated into the drive controller allows the drive to operate at full data rate without performance degradation
+- Strong security based in hardware: Encryption is always "on," and the keys for encryption never leave the hard drive. The drive authenticates the user independently from the operating system before it unlocks
+- Ease of use: Encryption is transparent to the user, and the user doesn't need to enable it. Encrypted hard drives are easily erased using an onboard encryption key. There's no need
+to re-encrypt data on the drive
+- Lower cost of ownership: There's no need for new infrastructure to manage encryption keys since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Encrypted hard drive](../operating-system-security/data-protection/encrypted-hard-drive.md)
+
+## Personal data encryption
+
+Personal Data Encryption refers to a new user authenticated encryption mechanism used to protect user content. Windows Hello for Business is the modern user authentication mechanism, which is used with PDE. Windows Hello for Business, either with PIN or biometrics (face or fingerprint), is used to protect the container, which houses the encryption keys used by Personal Data Encryption (PDE). When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content.
+
+With the first release of PDE (Windows 11 22H2), the PDE API was available, which when adopted by applications can protect data under the purview of the applications. With the platform release of the next Windows version, PDE for Folders will be released, this feature would require no updates to any applications and protects the contents in the Known Windows Folders from bootup till first login. This reduces the barrier for entry for customers and they'll be able to get PDE security as part of the OS.
+
+PDE requires Microsoft Entra ID.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Personal Data Encryption (PDE)](../operating-system-security/data-protection/personal-data-encryption/index.md)
+
+## Email encryption
+
+Email encryption enables users to encrypt outgoing email messages and attachments so that only intended recipients with a digital identification (ID) - also called a certificate - can read them.10 Users can digitally sign a message, which verifies the identity of the sender and ensures the message has not been tampered with.
+
+These encrypted messages can be sent by a user to people within their organization as well as external contacts who have proper encryption certificates.
+
+However, recipients using Windows 11 Mail app can only read encrypted messages if the message is received on their Exchange account and they have corresponding decryption keys. Encrypted messages can be read only by recipients who have a certificate. If an encrypted message is sent to recipients whose encryption certificates are not available, the app will prompt you to remove these recipients before sending the email.
diff --git a/windows/security/book/operating-system-security-network-security.md b/windows/security/book/operating-system-security-network-security.md
new file mode 100644
index 0000000000..5638c71bce
--- /dev/null
+++ b/windows/security/book/operating-system-security-network-security.md
@@ -0,0 +1,128 @@
+---
+title: Operating System security
+description: Windows 11 security book - Operating System security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Network security
+
+:::image type="content" source="images/operating-system.png" alt-text="Diagram of containing a list of security features." lightbox="images/operating-system.png" border="false":::
+
+Windows 11 raises the bar for network security, offering comprehensive protection to help people work with confidence from almost anywhere. To help reduce an organization's attack
+surface, network protection in Windows prevents people from accessing dangerous IP addresses and domains that may host phishing scams, exploits, and other malicious content.
+Using reputation-based services, network protection blocks access to potentially harmful, low-reputation domains and IP addresses.
+
+New DNS and TLS protocol versions strengthen the end-to-end protections needed for applications, web services, and Zero Trust networking. File access adds an untrusted network scenario with Server Message Block over QUIC, as well as new encryption and signing capabilities. Wi-Fi and Bluetooth advancements also provide greater trust in connections to other devices. In addition, VPN and Windows Firewall (previously called Windows Defender Firewall) platforms offer new ways to easily configure and debug software.
+
+In enterprise environments, network protection works best with Microsoft Defender for Endpoint, which provides detailed reporting on protection events as part of larger investigation scenarios.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [How to protect your network](/defender-endpoint/network-protection)
+
+## Transport layer security (TLS)
+
+Transport Layer Security (TLS) is the internet's most deployed security protocol, encrypting data in transit to provide a secure communication channel between two endpoints. Windows defaults to the latest protocol versions and strong cipher suites unless policies are in effect to limit them. There are many extensions available, such as client authentication for enhanced server security and session resumption for improved application performance.
+
+TLS 1.3 is the latest version of the protocol and is enabled by default starting with Windows 11 and Windows Server 2022. TLS 1.3 eliminates obsolete cryptographic algorithms, enhances security over older versions, and encrypts as much of the TLS handshake as possible. The handshake is more performant, with one fewer round trip per connection on average, and supports only five strong cipher suites, which provide perfect forward secrecy and reduced operational risk.
+
+Customers using TLS 1.3 (or Windows components that support it, including HTTP.SYS, WinInet, .NET, MsQuic, and more) will get enhanced privacy and lower latencies for their encrypted online connections. Note that if either the client or server does not support TLS 1.3, Windows will fall back to TLS 1.2.
+
+Legacy protocol versions TLS 1.0 and 1.1 are officially deprecated and will be disabled by default in future OS versions only. This change will come to Windows Insider Preview in September 2023. Organizations and application developers are strongly encouraged to begin to identify and remove code dependencies on TLS 1.0/1.1 if they have not done so already.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [TLS/SSL overview (Schannel SSP)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)
+- [TLS 1.0 and TLS 1.1 soon to be disabled in Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/bc-p/3894928/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExMM0hCN0VURDk3OU9OfDM4OTQ5Mjh8U1VCU0NSSVBUSU9OU3xoSw#M6180)
+
+## DNS security
+
+In Windows 11, the Windows DNS client supports DNS over HTTPS and DNS over TLS, two encrypted DNS protocols. These allow administrators to ensure their devices protect their
+name queries from on-path attackers, whether they are passive observers logging browsing behavior or active attackers trying to redirect clients to malicious sites. In a Zero Trust
+model where no trust is placed in a network boundary, having a secure connection to a trusted name resolver is required.
+
+Windows 11 provides Group Policy as well as programmatic controls to configure DNS over HTTPS behavior. As a result, IT administrators can extend existing security to adopt new models such as Zero Trust. IT administrators can mandate DNS over HTTPS protocol, ensuring that devices that use insecure DNS will fail to connect to network resources. IT administrators also have the option not to use DNS over HTTPS or DNS over TLS for legacy deployments where network edge appliances are trusted to inspect plain-text DNS traffic. By default, Windows 11 will defer to the local administrator on which resolvers should use encrypted DNS.
+
+Support for DNS encryption integrates with existing Windows DNS configurations such as the Name Resolution Policy Table (NRPT) and the system Hosts file, as well as resolvers specified per network adapter or network profile. The integration helps Windows 11 ensure that the benefits of greater DNS security do not regress existing DNS control mechanisms.
+
+## Bluetooth protection
+
+The number of Bluetooth devices connected to Windows 11 continues to increase. Windows users connect their Bluetooth headsets, mice, keyboards, and other accessories and improve their day-to-day PC experience by enjoying streaming, productivity, and gaming. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host-based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG) and Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that Bluetooth accessories' firmware and software are kept up to date.
+
+IT-managed environments have a number of [Bluetooth policies](/windows/client-management/mdm/policy-csp-bluetooth) (MDM, Group Policy, and PowerShell) that can be managed through MDM tools such as Microsoft Intune[\[9\]](conclusion.md#footnote9). You can configure Windows to use Bluetooth technology while supporting the security needs of your organization. For example, you can allow input and audio while blocking file transfer, force encryption standards, limit Windows discoverability, or even disable Bluetooth entirely for the most sensitive environments.
+
+## Securing Wi-Fi connections
+
+Windows Wi-Fi supports industry-standard authentication and encryption methods when connecting to Wi-Fi networks. WPA (Wi-Fi Protected Access) is a security standard defined by the Wi-Fi Alliance (WFA) to provide sophisticated data encryption and better user authentication.
+
+The current security standard for Wi-Fi authentication is WPA3, which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows supports three WPA3 modes - WPA3 Personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B.
+
+Windows 11 includes WPA3 Personal with the new H2E protocol and WPA3 Enterprise 192-bit Suite B. Windows 11 also supports WPA3 Enterprise, which includes enhanced server certificate validation and TLS 1.3 for authentication using EAP-TLS authentication.
+
+Opportunistic Wireless Encryption (OWE), a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots, is also included.
+
+## 5G and eSIM
+
+5G networks use stronger encryption and better network segmentation compared to previous generations of cellular protocols. Unlike Wi-Fi, 5G access is always mutually authenticated. Access credentials are stored in an EAL4-certified eSIM that is physically embedded in the device, making it much harder for attackers to tamper with. Together, 5G and eSIM provide a strong foundation for security.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [eSIM configuration of a download server](/mem/intune/configuration/esim-device-configuration-download-server)
+
+## Windows Firewall
+
+Windows Firewall with Advanced Security (previously called Windows Defender Firewall) is an important part of a layered security model. It provides host-based, two-way network traffic
+filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks the device is connected to.
+
+Windows Firewall in Windows 11 offers the following benefits:
+
+- Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules that restrict or allow traffic by many properties, such as IP addresses,
+ports, or program paths. This functionality increases manageability and decreases the likelihood of a successful attack
+- Safeguards sensitive data and intellectual property: By integrating with Internet Protocol Security (IPSec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data
+- Extends the value of existing investments: Because Windows Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API)
+
+Windows 11 makes the Windows Firewall easier to analyze and debug. IPSec behavior has been integrated with Packet Monitor (pktmon), an in-box, cross-component network diagnostic tool for Windows. Additionally, the Windows Firewall event logs have been enhanced to ensure an audit can identify the specific filter that was responsible for any given event. This enables analysis of firewall behavior and rich packet capture without relying on third-party tools.
+
+Admins can now configure additional settings through the Firewall and Firewall Rule policy templates in the Endpoint Security node in Microsoft Intune[\[9\]](conclusion.md#footnote9), leveraging the platform
+support from the Firewall configuration service provider (CSP) and applying these settings to Windows endpoints.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Firewall overview](../operating-system-security/network-security/windows-firewall/index.md)
+
+## Virtual private networks (VPN)
+
+Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built-in VPN
+protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and
+consumer VPNs, including apps for the most popular enterprise VPN gateways.
+
+In Windows 11, we've integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane, users can see the status of their VPN, start and stop the VPN tunnels, and with one click, go to the modern Settings app for more control.
+
+The Windows VPN platform connects to Microsoft Entra ID[\[9\]](conclusion.md#footnote9) and Conditional Access for single sign-on, including multifactor authentication (MFA) through Microsoft Entra ID. The VPN platform also supports classic domain-joined authentication. It's supported by Microsoft Intune and other modern device management (MDM) providers. The flexible VPN profile supports both built-in protocols and custom protocols. It can configure multiple authentication methods and can be automatically started as needed or manually started by the end user. It also supports split-tunnel VPN and exclusive VPN with exceptions for trusted external sites.
+
+With Universal Windows Platform (UWP) VPN apps, end users never get stuck on an old version of their VPN client. VPN apps from the store will be automatically updated as needed. Naturally, the updates are in the control of your IT admins.
+
+The Windows VPN platform has been tuned and hardened for cloud-based VPN providers like Azure VPN. Features like Microsoft Entra ID authentication, Windows user interface integration, plumbing IKE traffic selectors, and server support are all built into the Windows VPN platform. The integration into the Windows VPN platform leads to a simpler IT admin experience. User authentication is more consistent, and users can easily find and control their VPN.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows VPN technical guide](../operating-system-security/network-security/vpn/vpn-guide.md)
+
+## Server Message Block file services
+
+Server Message Block (SMB) and file services are the most common Windows workloads in the commercial and public sector ecosystem. Users and applications rely on SMB to access the files that run organizations of all sizes. In Windows 11, the SMB protocol has significant security updates to meet today's threats, including AES-256 encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and an entirely new scenario, SMB over QUIC for untrusted networks.
+
+SMB encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of this more advanced security or continue to use the more compatible and still-safe AES-128 encryption.
+
+In Windows 11 Enterprise, Education, Pro, and Pro Workstation, SMB Direct now supports encryption. For demanding workloads like video rendering, data science, or extremely large files, you can now operate with the same safety as traditional Transmission Control Protocol (TCP) and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now, data is encrypted before placement, leading to relatively minor performance degradation while adding packet privacy with AES-128 and AES-256 protection.
+
+Windows 11 also introduces AES-128-GMAC for SMB signing. Windows will automatically negotiate this better-performing cipher method when connecting to another computer that supports it. Signing prevents common attacks like relay and spoofing, and it is required by default when clients communicate with Active Directory domain controllers.
+
+Finally, Windows 11 introduces SMB over QUIC, an alternative to the TCP network transport that provides secure, reliable connectivity to edge file servers over untrusted networks like the internet, as well as highly secure communications on internal networks. QUIC is an Internet Engineering Task Force (IETF)-standardized protocol with many benefits when compared with TCP, but most importantly, it always requires TLS 1.3 and encryption. SMB over QUIC offers an SMB VPN for telecommuters, mobile device users, and high-security organizations. All SMB traffic, including authentication and authorization within the tunnel, is never exposed to the underlying network. SMB behaves normally within the QUIC tunnel, meaning the user experience doesn't change. SMB over QUIC will be a game-changing feature for Windows 11 accessing Windows file servers and eventually Azure Files and third parties.
+
+Newly installed Windows 11 Home editions that contain the February 2023 cumulative update no longer install the SMB 1.0 client by default, meaning the Home edition now operates like all other editions of Windows 11. SMB 1.0 is an unsafe and deprecated protocol that Microsoft superseded by later versions of SMB starting with Windows Vista. Microsoft began uninstalling SMB 1.0 by default in certain Windows 10 editions in 2017. No versions of Windows 11 now install SMB 1.0 by default.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [File sharing using the SMB 3 protocol](/windows-server/storage/file-server/file-server-smb-overview)
diff --git a/windows/security/book/operating-system-security-system-security.md b/windows/security/book/operating-system-security-system-security.md
new file mode 100644
index 0000000000..a3d5e5e95b
--- /dev/null
+++ b/windows/security/book/operating-system-security-system-security.md
@@ -0,0 +1,129 @@
+---
+title: Operating System security
+description: Windows 11 security book - Operating System security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# System security
+
+:::image type="content" source="images/operating-system.png" alt-text="Diagram of containing a list of security features." lightbox="images/operating-system.png" border="false":::
+
+## Trusted Boot (Secure Boot + Measured Boot)
+
+Windows 11 requires all PCs to use Unified Extensible Firmware Interface (UEFI)'s Secure Boot feature. When a Windows 11 device starts, Secure Boot and Trusted Boot work together to prevent malware and corrupted components from loading. Secure Boot provides initial protection, then Trusted Boot picks up the process.
+
+Secure Boot makes a safe and trusted path from the Unified Extensible Firmware Interface (UEFI) through the Windows kernel's Trusted Boot sequence. Malware attacks on the Windows boot sequence are blocked by the signature-enforcement handshakes throughout the boot sequence between the UEFI, bootloader, kernel, and application environments.
+
+To reduce the risk of firmware rootkits, the PC verifies that firmware is digitally signed as it begins the boot process. Then Secure Boot checks the OS bootloader's digital signature as well as all code that runs prior to the operating system starting to ensure the signature and code are uncompromised and trusted by the Secure Boot policy.
+
+Trusted Boot picks up the process that begins with Secure Boot. The Windows bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including boot drivers, startup files, and any anti-malware product's early-launch anti-malware (ELAM) driver. If any of these files have been tampered with, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally.
+
+Tampering or malware attacks on the Windows boot sequence are blocked by the signature enforcement handshakes between the UEFI, bootloader, kernel, and application environments.
+
+For more information about these features and how they help prevent rootkits and bootkits from loading during the startup process, see [Secure the Windows boot process](../operating-system-security/system-security/secure-the-windows-10-boot-process.md)
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Secure Boot and Trusted Boot](../operating-system-security/system-security/trusted-boot.md)
+
+## Cryptography
+
+Cryptography is designed to protect user and system data. The cryptography stack in Windows 11 extends from the chip to the cloud, enabling Windows, applications, and services to protect system and user secrets. For example, data can be encrypted so that only a specific reader with a unique key can read it. As a basis for data security, cryptography helps prevent anyone except the intended recipient from reading data, performs integrity checks to ensure data is free of tampering, and authenticates identity to ensure that communication is secure. Windows 11 cryptography is certified to meet the Federal Information Processing Standard (FIPS) 140. FIPS 140 certification ensures that US government-approved algorithms are correctly implemented.
+
+Learn more: FIPS 140 validation
+
+Windows cryptographic modules provide low-level primitives such as:
+
+- Random number generators (RNG)
+- Support for AES 128/256 with XTS, ECB, CBC, CFB, CCM, and GCM modes of operation; RSA and DSA 2048, 3072, and 4,096 key sizes; ECDSA over curves P-256, P-384, P-521
+- Hashing (support for SHA1, SHA-256, SHA-384, and SHA-512)
+- Signing and verification (padding support for OAEP, PSS, and PKCS1)
+- Key agreement and key derivation (support for ECDH over NIST-standard prime curves P-256, P-384, P-521 and HKDF)
+
+Application developers can use these cryptographic modules to perform low-level cryptographic operations (Bcrypt), key storage operations (NCrypt), protect static data (DPAPI), and securely share secrets (DPAPI-NG).
+
+Learn more: Cryptography and certificate management
+
+Developers can access the modules on Windows through the Cryptography Next Generation API (CNG), which is powered by Microsoft's open-source cryptographic library, SymCrypt. SymCrypt supports complete transparency through its open-source code. In addition, SymCrypt offers performance optimization for cryptographic operations by taking advantage of assembly and hardware acceleration when available.
+
+SymCrypt is part of Microsoft's commitment to transparency, which includes the global Microsoft Government Security Program that aims to provide the confidential security information and resources people need to trust Microsoft's products and services. The program offers controlled access to source code, threat and vulnerability information
+exchange, opportunities to engage with technical content about Microsoft's products and services, and access to five globally distributed Transparency Centers.
+
+## Certificates
+
+To help safeguard and authenticate information, Windows provides comprehensive support for certificates and certificate management. The built-in certificate management command-line utility (certmgr.exe) or MMC snap-in (certmgr.msc) can be used to view and manage certificates, certificate trust lists (CTLs), and
+certificate revocation lists (CRLs). Whenever a certificate is used in Windows, we validate that the leaf certificate and all the certificates in its chain of trust have not been revoked or compromised. The CTLs and CRLs on the machine are used as a reference for PKI trust and are updated monthly by the Microsoft Trusted Root program. If a trusted certificate or root is revoked, all global devices will be updated, meaning users can trust that Windows will automatically protect against vulnerabilities in public key infrastructure. For cloud and enterprise deployments, Windows also offers users the ability to autoenroll and renew certificates in Active Directory with Group Policy to reduce the risk of potential outages due to certificate expiration or misconfiguration. Additionally, enterprise certificate pinning can be used to help reduce man-in-the-middle attacks by enabling users to protect their internal domain names from chaining to unwanted certificates. A web application's server authentication certificate chain is checked to ensure it matches a restricted set of certificate authorities. Any web application triggering a name mismatch will start event logging and prevent user access from Microsoft Edge.
+
+## Code signing and integrity
+
+To ensure that Windows files haven't been tampered with, the Windows Code Integrity process verifies the signature of each file in Windows. Code signing is core to establishing the integrity of firmware, drivers, and software across the Windows platform. Code signing creates a digital signature by encrypting the hash of the file with the private key portion of a code-signing certificate and embedding the signature into the file. The Windows code integrity process verifies the signed file by decrypting the signature to check the integrity of the file and confirm that it is from a reputable publisher, ensuring that the file hasn't been tampered with.
+
+The digital signature is evaluated across the Windows environment on Windows boot code, Windows kernel code, and Windows user mode applications. Secure Boot and Code Integrity verify the signature on bootloaders, Option ROMs, and other boot components to ensure that it's trusted and from a reputable publisher. For drivers not published by Microsoft, Kernel Code Integrity verifies the signature on kernel drivers and requires that drivers be signed by Windows or certified by the Windows Hardware Compatibility Program (WHCP). This program ensures that third-party drivers are compatible with various hardware and Windows and that the drivers are from vetted driver developers.
+
+## Device health attestation
+
+The Windows device health attestation process supports a Zero Trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and haven't been tampered with before they can access corporate resources. These
+determinations are made with data stored in the TPM, which provides a secure root-of-trust. The information is sent to an attestation service such as Azure Attestation to verify that the device is in a trusted state. Then a modern device management (MDM) tool like Microsoft Intune[\[9\]](conclusion.md#footnote9) reviews device health and connects this information with Microsoft Entra ID[\[9\]](conclusion.md#footnote9) for conditional access.
+
+Windows includes many security features to help protect users from malware and attacks. However, security components are trustworthy only if the platform boots as expected and isn't tampered with. As noted above, Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, ELAM, DRTM, Trusted Boot, and other low-level hardware and firmware security features to protect your PC from attacks. From the moment you power on your PC until your antimalware starts, Windows is backed with the appropriate hardware configurations that help keep you safe. Measured Boot, implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to the TPM, that functions as a hardware root-of-trust. Remote attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper-resilient report. Remote attestation is the trusted auditor of your system's boot, allowing reliant parties to bind trust to the device and its security.
+
+A summary of the steps involved in attestation and Zero-Trust on a Windows device are as follows:
+
+- During each step of the boot process - such as a file load, update of special variables, and more - information such as file hashes and signature(s) are measured in the TPM Platform Configuration Register (PCRs). The measurements are bound by a Trusted Computing Group specification that dictates which events can be recorded and the format of each event. The data provides important information about device security from the moment it powers on
+- Once Windows has booted, the attestor (or verifier) requests the TPM get the measurements stored in its PCRs alongside the Measured Boot log. Together, these form the attestation evidence that's sent to the Microsoft Azure Attestation Service
+- The TPM is verified by using the keys or cryptographic material available on the chipset with an Azure Certificate Service
+- The above information is sent to the Azure Attestation Service to verify that the device is in a trusted state.
+
+Learn more: Control the health of Windows devices
+
+## Windows security policy settings and auditing
+
+Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies that IT administrators can use to help protect Windows devices and other resources in your organization. Security policies settings are rules you can configure on a device, or multiple devices, to control:
+
+- User authentication to a network or device
+- Resources that users are permitted to access
+- Whether to record a user or group's actions in the event log
+- Membership in a group
+
+Security auditing is one of the most powerful tools that you can use to maintain the integrity of your network and assets. Auditing can help identify attacks, network vulnerabilities, and attacks against high-value targets. You can specify categories of security-related events to create an audit policy tailored to the needs of your organization.
+
+All auditing categories are disabled when Windows is first installed. Before enabling them, follow these steps to create an effective security auditing policy:
+
+1. Identify your most critical resources and activities.
+1. Identify the audit settings you need to track them.
+1. Assess the advantages and potential costs associated with each resource or setting.
+1. Test these settings to validate your choices.
+1. Develop plans for deploying and managing your audit policy.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Security policy settings](/windows/security/threat-protection/security-policy-settings/security-policy-settings)
+- [Security auditing](/windows/security/threat-protection/auditing/security-auditing-overview)
+
+## Assigned Access
+
+With Assigned Access, Windows devices restrict functionality to pre-selected applications depending on the user and keep individual identities separate, which is ideal for public-facing or shared devices. Configuring a device in Kiosk Mode is a straightforward process. You can do this locally on the device or remotely using modern device management.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows kiosks and restricted user experiences](/windows/configuration/assigned-access)
+
+## Config Refresh
+
+With traditional Group Policy, policies were refreshed on a PC when a user signed in and every 90 minutes by default. Administrators could adjust that timing to be shorter to ensure that the PC's policies were compliant with the management settings set by IT.
+
+By contrast, with an MDM solution like Microsoft Intune[\[9\]](conclusion.md#footnote9), policies are refreshed when a user signs in and then at eight-hour intervals by default. But as more available group policies were implemented through MDM, one remaining gap was the longer period between the reapplication of a changed policy.
+
+Config Refresh allows settings in the Policy configuration service provider (CSP) that drift due to misconfiguration, registry edits, or malicious software on a PC to be reset to the value the administrator intended every 90 minutes by default. It is configurable to refresh every 30 minutes if desired. The Policy CSP covers hundreds of settings that were traditionally set with Group Policy and are now set through MDM.
+
+Config Refresh can also be *paused* for a configurable period of time, after which it will be reenabled. This is to support scenarios where a helpdesk technician might need to reconfigure a PC for troubleshooting purposes. It can also be resumed at any time by an administrator.
+
+## Windows security settings
+
+Visibility and awareness of device security and health are key to any action taken. The Windows built-in security settings provide an at-a-glance view of the security status and health of your device. These insights help you identify issues and act to make sure you're protected. You can quickly see the status of your virus and threat protection, firewall and network security, device security controls, and more.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows security settings](https://support.microsoft.com/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963)
+- [Windows Security](../operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md)
diff --git a/windows/security/book/operating-system-security-virus-and-threat-protection.md b/windows/security/book/operating-system-security-virus-and-threat-protection.md
new file mode 100644
index 0000000000..c5873bd86f
--- /dev/null
+++ b/windows/security/book/operating-system-security-virus-and-threat-protection.md
@@ -0,0 +1,126 @@
+---
+title: Operating System security
+description: Windows 11 security book - Operating System security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Virus and threat protection
+
+:::image type="content" source="images/operating-system.png" alt-text="Diagram of containing a list of security features." lightbox="images/operating-system.png" border="false":::
+
+Today's threat landscape is more complex than ever. This new world requires a new approach to threat prevention, detection, and response. Microsoft Defender Antivirus, along with many other features that are built into Windows 11, is at the frontlines, protecting customers against current and emerging threats.
+
+## Microsoft Defender SmartScreen
+
+Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files.
+
+SmartScreen determines whether a site is potentially malicious by:
+
+- Analyzing visited webpages to find indications of suspicious behavior. If it determines a page is suspicious, it will show a warning page advising caution
+- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, SmartScreen warns that the site might be malicious
+
+SmartScreen also determines whether a downloaded app or app installer is potentially malicious by:
+
+- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, SmartScreen warns that the file might be malicious
+- Checking downloaded files against a list of well-known files. If the file is of a dangerous type and not well-known, SmartScreen displays a caution alert
+
+With enhanced phishing protection in Windows 11, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location, regardless of which application or browser is used. IT can customize which notifications appear through Microsoft Intune[\[9\]](conclusion.md#footnote9). This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement.
+
+Because Windows 11 comes with these enhancements already built in and enabled, users have extra security from the moment they turn on their device.
+
+The app and browser control section contains information and settings for Microsoft Defender SmartScreen. IT administrators and IT pros can get configuration guidance in the [Microsoft Defender SmartScreen documentation library](/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview).
+
+## Microsoft Defender Antivirus
+
+Microsoft Defender Antivirus is a next-generation protection solution included in all versions of Windows 10 and Windows 11. From the moment you turn on Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. In addition to real-time protection, updates are downloaded automatically to help keep your device safe and protect it from threats. If you have another antivirus app installed and turned on, Microsoft Defender Antivirus will turn off automatically. If you uninstall the other app, Microsoft Defender Antivirus will turn back on.
+
+Microsoft Defender Antivirus includes real-time, behavior-based, and heuristic antivirus protection. This combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA), applications deemed to negatively impact your device but are not considered malware.
+
+Microsoft Defender Antivirus always-on protection is integrated with cloud-delivered protection, which helps ensure near-instant detection and blocking of new and emerging threats. This combination of local and cloud-delivered technologies provides award-winning protection at home and at work.
+
+:::image type="content" source="images/defender-antivirus.png" alt-text="Diagram of the Microsoft Defender Antivirus components." border="false":::
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Next-generation protection with Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows).
+
+## Attack surface reduction
+
+Attack surface reduction rules help prevent software behaviors that are often abused to compromise devices and networks. By reducing the attack surface, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as:
+
+- Launching executable files and scripts that attempt to download or run files
+- Running obfuscated or otherwise suspicious scripts
+- Performing behaviors that apps don't usually initiate during normal day-to-day work
+
+For example, an attacker might try to run an unsigned script from a USB drive or have a macro in an Office document make calls directly to the Win32 API. Attack surface reduction rules can constrain these kinds of risky behaviors and improve the defensive posture of the device. For comprehensive protection, follow steps for enabling hardware-based isolation
+
+For Microsoft Edge and reducing the attack surface across applications, folders, device,
+network, and firewall.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Attack surface reduction](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)
+
+## Tamper protection
+
+Attacks like ransomware attempt to disable security features, such as anti-virus protection. Bad actors like to disable security features to get easier access to user's data, to install malware, or otherwise exploit user's data, identity, and devices without fear of being blocked. Tamper protection helps prevent these kinds of activities.
+
+With tamper protection, malware is prevented from taking actions such as:
+
+- Disabling real-time protection
+- Turning off behavior monitoring
+- Disabling antivirus, such as IOfficeAntivirus (IOAV)
+- Disabling cloud-delivered protection
+- Removing security intelligence updates
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)
+
+## Exploit protection
+
+Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint[\[9\]](conclusion.md#footnote9), which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device and then use Group Policy in Active Directory or Microsoft Intune[\[9\]](conclusion.md#footnote9) to distribute the configuration XML file to multiple devices simultaneously.
+
+When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors.
+
+You can use audit mode to evaluate how exploit protection would impact your organization if it were enabled.
+
+Windows 11 provides configuration options for exploit protection. You can prevent users from modifying these specific options with Group Policy.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Protecting devices from exploits](/microsoft-365/security/defender-endpoint/enable-exploit-protection)
+
+## Controlled folder access
+
+You can protect your valuable information in specific folders by managing app access to them. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, and downloads, are included in the list of controlled folders.
+
+Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.
+
+Controlled folder access helps protect user's valuable data from malicious apps and threats such as ransomware.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)
+
+## Microsoft Defender for Endpoint
+
+Microsoft Defender for Endpoint[\[9\]](conclusion.md#footnote9) is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats.
+
+Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents:
+
+- Endpoint behavioral sensors: Embedded in Windows, these sensors collect and process behavioral signals from the operating system and send this sensor data to your private, isolated cloud instance of Microsoft Defender for Endpoint
+- Cloud security analytics: Behavioral signals are translated into insights, detections, and recommended responses to advanced threats. These analytics leverage big data, device learning, and unique Microsoft optics across the Windows ecosystem, enterprise cloud products such as Microsoft 365[\[9\]](conclusion.md#footnote9), and online assets
+- Threat intelligence: Microsoft processes over 43 trillion security signals every 24 hours, yielding a deep and broad view into the evolving threat landscape. Combined with our global team of security experts and cutting-edge artificial intelligence and machine learning, we can see threats that others miss. This threat intelligence helps provide unparalleled protection for our customers. The protections built into our platforms and products blocked
+attacks that include 31 billion identity threats and 32 billion email threats
+- Rich response capabilities: Defender for Endpoint empowers SecOps teams to isolate, remediate, and remote into machines to further investigate and stop active threats in their environment, as well as block files, network destinations, and create alerts for them. In addition, Automated Investigation and Remediation can help reduce the load on the SOC by automatically performing otherwise manual steps towards remediation and providing
+detailed investigation outcomes
+
+Defender for Endpoint is also part of Microsoft 365 Defender, our end-to-end, cloud-native extended detection and response (XDR) solution that combines best-of-breed endpoint, email, and identity security products. It enables organizations to prevent, detect, investigate, and remediate attacks by delivering deep visibility, granular context, and actionable insights generated from raw signals harnessed across the Microsoft 365 environment and other
+platforms, all synthesized into a single dashboard. This solution offers tremendous value to organizations of any size, especially those that are looking to break away from the added complexity of multiple point solutions, keeping them protected from sophisticated attacks and saving IT and security teams' time and resources.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Microsoft Defender for Endpoint](/defender-endpoint/microsoft-defender-endpoint)
+- [Microsoft 365 Defender](/microsoft-365/security/defender/microsoft-365-defender)
diff --git a/windows/security/book/operating-system-security.md b/windows/security/book/operating-system-security.md
new file mode 100644
index 0000000000..f5bf82d057
--- /dev/null
+++ b/windows/security/book/operating-system-security.md
@@ -0,0 +1,14 @@
+---
+title: Operating System security
+description: Windows 11 security book - Operating System security chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Operating System security
+
+:::image type="content" source="images/operating-system-security-cover.png" alt-text="Cover of the operating system security chapter." border="false":::
+
+:::image type="content" source="images/operating-system-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/operating-system.png" border="false":::
+
+Windows 11 is the most secure Windows yet with extensive security measures in the operating system designed to help keep devices, identities, and information safe. These measures include built-in advanced encryption and data protection, robust network system security, and intelligent safeguards against ever-evolving viruses and threats.
diff --git a/windows/security/book/privacy-controls.md b/windows/security/book/privacy-controls.md
new file mode 100644
index 0000000000..01caad195d
--- /dev/null
+++ b/windows/security/book/privacy-controls.md
@@ -0,0 +1,32 @@
+---
+title: Privacy
+description: Windows 11 security book - Privacy chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Privacy controls
+
+:::image type="content" source="images/privacy.png" alt-text="Diagram of containing a list of security features." lightbox="images/privacy.png" border="false":::
+
+## Privacy dashboard and report
+
+Customers can use the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy) to view, export, and delete their information, giving them further transparency and control. They can also use the [Microsoft Privacy Report](https://privacy.microsoft.com/privacy-report) to learn more about Windows data collection and how to manage it. For enterprises we provide a guide for Windows Privacy Compliance that includes additional details on the available controls and transparency.
+
+## Privacy transparency and controls
+
+Prominent system tray icons show users when resources and apps like microphones and location are in use. A description of the app and its activity are presented in a simple tooltip that appears when you hover over an icon with your cursor. Apps can also make use of new Windows APIs to support Quick Mute functionality and more.
+
+## Privacy resource usage
+
+Every Microsoft customer should be able to use our products secure in the knowledge that we will protect their privacy and give them the information and tools they need to easily make privacy decisions with confidence. Accessed in Settings, the new app usage history feature gives users a seven-day history of resource access for Location, Camera, Microphone, Phone Calls, Messaging, Contacts, Pictures, Videos, Music library, Screenshots, and other apps.
+
+This information helps you determine if an app is behaving as expected so that you can change the app's access to resources as desired.
+
+## Windows diagnostic data processor configuration
+
+The Windows diagnostic data processor configuration enables the user to be the controller, as defined by the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows devices that meet the configuration requirements.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows diagnostic data processor configuration](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#enable-windows-diagnostic-data-processor-configuration)
diff --git a/windows/security/book/privacy.md b/windows/security/book/privacy.md
new file mode 100644
index 0000000000..19cae8027a
--- /dev/null
+++ b/windows/security/book/privacy.md
@@ -0,0 +1,16 @@
+---
+title: Privacy
+description: Windows 11 security book - Privacy chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Privacy
+
+:::image type="content" source="images/privacy-cover.png" alt-text="Cover of the privacy chapter." border="false":::
+
+:::image type="content" source="images/privacy-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/privacy.png" border="false":::
+
+[Privacy: Your data, powering your experiences, controlled by you](https://privacy.microsoft.com/).
+
+Privacy is becoming top of mind for customers, who want to know who is using their data and why. They also need to know how to control and manage the data that is being collected - so providing transparency and control over this personal data is essential. At Microsoft we are focused on protecting the privacy and confidentiality of your data and will only use it in a way that is consistent with your expectations.
diff --git a/windows/security/book/security-foundation-certification.md b/windows/security/book/security-foundation-certification.md
new file mode 100644
index 0000000000..fe9fa899fc
--- /dev/null
+++ b/windows/security/book/security-foundation-certification.md
@@ -0,0 +1,24 @@
+---
+title: Security foundation
+description: Windows 11 security book - Security foundation chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Certification
+
+:::image type="content" source="images/security-foundation.png" alt-text="Diagram of containing a list of security features." lightbox="images/security-foundation.png" border="false":::
+
+Microsoft is committed to supporting product security standards and certifications, including FIPS 140 and Common Criteria, as an external validation of security assurance.
+
+## Federal Information Processing Standard (FIPS)
+
+The Federal Information Processing Standard (FIPS) Publication 140 is a US government standard that defines the minimum security requirements for cryptographic modules in IT products. Microsoft maintains an active commitment to meeting the requirements of the FIPS 140 standard, having validated cryptographic modules against FIPS 140-2 since it was first established. Microsoft products, including Windows 11, Windows 10, Windows Server, and many cloud services, use these cryptographic modules.
+
+## Common Criteria (CC)
+
+Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. Common Criteria defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements.
+
+Microsoft ensures that products incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications of Microsoft Windows products.
+
+Microsoft publishes the list of FIPS 140 and Common Criteria certified products at [Federal](/windows/security/security-foundations/certification/fips-140-validation) [Information Processing Standard (FIPS)](/windows/security/security-foundations/certification/fips-140-validation) 140 Validation and [Common Criteria Certifications.](/windows/security/threat-protection/windows-platform-common-criteria)
diff --git a/windows/security/book/security-foundation-offensive-research.md b/windows/security/book/security-foundation-offensive-research.md
new file mode 100644
index 0000000000..965ecba6c0
--- /dev/null
+++ b/windows/security/book/security-foundation-offensive-research.md
@@ -0,0 +1,42 @@
+---
+title: Security foundation
+description: Windows 11 security book - Security foundation chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Offensive research
+
+:::image type="content" source="images/security-foundation.png" alt-text="Diagram of containing a list of security features." lightbox="images/security-foundation.png" border="false":::
+
+## Microsoft Security Development Lifecycle (SDL)
+
+The Microsoft Security Development Lifecycle (SDL) introduces security best practices, tools, and processes throughout all phases of engineering and development.
+
+## OneFuzz service
+
+A range of tools and techniques - such as threat modeling, static analysis, fuzz testing, and code quality checks - enable continued security value to be embedded into Windows by every engineer on the team from day one. Through the SDL practices, Microsoft engineers are continuously provided with actionable and up-to-date methods to improve development workflows and overall product security before the code has been released.
+
+Microsoft is dedicated to working with the community and our customers to continuously improve and tune our platform and products to help defend against the dynamic and sophisticated threat landscape. Project OneFuzz - an extensible fuzz testing framework used by Microsoft Edge, Windows, and teams across Microsoft - is now available to developers around the world through GitHub as an open-source tool.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Project OneFuzz framework, an open source developer tool to find and fix bugs at scale](https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/)
+- [OneFuzz on GitHub](https://github.com/microsoft/onefuzz)
+
+## Microsoft Offensive Research and Security Engineering
+
+[Microsoft Offensive Research and Security Engineering](https://github.com/microsoft/WindowsAppSDK-Samples?msclkid=1a6280c6c73d11ecab82868efae04e5c) performs targeted design reviews, audits, and deep penetration testing of Windows features using Microsoft's open-source OneFuzz platform as part of their development and testing cycle.
+
+## Windows Insider and Bug Bounty program
+
+As part of our secure development process, the Microsoft Windows Insider Preview bounty program invites eligible researchers across the globe to find and submit vulnerabilities that reproduce in the latest Windows Insider Preview (WIP) Dev Channel.
+
+The goal of the Windows Insider Preview bounty program is to uncover significant vulnerabilities that have a direct and demonstrable impact on the security of customers using the latest version of Windows.
+
+Through this collaboration with researchers across the globe, our teams identify critical vulnerabilities that were not previously found during development and quick fix the issues before releasing our final Windows.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
+- [Windows Insider Program](/windows-insider/get-started)
+- [Microsoft bounty programs](https://www.microsoft.com/msrc/bounty)
diff --git a/windows/security/book/security-foundation-secure-supply-chain.md b/windows/security/book/security-foundation-secure-supply-chain.md
new file mode 100644
index 0000000000..ee2f6ef548
--- /dev/null
+++ b/windows/security/book/security-foundation-secure-supply-chain.md
@@ -0,0 +1,66 @@
+---
+title: Secure supply chain
+description: Windows 11 security book - Security foundation chapter - Secure supply chain.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Secure supply chain
+
+:::image type="content" source="images/security-foundation.png" alt-text="Diagram of containing a list of security features." lightbox="images/security-foundation.png" border="false":::
+
+The end-to-end Windows 11 supply chain is complex, extending from the entire development process to components such as chips, firmware, drivers, operating system, and apps from other organizations, manufacturing, and security updates. Microsoft invests significantly in Windows 11 supply chain security, as well as the security of features and components. In 2021, the United States issued an executive order on enhancing the nation's cybersecurity. The executive order, along with various attacks like SolarWinds and WannaCry, elevated the urgency and importance of ensuring a secure supply chain.
+
+Microsoft requires the Windows 11 supply chain to comply with controls including:
+
+- Identity management and user access control
+ - Access control
+ - Principles of least privilege
+ - RBAC
+ - Segregation of duties
+ - MFAs
+ - Account management
+ - Physical access control
+- Information security
+ - Information handling
+ - Cryptography
+ - Vulnerability scanning
+ - Encryption
+ - Integrity and attestation
+ - Confidentiality
+- Operational controls
+ - Code of repo ownership
+ - Config & change management
+ - Asset ownership
+ - Manufacturing standards
+- Security monitoring & event logging
+ - Network
+ - Host
+ - Application
+ - Services
+ - DevOps
+ - Manufacturing security
+ - Physical security monitoring
+- Supplier security control
+ - SSPA
+ - Supplier screening
+ - Supplier inventory
+- Logistics security control
+ - Receiving
+ - Shipping
+ - Warehouse & storage
+ - Logistics management
+
+## Software bill of materials (SBOM)
+
+In addition to following the above supply chain security controls, SBOMs are leveraged to provide the transparency and provenance of the content as it moves through various stages of the Windows supply chain. This enables trust between each supply chain segment, ensures that tampering has not taken place during ingestion and along the way, and provides a provable chain of custody for the product that we ship to customers.
+
+Code-signing software is the best way to guarantee application integrity and authenticity and helps users distinguish between trusted applications and malware before downloading or installing. Code signing proprietary applications and software from other organizations greatly reduces the complexity of creating and managing application control policies. Code signing enables the creation and deployment of certificate chain-based application control policies, which can then be cryptographically enforced.
+
+Traditionally, code signing has been a difficult undertaking due to the complexities involved in obtaining certificates, securely managing those certificates, and integrating a proper signing process into the development and continuous integration and continuous deployment (CI/CD) pipelines.
+
+## Windows App software development kit (SDK)
+
+Developers can design highly secure applications that benefit from the latest Windows 11 safeguards using the Windows App SDK. The SDK provides a unified set of APIs and tools for developing secure desktop apps for Windows 11 and Windows 10. To help create apps that are up to date and protected, the SDK follows the same security standards, protocols, and compliance as the core Windows operating system.
+
+If you are a developer, you can find security best practices and information at [Windows application development - best practices](/windows/security/threat-protection/windows-platform-common-criteria#security-and-privacy). You can get started with [Windows App SDK samples on GitHub](/windows/security/threat-protection/fips-140-validation#windows-app-sdk-samples). For an example of the continuous security process in action with the Windows App SDK, see the [most recent release](https://insider.windows.com/#version-11).
diff --git a/windows/security/book/security-foundation.md b/windows/security/book/security-foundation.md
new file mode 100644
index 0000000000..f0fb340c8a
--- /dev/null
+++ b/windows/security/book/security-foundation.md
@@ -0,0 +1,18 @@
+---
+title: Security foundation
+description: Windows 11 security book - Security foundation chapter.
+ms.topic: overview
+ms.date: 04/09/2024
+---
+
+# Security foundation
+
+:::image type="content" source="images/security-foundation-cover.png" alt-text="Cover of the security foundation chapter." border="false":::
+
+Microsoft is committed to continuously investing in improving our software development process, building highly secure-by-design software, and addressing security compliance requirements. At Microsoft, we embed security and privacy considerations from the earliest lifecycle phases of all our product design and software development processes. We build in security from the ground up for powerful defense in today's threat environment and have the infrastructure to protect and react quickly to future threats.
+
+Every component of the Windows 11 technology stack, from chip-to-cloud, is purposefully built secure by design. Windows 11 meets the modern threats of today's flexible work environments by delivering hardware-based isolation, end-to-end encryption, and advanced malware protection.
+
+With Windows 11, organizations can improve productivity and gain intuitive new experiences without compromising security.
+
+:::image type="content" source="images/security-foundation-on.png" alt-text="Diagram of containing a list of security features." lightbox="images/security-foundation.png" border="false":::
diff --git a/windows/security/book/toc.yml b/windows/security/book/toc.yml
new file mode 100644
index 0000000000..e1135516e9
--- /dev/null
+++ b/windows/security/book/toc.yml
@@ -0,0 +1,65 @@
+items:
+- name: Windows 11 Security Book
+ href: index.md
+- name: 1. Hardware security
+ items:
+ - name: Overview
+ href: hardware-security.md
+ - name: Hardware root-of-trust
+ href: hardware-security-hardware-root-of-trust.md
+ - name: Silicon assisted security
+ href: hardware-security-silicon-assisted-security.md
+- name: 2. Operating system security
+ items:
+ - name: Overview
+ href: operating-system-security.md
+ - name: System security
+ href: operating-system-security-system-security.md
+ - name: Encryption and data protection
+ href: operating-system-security-encryption-and-data-protection.md
+ - name: Network security
+ href: operating-system-security-network-security.md
+ - name: Virus and threat protection
+ href: operating-system-security-virus-and-threat-protection.md
+- name: 3. Application security
+ items:
+ - name: Overview
+ href: application-security.md
+ - name: Application and driver control
+ href: application-security-application-and-driver-control.md
+ - name: Application isolation
+ href: application-security-application-isolation.md
+- name: 4. Identity protection
+ items:
+ - name: Overview
+ href: identity-protection.md
+ - name: Passwordless sign-in
+ href: identity-protection-passwordless-sign-in.md
+ - name: Advanced credential protection
+ href: identity-protection-advanced-credential-protection.md
+- name: 5. Privacy
+ items:
+ - name: Overview
+ href: privacy.md
+ - name: Privacy controls
+ href: privacy-controls.md
+- name: 6. Cloud services
+ items:
+ - name: Overview
+ href: cloud-services.md
+ - name: Protect your work information
+ href: cloud-services-protect-your-work-information.md
+ - name: Protect your personal information
+ href: cloud-services-protect-your-personal-information.md
+- name: 7. Security foundation
+ items:
+ - name: Overview
+ href: security-foundation.md
+ - name: Offensive research
+ href: security-foundation-offensive-research.md
+ - name: Certification
+ href: security-foundation-certification.md
+ - name: Secure supply chain
+ href: security-foundation-secure-supply-chain.md
+- name: Conclusion
+ href: conclusion.md
\ No newline at end of file
diff --git a/windows/security/cloud-security/index.md b/windows/security/cloud-services/index.md
similarity index 77%
rename from windows/security/cloud-security/index.md
rename to windows/security/cloud-services/index.md
index 9fde8b8939..9124be688f 100644
--- a/windows/security/cloud-security/index.md
+++ b/windows/security/cloud-services/index.md
@@ -1,18 +1,18 @@
---
-title: Windows and cloud security
-description: Get an overview of cloud security features in Windows.
-ms.date: 08/02/2023
+title: Windows and cloud services
+description: Get an overview of cloud-based services in Windows.
+ms.date: 05/06/2024
ms.topic: overview
author: paolomatarazzo
ms.author: paoloma
---
-# Windows and cloud security
+# Windows and cloud services
Today's workforce has more freedom and mobility than ever before, and the risk of data exposure is also at its highest. We're focused on getting customers to the cloud to benefit from modern hybrid workstyles while improving security management. Built on zero-trust principles, Windows works with Microsoft cloud services to safeguard sensitive information while controlling access and mitigating threats.
From identity and device management to Office apps and data storage, Windows and integrated cloud services can help improve productivity, security, and resilience anywhere.
-Learn more about cloud security features in Windows.
+Learn more about cloud-based services in Windows.
[!INCLUDE [cloud-services](../includes/sections/cloud-services.md)]
diff --git a/windows/security/cloud-security/toc.yml b/windows/security/cloud-services/toc.yml
similarity index 100%
rename from windows/security/cloud-security/toc.yml
rename to windows/security/cloud-services/toc.yml
diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 87d822d8a1..2e3135282a 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -85,6 +85,8 @@
"application-security//**/*.yml": "vinaypamnani-msft",
"application-security/application-control/windows-defender-application-control/**/*.md": "jsuther1974",
"application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther1974",
+ "book//**/*.md": "paolomatarazzo",
+ "book//**/*.yml": "paolomatarazzo",
"hardware-security/**/*.md": "vinaypamnani-msft",
"hardware-security/**/*.yml": "vinaypamnani-msft",
"identity-protection/**/*.md": "paolomatarazzo",
@@ -103,6 +105,8 @@
"application-security//**/*.yml": "vinpa",
"application-security/application-control/windows-defender-application-control/**/*.md": "jsuther",
"application-security/application-control/windows-defender-application-control/**/*.yml": "jsuther",
+ "book//**/*.md": "paoloma",
+ "book//**/*.yml": "paoloma",
"hardware-security//**/*.md": "vinpa",
"hardware-security//**/*.yml": "vinpa",
"identity-protection/**/*.md": "paoloma",
@@ -135,6 +139,9 @@
"✅ Windows Server 2019",
"✅ Windows Server 2016"
],
+ "book/**/*.md": [
+ "✅ Windows 11"
+ ],
"hardware-security/**/*.md": [
"✅ Windows 11",
"✅ Windows 10"
@@ -216,6 +223,7 @@
"ms.reviewer": {
"application-security/application-control/windows-defender-application-control/**/*.md": "vinpa",
"application-security/application-isolation/microsoft-defender-application-guard/*.md": "sazankha",
+ "book/*.md": "paoloma",
"identity-protection/access-control/*.md": "sulahiri",
"identity-protection/credential-guard/*.md": "zwhittington",
"identity-protection/hello-for-business/*.md": "erikdau",
@@ -227,12 +235,16 @@
"operating-system-security/network-security/windows-firewall/*.md": "nganguly"
},
"ms.collection": {
+ "book/*.md": "tier3",
"identity-protection/hello-for-business/*.md": "tier1",
"information-protection/pluton/*.md": "tier1",
"information-protection/tpm/*.md": "tier1",
"operating-system-security/data-protection/bitlocker/*.md": "tier1",
"operating-system-security/data-protection/personal-data-encryption/*.md": "tier1",
"threat-protection/auditing/*.md": "tier3"
+ },
+ "ROBOTS": {
+ "book/*.md": "NOINDEX"
}
},
"template": [],
diff --git a/windows/security/hardware-security/index.md b/windows/security/hardware-security/index.md
index a6314a6d44..dbe8b6153f 100644
--- a/windows/security/hardware-security/index.md
+++ b/windows/security/hardware-security/index.md
@@ -3,10 +3,13 @@ title: Windows hardware security
description: Learn more about hardware security features support in Windows.
ms.date: 07/28/2023
ms.topic: overview
+appliesto:
---
# Windows hardware security
+:::image type="content" source="..\book\images\hardware.png" alt-text="Diagram of containing a list of security features." lightbox="..\book\images\hardware.png" border="false":::
+
Learn more about hardware security features support in Windows.
[!INCLUDE [hardware](../includes/sections/hardware.md)]
diff --git a/windows/security/identity-protection/hello-for-business/deploy/index.md b/windows/security/identity-protection/hello-for-business/deploy/index.md
index b28e7db255..f5c412fc4f 100644
--- a/windows/security/identity-protection/hello-for-business/deploy/index.md
+++ b/windows/security/identity-protection/hello-for-business/deploy/index.md
@@ -1,7 +1,7 @@
---
title: Plan a Windows Hello for Business Deployment
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
-ms.date: 03/12/2024
+ms.date: 05/16/2024
ms.topic: concept-article
---
@@ -151,14 +151,16 @@ The goal of Windows Hello for Business is to move organizations away from passwo
|| Deployment model | MFA options |
|--|--|--|
| **🔲** | **Cloud-only** | Microsoft Entra MFA |
-| **🔲** | **Cloud-only** | Non-Microsoft MFA via Microsoft Entra ID custom controls or federation |
+| **🔲** | **Cloud-only** | Non-Microsoft MFA, via external authentication method in Microsoft Entra ID or federation |
| **🔲** | **Hybrid** | Microsoft Entra MFA |
-| **🔲** | **Hybrid** | Non-Microsoft MFA via Microsoft Entra ID custom controls or federation|
+| **🔲** | **Hybrid** | Non-Microsoft MFA, via external authentication method in Microsoft Entra ID or federation|
| **🔲** | **On-premises** | AD FS MFA adapter |
-For more information how to configure Microsoft Entra multifactor authentication, see [Configure Microsoft Entra multifactor authentication settings][ENTRA-4].
+For more information:
-For more information how to configure AD FS to provide multifactor authentication, see [Configure Azure MFA as authentication provider with AD FS][SER-1].
+- [Configure Microsoft Entra multifactor authentication settings][ENTRA-4]
+- [Configure Azure MFA as authentication provider with AD FS][SER-1]
+- [Manage an external authentication method in Microsoft Entra ID][ENTRA-11]
#### MFA and federated authentication
@@ -298,6 +300,7 @@ Now that you've read about the different deployment options and requirements, yo
[ENTRA-8]: /entra/identity/conditional-access/overview
[ENTRA-9]: /entra/identity/authentication/concept-mfa-licensing
[ENTRA-10]: /entra/identity/hybrid/connect/whatis-fed
+[ENTRA-11]: /entra/identity/authentication/how-to-authentication-external-method-manage
[SER-1]: /windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa
[SER-2]: /windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods
diff --git a/windows/security/identity-protection/hello-for-business/dual-enrollment.md b/windows/security/identity-protection/hello-for-business/dual-enrollment.md
new file mode 100644
index 0000000000..7dd1507298
--- /dev/null
+++ b/windows/security/identity-protection/hello-for-business/dual-enrollment.md
@@ -0,0 +1,72 @@
+---
+title: Dual enrollment
+description: Learn how to configure Windows Hello for Business dual enrollment and how to configure Active Directory to support Domain Administrator enrollment.
+ms.date: 05/06/2024
+ms.topic: how-to
+---
+
+# Dual enrollment
+
+[!INCLUDE [intro](deploy/includes/intro.md)]
+- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](deploy/includes/tooltip-deployment-onpremises.md)], [!INCLUDE [tooltip-deployment-hybrid](deploy/includes/tooltip-deployment-hybrid.md)]
+- **Trust type:** [!INCLUDE [tooltip-cert-trust](deploy/includes/tooltip-trust-cert.md)]
+- **Join type:** [!INCLUDE [tooltip-join-domain](deploy/includes/tooltip-join-domain.md)], [!INCLUDE [tooltip-join-hybrid](deploy/includes/tooltip-join-hybrid.md)]
+---
+
+> [!IMPORTANT]
+> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages organizations to use the Privileged Access Workstations for their privileged credential users. Organizations can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature can't be used. To learn more, see [Privileged Access Workstations](/windows-server/identity/securing-privileged-access/privileged-access-workstations).
+
+Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their nonprivileged and privileged credentials on their device.
+
+By design, Windows doesn't enumerate all Windows Hello for Business users from within a user's session. Using the group policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices.
+
+With this setting, administrative users can sign in to Windows using their nonprivileged Windows Hello credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command-line applications by using `runas.exe` combined with the `/smartcard` argument. This enables administrators to perform their day-to-day operations without needing to sign in and out, or use fast user switching when alternating between privileged and nonprivileged workloads.
+
+> [!IMPORTANT]
+> You must configure a Windows computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation.
+
+## Configure Windows Hello for Business dual enrollment
+
+Here are the steps to enable dual enrollment:
+
+- Configure Active Directory to support Domain Administrator enrollment
+- Configure dual enrollment using Group Policy
+
+### Configure Active Directory to support Domain Administrator enrollment
+
+The designed Windows Hello for Business configuration gives the `Key Admins` group read and write permissions to the `msDS-KeyCredentialsLink` attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy.
+
+Active Directory Domain Services uses `AdminSDHolder` to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account might receive the permissions but they disappear from the user object unless you give the `AdminSDHolder` read and write permissions to the `msDS-KeyCredential` attribute.
+
+Sign in to a domain controller or management workstation with access equivalent to *domain administrator*.
+
+1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the `Key Admins` group on the `AdminSDHolder` object
+
+ ```cmd
+ dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink
+ ```
+
+ where `DC=domain,DC=com` is the LDAP path of your Active Directory domain and `domainName\keyAdminGroup` is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
+
+ ```cmd
+ dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink
+ ```
+
+1. To trigger security descriptor propagation, open `ldp.exe`
+1. Select **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and select **OK**
+1. Select **Connection** and select **Bind...** Select **OK** to bind as the currently signed-in user
+1. Select **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type `1`. Select **Enter** to add this to the **Entry List**
+1. Select **Run** to start the task
+1. Close LDP
+
+### Configure dual enrollment with group policy
+
+You configure Windows to support dual enrollment using the computer configuration portion of a Group Policy object:
+
+1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users
+1. Edit the Group Policy object from step 1
+1. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**
+1. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC
+1. Restart computers targeted by this Group Policy object
+
+The computer is ready for dual enrollment. Sign in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign out and sign in as the nonprivileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users.
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md
deleted file mode 100644
index 276e763252..0000000000
--- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md
+++ /dev/null
@@ -1,64 +0,0 @@
----
-title: Dual Enrollment
-description: Learn how to configure Windows Hello for Business dual enrollment and how to configure Active Directory to support Domain Administrator enrollment.
-ms.date: 07/05/2023
-ms.topic: how-to
----
-
-# Dual Enrollment
-
-**Requirements**
-
-- Hybrid and On-premises Windows Hello for Business deployments
-- Enterprise joined or Hybrid Azure joined devices
-- Certificate trust
-
-> [!IMPORTANT]
-> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information.
-
-Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device.
-
-By design, Windows does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices.
-
-With this setting, administrative users can sign in to Windows 10, version 1709 or later using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command-line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign in and out, or use fast user switching when alternating between privileged and non-privileged workloads.
-
-> [!IMPORTANT]
-> You must configure a Windows computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation.
-
-## Configure Windows Hello for Business Dual Enrollment
-
-In this task, you will
-
-* Configure Active Directory to support Domain Administrator enrollment
-* Configure Dual Enrollment using Group Policy
-
-### Configure Active Directory to support Domain Administrator enrollment
-
-The designed Windows Hello for Business configuration gives the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy.
-
-Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute.
-
-Sign in to a domain controller or management workstation with access equivalent to _domain administrator_.
-
-1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
-```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
-where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
-```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink```
-2. To trigger security descriptor propagation, open **ldp.exe**.
-3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**.
-4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user.
-5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**.
-6. Click **Run** to start the task.
-7. Close LDP.
-
-### Configuring Dual Enrollment using Group Policy
-
-You configure Windows 10 or Windows 11 to support dual enrollment using the computer configuration portion of a Group Policy object.
-
-1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users.
-2. Edit the Group Policy object from step 1.
-3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**.
-4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC.
-5. Restart computers targeted by this Group Policy object.
-
-The computer is ready for dual enrollment. Sign in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign out and sign in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users.
diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml
index 946281222c..a9067a5752 100644
--- a/windows/security/identity-protection/hello-for-business/toc.yml
+++ b/windows/security/identity-protection/hello-for-business/toc.yml
@@ -20,7 +20,7 @@ items:
- name: Configure PIN reset
href: pin-reset.md
- name: Configure dual enrollment
- href: hello-feature-dual-enrollment.md
+ href: dual-enrollment.md
- name: Configure dynamic lock
href: hello-feature-dynamic-lock.md
- name: Configure multi-factor unlock
diff --git a/windows/security/introduction.md b/windows/security/introduction.md
index 887774184b..7b90b57e21 100644
--- a/windows/security/introduction.md
+++ b/windows/security/introduction.md
@@ -4,10 +4,10 @@ description: System security book.
ms.date: 09/01/2023
ms.topic: tutorial
ms.author: paoloma
-ms.collection:
+ms.collection:
- essentials-security
- essentials-overview
-content_well_notification:
+content_well_notification:
- AI-contribution
author: paolomatarazzo
appliesto:
@@ -57,4 +57,6 @@ Microsoft offers comprehensive cloud services for identity, storage, and access
## Next steps
-To learn more about the security features included in Windows 11, download the [Windows 11 Security Book: Powerful security from chip to cloud](https://aka.ms/Windows11SecurityBook).
+To learn more about the security features included in Windows 11, read the [Windows 11 Security Book](book/index.md).
+
+
diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md
index 00c468a2dd..34a527cefe 100644
--- a/windows/security/licensing-and-edition-requirements.md
+++ b/windows/security/licensing-and-edition-requirements.md
@@ -19,7 +19,7 @@ Select one of the two tabs to learn about licensing requirements to use the secu
[!INCLUDE [licensing-requirements](../../includes/licensing/_licensing-requirements.md)]
-#### [:::image type="icon" source="images/icons/subscription.svg" border="false"::: **Edition requirements**](#tab/edition)
+#### [:::image type="icon" source="images/icons/certificate.svg" border="false"::: **Edition requirements**](#tab/edition)
[!INCLUDE [_edition-requirements](../../includes/licensing/_edition-requirements.md)]
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/bl-narrator.png b/windows/security/operating-system-security/data-protection/bitlocker/images/bl-narrator.png
new file mode 100644
index 0000000000..223d0bc3b6
Binary files /dev/null and b/windows/security/operating-system-security/data-protection/bitlocker/images/bl-narrator.png differ
diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md
index a8446d34d2..c7613a0f46 100644
--- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md
+++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md
@@ -29,6 +29,10 @@ The following list provides examples of common events that cause a device to ent
- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile
- Moving a BitLocker-protected drive into a new computer
- On devices with TPM 1.2, changing the BIOS or firmware boot device order
+- Exceeding the maximum allowed number of failed sign-in attempts
+
+ > [!NOTE]
+ > To take advantage of this functionality, you must configure the policy setting **Interactive logon: Machine account lockout threshold** located in **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**. Alternatively, use the [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) **MaxFailedPasswordAttempts** policy setting, or the [DeviceLock Configuration Service Provider (CSP)](/windows/client-management/mdm/policy-csp-devicelock#accountlockoutpolicy).
As part of the [BitLocker recovery process](recovery-process.md), it's recommended to determine what caused a device to enter in recovery mode. Root cause analysis might help to prevent the problem from occurring again in the future. For instance, if you determine that an attacker modified a device by obtaining physical access, you can implement new security policies for tracking who has physical presence.
@@ -40,6 +44,23 @@ For planned scenarios, such as a known hardware or firmware upgrades, initiating
> [!TIP]
> Recovery is described within the context of unplanned or undesired behavior. However, recovery can also be caused as an intended production scenario, for example in order to manage access control. When devices are redeployed to other departments or employees in the organization, BitLocker can be forced into recovery before the device is delivered to a new user.
+## Windows RE and BitLocker recovery
+
+Windows Recovery Environment (Windows RE) can be used to recover access to a drive protected by BitLocker. If a device is unable to boot after two failures, *Startup Repair* starts automatically.
+
+When Startup Repair is launched automatically due to boot failures, it only executes operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. On devices that support specific TPM measurements for PCR[7], the TPM validates that Windows RE is a trusted operating environment and unlocks any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM is disabled, the drives stay locked until the BitLocker recovery key is provided. If Startup Repair can't run automatically, and instead Windows RE is manually started from a repair disk, then the BitLocker recovery key must be provided to unlock the BitLocker-protected drives.
+
+Windows RE will also ask for your BitLocker recovery key when you start a *Remove everything* reset from Windows RE on a device that uses the **TPM + PIN** or **Password for OS drive** protector. If you start BitLocker recovery on a keyboardless device with TPM-only protection, Windows RE, not the boot manager, will ask for the BitLocker recovery key. After you enter the key, you can access Windows RE troubleshooting tools or start Windows normally.
+
+The BitLocker recovery screen that's shown by Windows RE has the accessibility tools like narrator and on-screen keyboard to help you enter your BitLocker recovery key:
+
+- To activate the narrator during BitLocker recovery in Windows RE, press WIN + CTRL + Enter
+- To activate the on-screen keyboard, tap on a text input control
+
+:::image type="content" source="images/bl-narrator.png" alt-text="Screenshot of Windows RE and narrator.":::
+
+If the BitLocker recovery key is requested by the Windows boot manager, those tools might not be available.
+
## BitLocker recovery options
In a recovery scenario, the following options to restore access to the drive might be available, depending on the policy settings applied to the devices:
diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md
index dc6e715410..02b20cfc2d 100644
--- a/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md
+++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/configure.md
@@ -2,7 +2,7 @@
title: PDE settings and configuration
description: Learn about the available options to configure Personal Data Encryption (PDE) and how to configure them via Microsoft Intune or Configuration Service Providers (CSP).
ms.topic: how-to
-ms.date: 08/11/2023
+ms.date: 05/06/2024
---
# PDE settings and configuration
diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml
index 6d9ebee1ad..cc6278f590 100644
--- a/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml
+++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/faq.yml
@@ -4,7 +4,7 @@ metadata:
title: Frequently asked questions for Personal Data Encryption (PDE)
description: Answers to common questions regarding Personal Data Encryption (PDE).
ms.topic: faq
- ms.date: 08/11/2023
+ ms.date: 05/06/2024
title: Frequently asked questions for Personal Data Encryption (PDE)
summary: |
@@ -15,19 +15,19 @@ sections:
questions:
- question: Can PDE encrypt entire volumes or drives?
answer: |
- No. PDE only encrypts specified files and content.
+ No, PDE only encrypts specified files and content.
- question: How are files and content protected by PDE selected?
answer: |
[PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) are used to select which files and content are protected using PDE.
- question: Can users manually encrypt and decrypt files with PDE?
answer: |
- Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section [Decrypt PDE-encrypted content](configure.md#decrypt-pde-encrypted-content).
+ Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section [Decrypt PDE-encrypted content](configure.md#decrypt-pde-encrypted-content).
- question: Can PDE protected content be accessed after signing on via a Remote Desktop connection (RDP)?
answer: |
- No. Accessing PDE protected content over RDP isn't currently supported.
+ No, it's not supported to access PDE-protected content over RDP.
- question: Can PDE protected content be accessed via a network share?
answer: |
- No. PDE protected content can only be accessed after signing on locally to Windows with Windows Hello for Business credentials.
+ No, PDE protected content can only be accessed after signing on locally to Windows with Windows Hello for Business credentials.
- question: What encryption method and strength does PDE use?
answer: |
PDE uses AES-CBC with a 256-bit key to encrypt content.
@@ -39,13 +39,13 @@ sections:
During user sign-on, Windows Hello for Business unlocks the keys that PDE uses to protect content.
- question: If a user signs into Windows with a password instead of Windows Hello for Business, will they be able to access their PDE protected content?
answer: |
- No. The keys used by PDE to protect content are protected by Windows Hello for Business credentials and will only be unlocked when signing on with Windows Hello for Business PIN or biometrics.
+ No, the keys used by PDE to protect content are protected by Windows Hello for Business credentials and will only be unlocked when signing on with Windows Hello for Business PIN or biometrics.
- question: Can a file be protected with both PDE and EFS at the same time?
answer: |
- No. PDE and EFS are mutually exclusive.
+ No, PDE and EFS are mutually exclusive.
- question: Is PDE a replacement for BitLocker?
answer: |
- No. It's still recommended to encrypt all volumes with BitLocker Drive Encryption for increased security.
+ No, it's recommended to encrypt all volumes with BitLocker Drive Encryption for increased security.
- question: Do I need to use OneDrive in Microsoft 365 as my backup provider?
answer: |
- No. PDE doesn't have a requirement for a backup provider, including OneDrive in Microsoft 365. However, backups are recommended in case the keys used by PDE to protect files are lost. OneDrive in Microsoft 365 is a recommended backup provider.
+ No, PDE doesn't have a requirement for a backup provider, including OneDrive in Microsoft 365. However, backups are recommended in case the keys used by PDE to protect files are lost. OneDrive in Microsoft 365 is a recommended backup provider.
diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md
index 14df705407..f0f3e1f99f 100644
--- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md
+++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md
@@ -2,7 +2,7 @@
title: Personal Data Encryption (PDE)
description: Personal Data Encryption unlocks user encrypted files at user sign-in instead of at boot.
ms.topic: how-to
-ms.date: 08/11/2023
+ms.date: 05/06/2024
---
# Personal Data Encryption (PDE)
diff --git a/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
index d87edf7174..c2a7ae57a8 100644
--- a/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
+++ b/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
@@ -1,7 +1,7 @@
---
title: How to configure cryptographic settings for IKEv2 VPN connections
description: Learn how to update the IKEv2 cryptographic settings of VPN servers and clients by running VPN cmdlets to secure connections.
-ms.date: 08/03/2023
+ms.date: 05/06/2024
ms.topic: how-to
---
@@ -9,11 +9,11 @@ ms.topic: how-to
In IKEv2 VPN connections, the default setting for IKEv2 cryptographic settings are:
-- Encryption Algorithm: DES3
-- Integrity, Hash Algorithm: SHA1
+- Encryption Algorithm: DES3
+- Integrity, Hash Algorithm: SHA1
- Diffie Hellman Group (Key Size): DH2
-These settings aren't secure for IKE exchanges.
+These settings aren't secure for IKE exchanges.
To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets.
@@ -42,27 +42,27 @@ Set-VpnConnectionIPsecConfiguration -ConnectionName