From 9178e4ce729b15b09e800c8c4e43e737fe806cc6 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 10 May 2019 09:52:59 -0700 Subject: [PATCH 001/143] Added 19H1 new policy doc and policy --- .../policy-configuration-service-provider.md | 9 ++ .../mdm/policy-csp-servicecontrolmanager.md | 115 ++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-servicecontrolmanager.md diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a27926a537..58bba60460 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2927,6 +2927,13 @@ The following diagram shows the Policy configuration service provider in tree fo +### ServiceControlManager policies +
+
+ ServiceControlManager/SvchostProcessMitigation +
+
+ ### Settings policies
@@ -4112,6 +4119,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) - [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) - [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) - [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) - [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) - [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) @@ -4833,6 +4841,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) - [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) - [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) - [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) - [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) - [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md new file mode 100644 index 0000000000..a2558d44fc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -0,0 +1,115 @@ +--- +title: Policy CSP - ServiceControlManager +description: Policy CSP - ServiceControlManager +ms.author: Heidi.Lohr +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: Heidilohr +ms.date: 05/10/2019 +--- + +# Policy CSP - ServiceControlManager + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
+ + +## ServiceControlManager policies + +
+
+ ServiceControlManager/SvchostProcessMitigation +
+
+ +
+ + +**ServiceControlManager/SvchostProcessMitigation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcheck mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting enables process mitigation options on svchost.exe processes. + +If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. + +This includes Microsoft to sign a policy requiring all binaries loaded on SVCHOST processes and a policy disallowing dynamically generated code. + +If you disable or do not configure this policy setting, the stricter security settings will not be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable svchost.exe mitigation options* +- GP name: *SvchostProcessMitigationEnable* +- GP path: *System/Service Control Manager Settings/Security Settings* +- GP ADMX file name: *ServiceControlManager.admx* + + + +Supported values: +- disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. +- enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. + + + + + + + + + + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file From 0698551ddba4bd99d3d06c7550a103103680f912 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Fri, 10 May 2019 12:52:08 -0500 Subject: [PATCH 002/143] Update hello-hybrid-key-trust-prereqs.md --- .../hello-hybrid-key-trust-prereqs.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 1993139da7..73a2919976 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -58,7 +58,20 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can use a 3rd Party enterprise certification authority too. The detailed requieriments for the Domain Controller certificate are shown below. + +* The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). +* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) +* The certificate Key Usage section must contain: +Digital Signature, Key Encipherment +* Optionally, the certificate Basic Constraints section should contain: +[Subject Type=End Entity, Path Length Constraint=None] +* The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) +* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. +* The certificate template must have an extension that has the BMP data value "DomainController." +* The domain controller certificate must be installed in the local computer's certificate store + + > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: From d51bdc2327b1e520721a2e53b33a06aadaa75113 Mon Sep 17 00:00:00 2001 From: illfated Date: Fri, 19 Apr 2019 16:45:28 +0200 Subject: [PATCH 003/143] Surface Hub: note for creating accounts using EAC According to user feedback, using the Exchange Admin Center to create Surface Hub device user accounts requires on-premises Active Directory to synchronize from, for that method to work. Closes #3295 --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index 2d52e698c0..7166019087 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -217,6 +217,8 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center +>[!NOTE] +>This method will only work if you have an on-premises Active Directory that you are syncing from. You can use the Exchange Admin Center to create a device account: From d42a7b0c3b97ca0c8f40495219e917f95e764845 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:57:49 -0500 Subject: [PATCH 004/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 73a2919976..2e9bd1375c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -58,7 +58,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can use a 3rd Party enterprise certification authority too. The detailed requieriments for the Domain Controller certificate are shown below. +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. * The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) From 250089d828d765c881cb41693a911bf249907ea8 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:58:41 -0500 Subject: [PATCH 005/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 2e9bd1375c..cfa4d2724c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -60,7 +60,7 @@ Key trust deployments do not need client issued certificates for on-premises aut The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. -* The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). +* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) * The certificate Key Usage section must contain: Digital Signature, Key Encipherment From 70f35d9b556ca77586782b3fa234d89b59e7ebee Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:59:11 -0500 Subject: [PATCH 006/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index cfa4d2724c..8e2a006a40 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -61,7 +61,7 @@ Key trust deployments do not need client issued certificates for on-premises aut The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. -* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) +* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain: Digital Signature, Key Encipherment * Optionally, the certificate Basic Constraints section should contain: From 6f1af988debf6ac45f39b9d2dd82f20f68fad894 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:59:46 -0500 Subject: [PATCH 007/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 8e2a006a40..fa127fbc9c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -63,7 +63,6 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain: -Digital Signature, Key Encipherment * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) From 479a1ff8734f6d075d3ef75328f6d9013145d24b Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:13 -0500 Subject: [PATCH 008/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index fa127fbc9c..5255ad8eec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -62,7 +62,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). -* The certificate Key Usage section must contain: +* The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) From 72371c8e34b8d360a8036c9f662f20da9f9debe2 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:31 -0500 Subject: [PATCH 009/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 5255ad8eec..dfe1bdb31d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -65,7 +65,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] -* The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) +* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController." * The domain controller certificate must be installed in the local computer's certificate store From 6f42299166ef7a8eb90d449098abd5fd088c077a Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:54 -0500 Subject: [PATCH 010/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index dfe1bdb31d..c6ad8bf880 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -64,7 +64,6 @@ The minimum required enterprise certificate authority that can be used with Wind * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: -[Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController." From dca438d5b4f8cbf5c36ad1d1d5085956a2a00dd4 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:01:09 -0500 Subject: [PATCH 011/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index c6ad8bf880..86afa736bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -66,7 +66,7 @@ The minimum required enterprise certificate authority that can be used with Wind * Optionally, the certificate Basic Constraints section should contain: * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the BMP data value "DomainController." +* The certificate template must have an extension that has the BMP data value "DomainController". * The domain controller certificate must be installed in the local computer's certificate store From 3aa10bc1504fdadd15316df6265672b3d99120bb Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:01:35 -0500 Subject: [PATCH 012/143] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 86afa736bf..9b3432c015 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -67,7 +67,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController". -* The domain controller certificate must be installed in the local computer's certificate store +* The domain controller certificate must be installed in the local computer's certificate store. From 5f13583ff5b73766b3cf8ae44a172f4cf1b48936 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Tue, 14 May 2019 10:44:54 -0500 Subject: [PATCH 013/143] Update user-roles-windows-defender-advanced-threat-protection.md --- ...-roles-windows-defender-advanced-threat-protection.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md index ab60042a21..c68c954776 100644 --- a/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md @@ -59,6 +59,10 @@ The following steps guide you on how to create roles in Windows Defender Securit After creating roles, you'll need to create a machine group and provide access to the machine group by assigning it to a role that you just created. +>[!NOTE] +>The Windows Defender ATP administrator (default) role has administrator permissions. The administrator permissions cannot be assigned >to any other role. On>groups assigned the Windows Defender ATP administrator role have access to all machine groups. + + ## Edit roles 1. Select the role you'd like to edit. @@ -76,6 +80,7 @@ After creating roles, you'll need to create a machine group and provide access t 2. Click the drop-down button and select **Delete role**. -##Related topic + +## Related topic - [User basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md) -- [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) From 9d4c6f334383da0079c3ca9ac277acbb521a3600 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Tue, 14 May 2019 10:49:36 -0500 Subject: [PATCH 014/143] Update user-roles-windows-defender-advanced-threat-protection.md --- .../user-roles-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md index c68c954776..70a52291c3 100644 --- a/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md @@ -60,7 +60,7 @@ After creating roles, you'll need to create a machine group and provide access t >[!NOTE] ->The Windows Defender ATP administrator (default) role has administrator permissions. The administrator permissions cannot be assigned >to any other role. On>groups assigned the Windows Defender ATP administrator role have access to all machine groups. +>The Windows Defender ATP administrator (default) role has administrator permissions. The administrator permissions cannot be assigned to any other role. On groups assigned the Windows Defender ATP administrator role have access to all machine groups. ## Edit roles From 111800e5bd586ad579d72d28a7bba9c9b36fce22 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 15 May 2019 10:19:09 +0500 Subject: [PATCH 015/143] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 32055b2546..957c81811a 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -57,12 +57,15 @@ This section covers requirements for each feature in Windows Defender EG. | ![supported](./images/ball_50.png) | Supported | | ![supported, full reporting](./images/ball_full.png) | Recommended. Includes full, automated reporting into the Windows Defender ATP console. Provides additional cloud-powered capabilities, including the Network protection ability to block apps from accessing low-reputation websites and an attack surface reduction rule that blocks executable files that meet age or prevalence criteria.| -| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 E3 | Windows 10 E5 | -| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | -| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 Enterprise | Windows 10 with Enterprise E3 subscription | Windows 10 with Enterprise E5 subscription | +| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | :--------------------------------------: | +| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | + +>[!NOTE] +> [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From 3586e4e66216238a436bd3ec69076f9ecbe91c98 Mon Sep 17 00:00:00 2001 From: Marcus <49599477+h3xmarcux@users.noreply.github.com> Date: Wed, 15 May 2019 15:18:46 +0100 Subject: [PATCH 016/143] Update advanced-security-auditing-faq.md --- .../auditing/advanced-security-auditing-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index 6935b85eb1..3d4c6fe39a 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -83,7 +83,7 @@ The rules that govern how Group Policy settings are applied propagate to the sub | - | - | - | -| | Detailed File Share Auditing | Success | Failure | Success | | Process Creation Auditing | Disabled | Success | Disabled | -| Logon Auditing | Success | Failure | Failure | +| Logon Auditing | Success | Failure | Success | ## What is the difference between an object DACL and an object SACL? From 13d8ad3af499a258e2f748ec71c252ff43d7fe04 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Wed, 15 May 2019 17:29:56 -0500 Subject: [PATCH 017/143] Do a Reboot for Restart the PC. --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 11f72817b6..69de4938f5 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -769,7 +769,7 @@ To remove the News app: -or- >[!IMPORTANT] -> If you have any issues with these commands, do a system reboot and try the scripts again. +> If you have any issues with these commands, restart the PC and try the scripts again. > - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** From e5b83dc638fe50dc32fae1d283465bccf11e789e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Thu, 16 May 2019 02:56:41 +0200 Subject: [PATCH 018/143] Update devices/surface-hub/create-a-device-account-using-office-365.md Pragmatic grammar change. --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index 7166019087..d1fbebaa56 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -218,7 +218,7 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center >[!NOTE] ->This method will only work if you have an on-premises Active Directory that you are syncing from. +> This method will only work if you are syncing from an on-premises Active Directory. You can use the Exchange Admin Center to create a device account: From 73c4c68274a2c4b7c52884ab29e822febd5b4534 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 16 May 2019 10:28:13 +0500 Subject: [PATCH 019/143] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 957c81811a..da228553fc 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -65,7 +65,7 @@ This section covers requirements for each feature in Windows Defender EG. | Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | >[!NOTE] -> [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. +> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From ad020077ac6c17a8f95057765b4a4e413e7a14e5 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Thu, 16 May 2019 01:22:04 -0500 Subject: [PATCH 020/143] Resolving ISsue#915 --- .../whats-new-windows-10-version-1803.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index a4846edc0d..359a0c2ae5 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -22,11 +22,8 @@ This article lists new and updated features and content that are of interest to The following 3-minute video summarizes some of the new features that are available for IT Pros in this release. -  - > [!video https://www.microsoft.com/en-us/videoplayer/embed/RE21ada?autoplay=false] - ## Deployment ### Windows Autopilot @@ -135,7 +132,7 @@ Portions of the work done during the offline phases of a Windows update have bee ### Co-management -Intune and System Center Configuration Manager policies have been added to enable hybrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. +**Intune** and **System Center Configuration Manager** policies have been added to enable hybrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. For more information, see [What's New in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1803) @@ -231,8 +228,12 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
-[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
+[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. + +[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. + +[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. + [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. + From 590ba2a7ecfa171d0dd4abb8dac043d09680fdc7 Mon Sep 17 00:00:00 2001 From: alexander7567 <1144391+alexander7567@users.noreply.github.com> Date: Thu, 16 May 2019 10:16:53 -0400 Subject: [PATCH 021/143] Fixed missing colon in path Fixed missing colon in path --- .../client-management/advanced-troubleshooting-boot-problems.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 101ca103bc..b80840d43d 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -385,6 +385,6 @@ If the dump file shows an error that is related to a driver (for example, window 1. Start WinRE, and open a Command Prompt window. 2. Start a text editor, such as Notepad. - 3. Navigate to C\Windows\System32\Config\. + 3. Navigate to C:\Windows\System32\Config\. 4. Rename the all five hives by appending ".old" to the name. 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. From 3279e783ff5721e26416fe24157a90498403d8cf Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:29 -0500 Subject: [PATCH 022/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 359a0c2ae5..b0aa87146e 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -228,7 +228,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. +- [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. From 7e3c471554b2d1cbb176262bb34acdc35d2846e7 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:42 -0500 Subject: [PATCH 023/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index b0aa87146e..4976aba0c4 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -229,7 +229,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. - [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. From c307294550eaf40eb189a8a73f2679bfc725dcfa Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:49 -0500 Subject: [PATCH 024/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 4976aba0c4..b303d7d580 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -230,7 +230,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 0557f502a02d9a9a7293b12f82d483ee7577396c Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:57 -0500 Subject: [PATCH 025/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index b303d7d580..8ff528af58 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -231,7 +231,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 66d8ae4a07ab0f86234bf97985d834aec332f5ce Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:06 -0500 Subject: [PATCH 026/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 8ff528af58..0f56c2a037 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -231,6 +231,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. -[Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. +- [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 800d7f46112996a0c0fd85910340ff7801ac283d Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:16 -0500 Subject: [PATCH 027/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 0f56c2a037..edf483eab6 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -230,7 +230,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. -[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. +- [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 60cf9d4e55b19e1f158a115337ec8a175686c28d Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:42 -0500 Subject: [PATCH 028/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index edf483eab6..220d35e86c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -229,7 +229,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. +- [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From c5ae6b310f7d669c18483802fb3b6c7c49477343 Mon Sep 17 00:00:00 2001 From: John Rajunas Date: Thu, 16 May 2019 12:49:20 -0400 Subject: [PATCH 029/143] Change "Windows Management Instruction" Proposing the correct the phrase "Windows Management Instruction" to "Windows Management Instrumentation" to more accurately reflect the proper meaning of the acronym WMI in this context, and to match the rest of the topic's use of "WMI". --- ...iguration-management-reference-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index 901c6c4995..471d647e37 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -26,7 +26,7 @@ You can manage and configure Windows Defender Antivirus with the following tools - System Center Configuration Manager - Group Policy - PowerShell cmdlets -- Windows Management Instruction (WMI) +- Windows Management Instrumentation (WMI) - The mpcmdrun.exe utility The topics in this section provide further information, links, and resources for using these tools to manage and configure Windows Defender Antivirus. From 9fd74e4aa21426c7eb7e9a542a159135e97319fc Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Fri, 17 May 2019 12:00:30 +0500 Subject: [PATCH 030/143] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index da228553fc..45b1954386 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -65,7 +65,7 @@ This section covers requirements for each feature in Windows Defender EG. | Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | >[!NOTE] -> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. +> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as the Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From 707ecda1ab12f0a332e02544480c4c6973030bf5 Mon Sep 17 00:00:00 2001 From: illfated Date: Fri, 17 May 2019 10:32:39 +0200 Subject: [PATCH 031/143] Update hello-how-it-works-technology.md (TPM section) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - replace 3 occurrences of the character `�` with a normal No-Break Space character (ASCII 32) - remove 13 redundant blank lines at the end of the document (redundant whitespace) --- .../hello-how-it-works-technology.md | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 99026497a4..c8fbed37c7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -284,9 +284,9 @@ A TPM implements controls that meet the specification described by the Trusted C - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. -Windows�10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). +Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). -Windows�10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows�10 supports only TPM 2.0. +Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 provides a major revision to the capabilities over TPM 1.2: @@ -316,16 +316,3 @@ In a simplified manner, the TPM is a passive component with limited resources. I [Return to Top](hello-how-it-works-technology.md) - - - - - - - - - - - - - From 959f88dbd27966614e2401cbea3fdfec98a035b0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 12:50:09 -0700 Subject: [PATCH 032/143] Updated SKU --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index a2558d44fc..ec32296079 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -44,7 +44,7 @@ ms.date: 05/10/2019 cross mark - cross mark + check mark6 check mark6 check mark6 check mark6 From 5480ba46fe2edcc6eac8281bb918b6a8e805eeda Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 14:52:36 -0700 Subject: [PATCH 033/143] Update SKU --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index ec32296079..a2558d44fc 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -44,7 +44,7 @@ ms.date: 05/10/2019 cross mark - check mark6 + cross mark check mark6 check mark6 check mark6 From 7e5a521e9daf4492560ad8268a507d2d0679214a Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 15:21:38 -0700 Subject: [PATCH 034/143] Added dev comment --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index a2558d44fc..b879cef048 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -68,7 +68,7 @@ This policy setting enables process mitigation options on svchost.exe processes. If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. -This includes Microsoft to sign a policy requiring all binaries loaded on SVCHOST processes and a policy disallowing dynamically generated code. +This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code. If you disable or do not configure this policy setting, the stricter security settings will not be applied. From 53276bd754ae0d5f1f909ba551a85c4465ba20e6 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 20 May 2019 10:25:10 +0500 Subject: [PATCH 035/143] update windows-10-enterprise-subscription-activation.md --- .../deployment/windows-10-enterprise-subscription-activation.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index e57c8a14cc..50cda76821 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -154,6 +154,8 @@ changepk.exe /ProductKey %ProductKey% ) +If no firmware-embedded Windows 10 activation key presents, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. + ### Obtaining an Azure AD licence Enterprise Agreement/Software Assurance (EA/SA): From 5735cae0863cd1e12057dca75e78c8d0e0b73922 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Mon, 20 May 2019 01:12:37 -0500 Subject: [PATCH 036/143] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 220d35e86c..a7a77b4172 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -233,4 +233,3 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. - From 5f0e08d058c5b5a3c57452fc4c93bbdf5185b69d Mon Sep 17 00:00:00 2001 From: illfated Date: Mon, 20 May 2019 18:57:44 +0200 Subject: [PATCH 037/143] Remove space between indent marker and text - (keeping the current code style unchanged) --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index d1fbebaa56..85be497437 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -218,7 +218,7 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center >[!NOTE] -> This method will only work if you are syncing from an on-premises Active Directory. +>This method will only work if you are syncing from an on-premises Active Directory. You can use the Exchange Admin Center to create a device account: From a70188b625a202ea1278655d6108d17e2ea056f9 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 14:14:51 -0700 Subject: [PATCH 038/143] Added "Win10 & Priv. compliance" article Added new article "Windows 10 & Priv. Compliance" and edited TOC. --- windows/privacy/TOC.md | 1 + .../windows-10-and-privacy-compliance.md | 208 ++++++++++++++++++ 2 files changed, 209 insertions(+) create mode 100644 windows/privacy/windows-10-and-privacy-compliance.md diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md index 35561d07af..0ce986219f 100644 --- a/windows/privacy/TOC.md +++ b/windows/privacy/TOC.md @@ -1,6 +1,7 @@ # [Privacy](index.yml) ## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md) ## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) +## [Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals](Windows-10-and-privacy-compliance.md) ## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md) ## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) ## Diagnostic Data Viewer diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md new file mode 100644 index 0000000000..ceedc90f13 --- /dev/null +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -0,0 +1,208 @@ +--- +description: This article provides information to help IT and compliance professionals understand the personal data policies as related to Windows 10. +title: Windows 10 & Privacy Compliance - A Guide for IT and Compliance Professionals +keywords: privacy, GDPR, compliance +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +audience: ITPro +author: brianlic-msft +ms.author: brianlic +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 05/21/2019 +--- + +# Windows 10 & Privacy Compliance:
A Guide for IT and Compliance Professionals + +Applies to: +- Windows 10, version 1809 +- Windows 10, version 1803 +- Windows 10, version 1709 +- Windows 10, version 1703 +- Windows 10 Team Edition, version 1703 for Surface Hub +- Windows Server 2019 +- Windows Server 2016 +- Windows Analytics + +For more information about the GDPR, see: +* [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) +* [Microsoft GDPR Overview](https://aka.ms/GDPROverview) +* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq) +* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp) +* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted) + +## Overview + +At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide IT and compliance professionals with data privacy considerations for Windows 10. + +Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls and support for data subject requests, all of which are detailed in this guide. + +This information allows IT and compliance professionals work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR). + + +## 1. Windows 10 data collection transparency + +Transparency is an important part of the data collection process in Windows 10. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up. + +If interested in understanding how to manage settings related to data collection skip to the next section [Windows 10 data collection management](#12-data-collection-monitoring). + + +### 1.1 Device set up experience and support for layered transparency + +When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used and how to manage the setting after the device setup is complete. The user can also review the privacy statement when connected to the network during this portion of setup. A brief overview of the set up experience for privacy settings are described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97). + +The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. + +> [!NOTE] +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Window 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). + +> [!div class="mx-tdBreakAll"] +> | Feature/Setting | Description | Supporting Content | Privacy Statement | +> |---|---|---|---| +> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configuring diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +> | Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +> | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | +> | Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +> | Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +> | Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +> | Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | +> | Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/en-us/privacystatement#mainactivityhistorymodule) | +> | Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | + +### 1.2 Data collection monitoring + +The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides information on how users can get started on using this tool. + +An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer) provides further information. + + +## 2. Windows 10 data collection management + +Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start** > **Settings** > **Privacy**). The organization can also manage the privacy settings using group policy or mobile device management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article. + +### 2.1 Privacy setting options for users + +Once a Windows 10 device is set up, a user can manage data collection settings by going to **Start** > **Settings** > **Privacy**. IT administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to **Start** > **Settings** > **Privacy**. Meaning the user can only change settings in accordance with the policies that the administrator has applied to the device. + +### 2.2 Privacy setting controls for administrators + +The IT department can configure and control privacy settings across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings. + +The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. + +> [!NOTE] +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from Windows operating system components to Microsoft services. + +> [!div class="mx-tdBreakAll"] +> | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | +> |---|---|---|---| +> | [Speech](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +> | [Location](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +> | [Find my device](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | +> | [Diagnostic Data](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | +> | [Inking and typing diagnostics](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +> | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | +> | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | +> | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | +> | [Cortana](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | + +### 2.3 Guidance for configuration options + +This section provides general details and links to more detailed information as well as instructions for IT administrators and compliance professional. These instructions allow IT admins and compliance pros to manage the device compliance. This information includes details about setting up a device, to configuring the device’s settings after setup is completed to minimize data collected and drive privacy related user experiences. + +#### 2.3.1 Managing the device setup experience + +Windows deployment can be configured using several different methods, which provide an administrator with options to control: how a device is set up, what’s enabled by default, and what the user is able to change on the system after they log on. + +The [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment/) section of the Windows IT Pro Center provides an overview of the different options. + +#### 2.3.2 Managing connections from Windows components to Microsoft services + +IT administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by these Windows components. + +See [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) for more details, including the different methods available on how to configure each setting, the impact to functionality and which versions of Windows that are applicable. + +#### 2.3.3 Managing Windows 10 connections + +Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization. + +[Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu. + +#### 2.3.4 Limited functionality baseline + +An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. + +#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon + +Windows 10, version 1803, and later provides users with a notification during sign in about changes to the diagnostic data level on the device so they are aware of any changes where additional data may be collected. For instance, if the diagnostic level on the device is set to Basic and an administrator changes it to Full, users will be notified when they next sign in. The IT administrator can disable these notifications by setting Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. + +#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting + +Windows 10, version 1803 and later, allows users to change their diagnostic data level to a lower setting than what their IT administrator has set. For instance, if the administrator has set the diagnostic data level to Enhanced or Full, a user can change the setting to Basic by going into **Settings** > **Privacy** > **Diagnostic & feedback**. The administrator can disable the user ability to change the setting via **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. + +#### 2.3.7 Diagnostic data: Managing device-based data delete + +Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [`Clear-WindowsDiagnosticData`](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. + +An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. + + +## 3. The process for exercising data subject rights + +This section discusses the different methods Microsoft provides for users and IT administrators to exercise data subject rights for data collected from a Windows 10 device. + +### 3.1 Delete + +Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [`Clear-WindowsDiagnosticData`](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. + +### 3.2 View + +The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/en-us/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. + +### 3.3 Export + +The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/en-us/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. + +### 3.4 Devices connected to a Microsoft account + +If a user signs in to a Windows experience or app on their device with their Microsoft account (MSA), they can view, delete, and export data associated with their MSA on the [Privacy dashboard](https://account.microsoft.com/privacy). + + +## 4. Cross-border data transfers + +Microsoft complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States. + +Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data. + + +## 5. Related Windows product considerations + +The following sections provide details about how privacy data is collected and managed across related Windows products. + +### 5.1 Windows Server 2016 and 2019 + +Windows Server follows the same mechanisms as Windows 10 for handling of personal data. There are some differences regarding [diagnostic default settings for Windows Server](https://microsoft-my.sharepoint.com/personal/v-colinm_microsoft_com/Documents/WINDOWS%20PRIVACY/Windows%20diagnostic%20data%20and%20Windows%20Server). + +### 5.2 Surface Hub + +Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. + +For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](https://docs.microsoft.com/en-us/windows/privacy/gdpr-it-guidance#windows-10-team-edition-version-1703-for-surface-hub). + +### 5.3 Windows 10 Analytics + +[Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: Device Health, Update Compliance, and Upgrade Readiness. Windows Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. + +For more details, see the [Windows Analytics overview page](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview). + + +## Additional Resources + +[Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) +[Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/en-us/TrustCenter/Privacy/privacy-overview) +[Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) + From 616492a42db7788b20b9bb3c13a57ec5614bb823 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 14:43:53 -0700 Subject: [PATCH 039/143] Update windows-10-and-privacy-compliance.md Addressed initial feedback from Brian --- .../privacy/windows-10-and-privacy-compliance.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index ceedc90f13..0340891fac 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -19,6 +19,7 @@ ms.date: 05/21/2019 # Windows 10 & Privacy Compliance:
A Guide for IT and Compliance Professionals Applies to: +- Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 @@ -58,12 +59,12 @@ When setting up a device, a user can configure their privacy settings. Those pri The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Window 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). > [!div class="mx-tdBreakAll"] > | Feature/Setting | Description | Supporting Content | Privacy Statement | > |---|---|---|---| -> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configuring diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | > | Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | @@ -95,7 +96,7 @@ The IT department can configure and control privacy settings across their organi The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from Windows operating system components to Microsoft services. +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). > [!div class="mx-tdBreakAll"] > | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | @@ -202,7 +203,7 @@ For more details, see the [Windows Analytics overview page](https://docs.microso ## Additional Resources -[Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) -[Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/en-us/TrustCenter/Privacy/privacy-overview) -[Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) +* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) +* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/en-us/TrustCenter/Privacy/privacy-overview) +* [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) From f1ea2a7e1106ebec377a172200866ebe3dcd98cc Mon Sep 17 00:00:00 2001 From: jaimeo Date: Mon, 20 May 2019 14:59:53 -0700 Subject: [PATCH 040/143] adding new stuff for 19H1 --- .../waas-delivery-optimization-setup.md | 31 ++++++++++++++++++- .../update/waas-delivery-optimization.md | 11 +++++-- 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index e846ff795e..fafd11bdde 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -48,7 +48,7 @@ Quick-reference table: For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. -[//]: # (is there a topic on GroupIDSrc we can link to?) + To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. @@ -113,6 +113,13 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** | BytesfromHTTP | Total number of bytes received over HTTP | | DownloadDuration | Total download time in seconds | | Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | +| NumPeers | Indicates the total number of peers returned from the service. | +| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | +| ExpireOn | The target expiration date and time for the file. | +| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | + + +   @@ -133,6 +140,28 @@ Using the `-Verbose` option returns additional information: - Average number of peer connections per download  +**Starting in Windows 10, version 1903:** + +`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time. + +`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache. + +You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3. + +`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation. + +`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are rreached. The file is included in the cache quota calculation. + +`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet: + +- `-FileID` specifies a particular file to delete. +- `-IncludePinnedFiles` deletes all files that are pinned. +- `-Force` deletes the cache with no prompts. + +`get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. + + + **Starting in Windows 10, version 1803:** `Get-DeliveryOptimizationLog [-Path ] [-Flush]` diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 765547a61f..d10ada6ff6 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -53,7 +53,9 @@ The following table lists the minimum Windows 10 version that supports Delivery | Win32 apps for Intune | 1709 | | SCCM Express Updates | 1709 + Configuration Manager version 1711 | -[//]: # (**Network requirements**) +### Network requirements + +{can you share with me what the network requirements are?} @@ -72,7 +74,9 @@ You can use Group Policy or an MDM solution like Intune to configure Delivery Op You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. -[//]: # (Starting with Windows Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see {LINK}.) +Starting with Windows Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) + +**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. ## Reference @@ -110,6 +114,9 @@ For the payloads (optional): **Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. +**What data does Delivery Optimization send to its service?** +{you've got that big table at the OSGwiki--do you want all that to be published?} + ## Troubleshooting This section summarizes common problems and some solutions to try. From 54d8bdded1b48ef7b6ee730566d8e5c071b4e58c Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 15:17:56 -0700 Subject: [PATCH 041/143] Update windows-10-and-privacy-compliance.md Removed locale from target URLs. Woops. (;<_<) --- .../windows-10-and-privacy-compliance.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 0340891fac..1d1af4f5c7 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -71,7 +71,7 @@ The following table provides an overview of the Windows 10 privacy settings pres > | Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | > | Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | -> | Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/en-us/privacystatement#mainactivityhistorymodule) | +> | Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | > | Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | ### 1.2 Data collection monitoring @@ -96,16 +96,16 @@ The IT department can configure and control privacy settings across their organi The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). > [!div class="mx-tdBreakAll"] > | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | > |---|---|---|---| -> | [Speech](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -> | [Location](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | -> | [Find my device](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -> | [Diagnostic Data](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | -> | [Inking and typing diagnostics](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +> | [Speech](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +> | [Location](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +> | [Find my device](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | +> | [Diagnostic Data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | +> | [Inking and typing diagnostics](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | > | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | > | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | > | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | @@ -162,11 +162,11 @@ Users can delete their device-based data by going to **Settings** > **Privacy** ### 3.2 View -The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/en-us/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.3 Export -The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/en-us/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.4 Devices connected to a Microsoft account @@ -192,7 +192,7 @@ Windows Server follows the same mechanisms as Windows 10 for handling of persona Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. -For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](https://docs.microsoft.com/en-us/windows/privacy/gdpr-it-guidance#windows-10-team-edition-version-1703-for-surface-hub). +For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance#windows-10-team-edition-version-1703-for-surface-hub). ### 5.3 Windows 10 Analytics @@ -204,6 +204,6 @@ For more details, see the [Windows Analytics overview page](https://docs.microso ## Additional Resources * [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) -* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/en-us/TrustCenter/Privacy/privacy-overview) +* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/TrustCenter/Privacy/privacy-overview) * [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) From 3c091ade9db52942a737910992c9b5449137ac46 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 15:25:03 -0700 Subject: [PATCH 042/143] Update windows-10-and-privacy-compliance.md More work on table formatting. Hopefully, this will fix the ugly line breaks. --- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 1d1af4f5c7..005045c2fa 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -61,7 +61,7 @@ The following table provides an overview of the Windows 10 privacy settings pres > [!NOTE] > This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). -> [!div class="mx-tdBreakAll"] +> [!div class="mx-tdCol2BreakAll"] > | Feature/Setting | Description | Supporting Content | Privacy Statement | > |---|---|---|---| > | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | @@ -98,7 +98,7 @@ The following table provides an overview of the privacy settings discussed earli > [!NOTE] > This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). -> [!div class="mx-tdBreakAll"] +> [!div class="mx-tdCol2BreakAll"] > | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | > |---|---|---|---| > | [Speech](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | From 3e82cc6837837a75c70e89fdec48f073515714ff Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 15:46:41 -0700 Subject: [PATCH 043/143] Update windows-10-and-privacy-compliance.md Changed links with absolute URLs to relative URLs where they seemed appropriate. Still trying to get the tables fixed, too. (;<_<) --- .../windows-10-and-privacy-compliance.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 005045c2fa..eb3cff64f6 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -59,12 +59,12 @@ When setting up a device, a user can configure their privacy settings. Those pri The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -> [!div class="mx-tdCol2BreakAll"] +> [!div class="mx-tdBreakAll"] > | Feature/Setting | Description | Supporting Content | Privacy Statement | > |---|---|---|---| -> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | > | Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | @@ -76,9 +76,9 @@ The following table provides an overview of the Windows 10 privacy settings pres ### 1.2 Data collection monitoring -The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides information on how users can get started on using this tool. +The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](diagnostic-data-viewer-overview.md) provides information on how users can get started on using this tool. -An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer) provides further information. +An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. ## 2. Windows 10 data collection management @@ -96,20 +96,20 @@ The IT department can configure and control privacy settings across their organi The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -> [!div class="mx-tdCol2BreakAll"] +> [!div class="mx-tdBreakAll"] > | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | > |---|---|---|---| -> | [Speech](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -> | [Location](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | -> | [Find my device](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -> | [Diagnostic Data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | -> | [Inking and typing diagnostics](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +> | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech.md) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +> | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +> | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | +> | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization#enterprise-management.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | +> | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | > | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | > | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | > | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | -> | [Cortana](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | +> | [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | ### 2.3 Guidance for configuration options @@ -131,11 +131,11 @@ See [Manage connections from Windows operating system components to Microsoft se Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization. -[Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu. +[Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu. #### 2.3.4 Limited functionality baseline -An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. +An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. #### 2.3.5 Diagnostic data: Managing notifications for change of level at logon @@ -162,11 +162,11 @@ Users can delete their device-based data by going to **Settings** > **Privacy** ### 3.2 View -The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.3 Export -The [Diagnostic Data Viewer (DDV)](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](https://docs.microsoft.com/windows/privacy/microsoft-diagnosticdataviewer#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.4 Devices connected to a Microsoft account @@ -192,7 +192,7 @@ Windows Server follows the same mechanisms as Windows 10 for handling of persona Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. -For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance#windows-10-team-edition-version-1703-for-surface-hub). +For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](gdpr-it-guidance.md#windows-10-team-edition-version-1703-for-surface-hub). ### 5.3 Windows 10 Analytics From 7fbb9952ef22eddd97d8a3963ab3c69bab8df471 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 16:00:56 -0700 Subject: [PATCH 044/143] Update windows-10-and-privacy-compliance.md Fixed some broken URLs. --- windows/privacy/windows-10-and-privacy-compliance.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index eb3cff64f6..6204a5117d 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -101,10 +101,10 @@ The following table provides an overview of the privacy settings discussed earli > [!div class="mx-tdBreakAll"] > | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | > |---|---|---|---| -> | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-speech.md) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -> | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-location.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | -> | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services#find-my-device.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -> | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization#enterprise-management.md) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | +> | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +> | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +> | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | +> | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | > | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | > | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | > | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | From 7d331a563334c84d664e5a50317af272d9c7ed5d Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 16:12:02 -0700 Subject: [PATCH 045/143] Update windows-10-and-privacy-compliance.md Working on some link issues and still working on table formatting. --- windows/privacy/windows-10-and-privacy-compliance.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 6204a5117d..55699a05dc 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -63,7 +63,7 @@ The following table provides an overview of the Windows 10 privacy settings pres > [!div class="mx-tdBreakAll"] > | Feature/Setting | Description | Supporting Content | Privacy Statement | -> |---|---|---|---| +> | --- | --- | --- | --- | > | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | > | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | @@ -147,7 +147,7 @@ Windows 10, version 1803 and later, allows users to change their diagnostic data #### 2.3.7 Diagnostic data: Managing device-based data delete -Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [`Clear-WindowsDiagnosticData`](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the `[Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps)` PowerShell cmdlet script. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. From d850e91f80f1983e5b42fbcdb04ac7a9a9dd3dcb Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Mon, 20 May 2019 16:31:26 -0700 Subject: [PATCH 046/143] Update windows-10-and-privacy-compliance.md Another attempt to fix the table formatting. --- .../windows-10-and-privacy-compliance.md | 54 +++++++++---------- 1 file changed, 26 insertions(+), 28 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 55699a05dc..96a3b54258 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -61,18 +61,17 @@ The following table provides an overview of the Windows 10 privacy settings pres > [!NOTE] > This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -> [!div class="mx-tdBreakAll"] -> | Feature/Setting | Description | Supporting Content | Privacy Statement | -> | --- | --- | --- | --- | -> | Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -> | Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -> | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | -> | Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | -> | Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | -> | Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -> | Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | -> | Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | -> | Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | +| Feature/Setting | Description | Supporting Content | Privacy Statement | +| --- | --- | --- | --- | +| Diagnostic Data |

Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

Diagnostic data is categorized into four levels:

  • **Security**
    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
  • **Basic**
    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
  • **Enhanced**
    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
  • **Full**
    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | +| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +| Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | +| Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | +| Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | ### 1.2 Data collection monitoring @@ -98,18 +97,17 @@ The following table provides an overview of the privacy settings discussed earli > [!NOTE] > This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -> [!div class="mx-tdBreakAll"] -> | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | -> |---|---|---|---| -> | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -> | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | -> | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -> | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | -> | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | -> | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | -> | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | -> | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | -> | [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | +| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | +|---|---|---|---| +| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | +| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +| Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | +| Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | +| Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | +| [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | ### 2.3 Guidance for configuration options @@ -147,7 +145,7 @@ Windows 10, version 1803 and later, allows users to change their diagnostic data #### 2.3.7 Diagnostic data: Managing device-based data delete -Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the `[Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps)` PowerShell cmdlet script. +Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. @@ -158,15 +156,15 @@ This section discusses the different methods Microsoft provides for users and IT ### 3.1 Delete -Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [`Clear-WindowsDiagnosticData`](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. ### 3.2 View -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [`Get-DiagnosticData`](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.3 Export -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [`Get-DiagnosticData`](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.4 Devices connected to a Microsoft account From 2834d122b1ebb1b3688a5754f1f2e0bd9c5ec171 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Mon, 20 May 2019 21:22:41 -0500 Subject: [PATCH 047/143] Formating the whole Article tables and links. --- .../access-control/special-identities.md | 1028 ++++------------- 1 file changed, 193 insertions(+), 835 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 16e282f16f..b29d15b901 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -34,364 +34,153 @@ Although the special identity groups can be assigned rights and permissions to r For information about security groups and group scope, see [Active Directory Security Groups](active-directory-security-groups.md). -The special identity groups are described in the following tables. +The special identity groups are described in the following tables. -- [Anonymous Logon](#bkmk-anonymouslogon) +- [Anonymous Logon](#Anonymous-Logon) -- [Authenticated User](#bkmk-authenticateduser) +- [Authenticated User](#Authenticated-Users) -- [Batch](#bkmk-batch) +- [Batch](#batch) -- [Creator Group](#bkmk-creatorgroup) +- [Creator Group](#Creator-Group) -- [Creator Owner](#bkmk-creatorowner) +- [Creator Owner](#Creator-Owner) -- [Dialup](#bkmk-dialup) +- [Dialup](#Dialup) -- [Digest Authentication](#bkmk-digestauth) +- [Digest Authentication](#Digest-Authentication) -- [Enterprise Domain Controllers](#bkmk-entdcs) +- [Enterprise Domain Controllers](#Enterprise-Domain-Controllers) -- [Everyone](#bkmk-everyone) +- [Everyone](#everyone) -- [Interactive](#bkmk-interactive) +- [Interactive](#interactive) -- [Local Service](#bkmk-localservice) +- [Local Service](#local-service) -- [LocalSystem](#bkmk-localsystem) +- [LocalSystem](#LocalSystem) -- [Network](#bkmk-network) +- [Network](#network) -- [Network Service](#bkmk-networkservice) +- [Network Service](#Network-Service) -- [NTLM Authentication](#bkmk-ntlmauth) +- [NTLM Authentication](#NTLM-Authentication) -- [Other Organization](#bkmk-otherorganization) +- [Other Organization](#Other-Organization) -- [Principal Self](#bkmk-principalself) +- [Principal Self](#Principal-Self) -- [Remote Interactive Logon](#bkmk-remoteinteractivelogon) +- [Remote Interactive Logon](#Remote-Interactive-Logon) -- [Restricted](#bkmk-restrictedcode) +- [Restricted](#Restricted) -- [SChannel Authentication](#bkmk-schannelauth) +- [SChannel Authentication](#SChannel-Authentication) -- [Service](#bkmk-service) +- [Service](#Service) -- [Terminal Server User](#bkmk-terminalserveruser) +- [Terminal Server User](#Terminal-Server-User) -- [This Organization](#bkmk-thisorg) +- [This Organization](#This-Organization) -- [Window Manager\\Window Manager Group](#bkmk-windowmanager) +- [Window Manager\\Window Manager Group](#Window-Manager\\Window-Manager-Group) -## Anonymous Logon +## Anonymous Logon Any user who accesses the system through an anonymous logon has the Anonymous Logon identity. This identity allows anonymous access to resources, such as a web page that is published on corporate servers. The Anonymous Logon group is not a member of the Everyone group by default. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-7

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-7 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Authenticated Users +## Authenticated Users Any user who accesses the system through a sign-in process has the Authenticated Users identity. This identity allows access to shared resources within the domain, such as files in a shared folder that should be accessible to all the workers in the organization. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-11

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-11 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Batch +## Batch Any user or process that accesses the system as a batch job (or through the batch queue) has the Batch identity. This identity allows batch jobs to run scheduled tasks, such as a nightly cleanup job that deletes temporary files. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-3

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-3 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Group +## Creator Group The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder security identifier (SID) is created in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object’s current owner. The primary group is used only by the Portable Operating System Interface for UNIX (POSIX) subsystem. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-3-1

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Owner +## Creator Owner The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder SID is created in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object’s current owner. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-3-0

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Dialup +## Dialup Any user who accesses the system through a dial-up connection has the Dial-Up identity. This identity distinguishes dial-up users from other types of authenticated users. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-1

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Digest Authentication +## Digest Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-21

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-21 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Enterprise Domain Controllers +## Enterprise Domain Controllers This group includes all domain controllers in an Active Directory forest. Domain controllers with enterprise-wide roles and responsibilities have the Enterprise Domain Controllers identity. This identity allows them to perform certain tasks in the enterprise by using transitive trusts. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-9

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights Assignment

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-9 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight| -  - -## Everyone +## Everyone All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to system resources. Whenever a user logs on to the network, the user is automatically added to the Everyone group. @@ -400,615 +189,184 @@ On computers running Windows 2000 and earlier, the Everyone group included the Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-1-0

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-1-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Interactive +## Interactive Any user who is logged on to the local system has the Interactive identity. This identity allows only local users to access a resource. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is automatically added to the Interactive group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-4

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-4 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Local Service +## Local Service The Local Service account is similar to an Authenticated User account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session with anonymous credentials. The name of the account is NT AUTHORITY\\LocalService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-19

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default user rights

[Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege

-

[Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege

-

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-

[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-19 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege
[Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege
[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
| -  - -## LocalSystem +## LocalSystem This is a service account that is used by the operating system. The LocalSystem account is a powerful account that has full access to the system and acts as the computer on the network. If a service logs on to the LocalSystem account on a domain controller, that service has access to the entire domain. Some services are configured by default to log on to the LocalSystem account. Do not change the default service setting. The name of the account is LocalSystem. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-18

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

-  - -## Network +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-18 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| +## Network This group implicitly includes all users who are logged on through a network connection. Any user who accesses the system through a network has the Network identity. This identity allows only remote users to access a resource. Whenever a user accesses a given resource over the network, the user is automatically added to the Network group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-2

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-2 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Network Service +## Network Service The Network Service account is similar to an Authenticated User account. The Network Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources by using the credentials of the computer account. The name of the account is NT AUTHORITY\\NetworkService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-20

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-

[Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege

-

[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-20 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
[Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege
[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
| -  - -## NTLM Authentication +## NTLM Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-10

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Other Organization +## Other Organization This group implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-1000

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1000 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Principal Self +## Principal Self This identify is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-10

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Remote Interactive Logon +## Remote Interactive Logon This identity represents all users who are currently logged on to a computer by using a Remote Desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-14

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-14| +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Restricted +## Restricted Users and computers with restricted capabilities have the Restricted identity. This identity group is used by a process that is running in a restricted security context, such as running an application with the RunAs service. When code runs at the Restricted security level, the Restricted SID is added to the user’s access token. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-12

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-12 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## SChannel Authentication +## SChannel Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-14

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-14 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Service +## Service Any service that accesses the system has the Service identity. This identity group includes all security principals that are signed in as a service. This identity grants access to processes that are being run by Windows Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-6

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-6 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
| -## Terminal Server User +## Terminal Server User Any user accessing the system through Terminal Services has the Terminal Server User identity. This identity allows users to access Terminal Server applications and to perform other necessary tasks with Terminal Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-13

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-13 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## This Organization +## This Organization - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-15

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-15 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  +## Window Manager\\Window Manager Group -## Window Manager\\Window Manager Group - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

Object Class

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | | +|Object Class| | +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege
| ## See also From be0035723c331177d8da1b6c830b7620ed83208d Mon Sep 17 00:00:00 2001 From: zhouyuZY <50821229+zhouyuZY@users.noreply.github.com> Date: Tue, 21 May 2019 13:13:48 +0800 Subject: [PATCH 048/143] Update set-up-enterprise-mode-portal.md In step 1, after the 6th point, the note is not in correct format. --- .../ie11-deploy-guide/set-up-enterprise-mode-portal.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md index c6c5cf099e..83ca5233e3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md @@ -45,8 +45,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all 6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution. - >[!Note] - >Step 3 of this topic provides the steps to create your database. + >[!Note] + >Step 3 of this topic provides the steps to create your database. 7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. From f5bbb87a938ba6457203617e5b806e8a5addf8ae Mon Sep 17 00:00:00 2001 From: Wolfgang Sauer <43094787+WolfgangSauer@users.noreply.github.com> Date: Tue, 21 May 2019 10:53:28 +0200 Subject: [PATCH 049/143] Update live-response.md corrected typo --- .../threat-protection/microsoft-defender-atp/live-response.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index aaab0a442a..5500639c55 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -107,7 +107,7 @@ help | Provides help information for live response commands. persistence | Shows all known persistence methods on the machine. processes | Shows all processes running on the machine. registry | Shows registry values. -sheduledtasks| Shows all scheduled tasks on the machine. +scheduledtasks| Shows all scheduled tasks on the machine. services | Shows all services on the machine. trace | Sets the terminal's logging mode to debug. From b3fcab0d4c650ad9a6d6b470978781e8c6255204 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 21 May 2019 14:46:06 +0500 Subject: [PATCH 050/143] update windows-10-enterprise-subscription-activation.md --- .../deployment/windows-10-enterprise-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index 50cda76821..0e718cbc92 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -154,7 +154,7 @@ changepk.exe /ProductKey %ProductKey% ) -If no firmware-embedded Windows 10 activation key presents, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. +If a firmware-embedded Windows 10 activation key is not present, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. ### Obtaining an Azure AD licence From 7dfcc6a36bd5bb7fc75dbb5b325e06c27ff543a2 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Tue, 21 May 2019 10:41:17 -0500 Subject: [PATCH 051/143] : by . Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/access-control/special-identities.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index b29d15b901..670f831be0 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -34,7 +34,7 @@ Although the special identity groups can be assigned rights and permissions to r For information about security groups and group scope, see [Active Directory Security Groups](active-directory-security-groups.md). -The special identity groups are described in the following tables. +The special identity groups are described in the following tables: - [Anonymous Logon](#Anonymous-Logon) @@ -374,4 +374,4 @@ Any user accessing the system through Terminal Services has the Terminal Server - [Security Principals](security-principals.md) -- [Access Control Overview](access-control.md) \ No newline at end of file +- [Access Control Overview](access-control.md) From fd182b03c474f94d7c4e4532c113b1ac170e1c69 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Tue, 21 May 2019 09:02:27 -0700 Subject: [PATCH 052/143] Update windows-10-and-privacy-compliance.md Trying to fix some broken links --- windows/privacy/windows-10-and-privacy-compliance.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 96a3b54258..e584b41c27 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -99,15 +99,15 @@ The following table provides an overview of the privacy settings discussed earli | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| -| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#186-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#182-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | -| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1821-inking-&-typing) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | -| [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | +| [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#2-cortana-and-search) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | ### 2.3 Guidance for configuration options From e7512c79c55982879ba83b9b90f510bedaaef475 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Tue, 21 May 2019 09:40:56 -0700 Subject: [PATCH 053/143] Update windows-10-and-privacy-compliance.md More work on fixing broken links. --- windows/privacy/windows-10-and-privacy-compliance.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index e584b41c27..2583fffda5 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -99,11 +99,11 @@ The following table provides an overview of the privacy settings discussed earli | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| -| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#186-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#182-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | +| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | | [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)

Server SKUs:
Enhanced | Security and block endpoints | -| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#1821-inking-&-typing) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | +| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: Link TBD | Off | Off | | Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | | Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | From 795220705d4d0e27b6c6b997641677f60e295c33 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 21 May 2019 12:23:12 -0500 Subject: [PATCH 054/143] Removing caps from links --- .../access-control/special-identities.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index b29d15b901..f30d62a674 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -36,21 +36,21 @@ For information about security groups and group scope, see [Active Directory Sec The special identity groups are described in the following tables. -- [Anonymous Logon](#Anonymous-Logon) +- [Anonymous Logon](#anonymous-logon) -- [Authenticated User](#Authenticated-Users) +- [Authenticated User](#authenticated-users) - [Batch](#batch) -- [Creator Group](#Creator-Group) +- [Creator Group](#creator-group) -- [Creator Owner](#Creator-Owner) +- [Creator Owner](#creator-owner) -- [Dialup](#Dialup) +- [Dialup](#dialup) -- [Digest Authentication](#Digest-Authentication) +- [Digest Authentication](#digest-authentication) -- [Enterprise Domain Controllers](#Enterprise-Domain-Controllers) +- [Enterprise Domain Controllers](#enterprise-domain-controllers) - [Everyone](#everyone) @@ -58,31 +58,31 @@ The special identity groups are described in the following tables. - [Local Service](#local-service) -- [LocalSystem](#LocalSystem) +- [LocalSystem](#localsystem) - [Network](#network) -- [Network Service](#Network-Service) +- [Network Service](#network-service) -- [NTLM Authentication](#NTLM-Authentication) +- [NTLM Authentication](#ntlm-authentication) -- [Other Organization](#Other-Organization) +- [Other Organization](#other-organization) -- [Principal Self](#Principal-Self) +- [Principal Self](#principal-self) -- [Remote Interactive Logon](#Remote-Interactive-Logon) +- [Remote Interactive Logon](#remote-interactive-logon) -- [Restricted](#Restricted) +- [Restricted](#restricted) -- [SChannel Authentication](#SChannel-Authentication) +- [SChannel Authentication](#schannel-authentication) -- [Service](#Service) +- [Service](#service) -- [Terminal Server User](#Terminal-Server-User) +- [Terminal Server User](#terminal-server-user) -- [This Organization](#This-Organization) +- [This Organization](#this-organization) -- [Window Manager\\Window Manager Group](#Window-Manager\\Window-Manager-Group) +- [Window Manager\\Window Manager Group](#window-manager\\window-manager-group) ## Anonymous Logon From 75772364e18b8bd4aac658cd8eb362969fc9d8fc Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 21 May 2019 14:10:24 -0500 Subject: [PATCH 055/143] Added a link into the Referenced Topics with the information required to a spreadsheed #884 --- windows/client-management/new-policies-for-windows-10.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 7d77e94d7d..6efbed9a1f 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -254,6 +254,7 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= ## Related topics +[Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) [Manage corporate devices](manage-corporate-devices.md) From 306ba61ecb6c5564c465eaa3b88afaae9ee67182 Mon Sep 17 00:00:00 2001 From: Chuck Kim Date: Tue, 21 May 2019 12:43:28 -0700 Subject: [PATCH 056/143] Update windows-10-and-privacy-compliance.md Adjusted the list of applicable versions of Windows. --- windows/privacy/windows-10-and-privacy-compliance.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 2583fffda5..47ce5b00ee 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -21,9 +21,6 @@ ms.date: 05/21/2019 Applies to: - Windows 10, version 1903 - Windows 10, version 1809 -- Windows 10, version 1803 -- Windows 10, version 1709 -- Windows 10, version 1703 - Windows 10 Team Edition, version 1703 for Surface Hub - Windows Server 2019 - Windows Server 2016 From 902ff53be3847152f6390f113b8200173b84c0e9 Mon Sep 17 00:00:00 2001 From: CTroessaert <43269447+CTroessaert@users.noreply.github.com> Date: Tue, 21 May 2019 22:17:43 +0200 Subject: [PATCH 057/143] remove typo for Hello for Business --- windows/whats-new/whats-new-windows-10-version-1903.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 071529cc49..64477e8511 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -120,7 +120,7 @@ The draft release of the [security configuration baseline settings](https://blog - [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. - [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! i +- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! - [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Security management From b5eb147c3edab34af088a94ea374233e6ce375e4 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Wed, 22 May 2019 08:06:55 -0700 Subject: [PATCH 058/143] Update security-compliance-toolkit-10.md Updated page to include 1903 release --- .../threat-protection/security-compliance-toolkit-10.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index fe229e350d..faa63ea948 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -26,6 +26,7 @@ The SCT enables administrators to effectively manage their enterprise’s Group The Security Compliance Toolkit consists of: - Windows 10 security baselines + - Windows 10 Version 1903 (May 2019 Update) - Windows 10 Version 1809 (October 2018 Update) - Windows 10 Version 1803 (April 2018 Update) - Windows 10 Version 1709 (Fall Creators Update) @@ -69,4 +70,4 @@ LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files It can export local policy to a GPO backup. It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file. -Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). \ No newline at end of file +Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). From 39c663b33f6a18e42d55ea3029f171e64103c9a9 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Wed, 22 May 2019 10:45:18 -0500 Subject: [PATCH 059/143] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-Authored-By: Joyce Y. <47188252+mypil@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 69de4938f5..3cca011117 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -769,7 +769,7 @@ To remove the News app: -or- >[!IMPORTANT] -> If you have any issues with these commands, restart the PC and try the scripts again. +> If you have any issues with these commands, restart the system and try the scripts again. > - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** From 3b4f39d1720aa156986fa6bb5f3b7fb499123da6 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 22 May 2019 11:19:16 -0700 Subject: [PATCH 060/143] incorp of feedback from Narkis --- .../waas-delivery-optimization-reference.md | 14 +++++++++-- .../waas-delivery-optimization-setup.md | 24 +++++++++---------- .../update/waas-delivery-optimization.md | 4 ++-- 3 files changed, 26 insertions(+), 16 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index 7fbacf8aee..100f99d74c 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -5,9 +5,9 @@ keywords: oms, operations management suite, wdav, updates, downloads, log analyt ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: greg-lindsay +author: jaimeo ms.localizationpriority: medium -ms.author: greglin +ms.author: jaimeo ms.collection: M365-modern-desktop ms.topic: article --- @@ -59,6 +59,8 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | | [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 | | [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 | +| [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | +| [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | ### More detail on Delivery Optimization settings: @@ -198,6 +200,12 @@ Starting in Windows 10, version 1803, this allows you to delay the use of an HTT ### Delay foreground download from http (in secs) Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. +### Delay Foreground Download Cache Server Fallback (in secs) +Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If you set the policy to delay foreground download from http, it will apply first (to allow downloads from peers first). + +### Delay Background Download Cache Server Fallback (in secs) +Starting in Windows 10, version 1903, set this policy to delay the fallback from cache server to the HTTP source for a background content download by X seconds. If you set the policy to delay background download from http, it will apply first (to allow downloads from peers first). + ### Minimum Background QoS This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from Windows Update servers or WSUS. Simply put, the lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network. @@ -221,3 +229,5 @@ The device can download from peers while on battery regardless of this policy. >[!IMPORTANT] > By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause. + + diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index fafd11bdde..7a88db81fd 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -97,8 +97,11 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** ## Monitor Delivery Optimization [//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) -### Windows PowerShell cmdlets for analyzing usage -**Starting in Windows 10, version 1703**, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization: +### Windows PowerShell cmdlets + +**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization. + +#### Analyze usage `Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs. @@ -117,11 +120,6 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** | PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | | ExpireOn | The target expiration date and time for the file. | | Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | - - - - -   `Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: @@ -136,9 +134,14 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** Using the `-Verbose` option returns additional information: - Bytes from peers (per type)  -- Bytes from CDN  (the number of bytes received over HTTP) +- Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download  +Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. + +Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. + +#### Manage the Delivery Optimization cache **Starting in Windows 10, version 1903:** @@ -158,9 +161,8 @@ You can now "pin" files to keep them persistent in the cache. You can only do th - `-IncludePinnedFiles` deletes all files that are pinned. - `-Force` deletes the cache with no prompts. -`get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. - +#### Work with Delivery Optimization logs **Starting in Windows 10, version 1803:** @@ -172,9 +174,7 @@ Log entries are written to the PowerShell pipeline as objects. To dump logs to a [//]: # (section on what to look for in logs, list of peers, connection failures) -`Get-DeliveryOptimizationPerfSnapThisMonth` -Returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. [//]: # (possibly move to Troubleshooting) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index d10ada6ff6..c6fb7e2691 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -114,8 +114,8 @@ For the payloads (optional): **Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. -**What data does Delivery Optimization send to its service?** -{you've got that big table at the OSGwiki--do you want all that to be published?} +**How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimizatio uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). + ## Troubleshooting From fc8f2edd22104dbe844ed6158b8548357bdbd96d Mon Sep 17 00:00:00 2001 From: illfated Date: Wed, 22 May 2019 22:00:33 +0200 Subject: [PATCH 061/143] Windows Hello For Business overview: URL correction Description: Under the "Learn more" section: - The link to "Implementing Windows Hello for Business at Microsoft" no longer points to the correct Showcase page, but goes to the main Showcase page (Showcase portal) instead. Proposed change: insert the correct link to the (en-us only) working page. Unfortunately, there is no localization for this page yet. Closes #3728 --- .../identity-protection/hello-for-business/hello-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 58614660a4..bca87f02c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -97,7 +97,7 @@ Windows Hello for Business can use either keys (hardware or software) or certifi ## Learn more -[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/830/Implementing-Windows-Hello-for-Business-at-Microsoft) +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy From 793ff13d99c1ff6ba80410495690483e7c6f4607 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 23 May 2019 01:31:01 +0500 Subject: [PATCH 062/143] Link was not working The link was pointing to the wrong doc and that doc was also not available. I have updated it to point to the correct doc for Azure AD Connect. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/2405 --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index dd447eb2b1..dc00790f7f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -85,7 +85,7 @@ Organizations using older directory synchronization technology, such as DirSync
## Federation with Azure ## -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. ### Section Review ### > [!div class="checklist"] From 38a53c1ecf3b81a8b61801e92de75586f2de5898 Mon Sep 17 00:00:00 2001 From: MatthewMWR Date: Wed, 22 May 2019 13:52:23 -0700 Subject: [PATCH 063/143] Fix AllowTelemetry precedence info --- .../update/windows-analytics-FAQ-troubleshooting.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 9942044960..e2e21a62bc 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -84,11 +84,13 @@ If you have devices that appear in other solutions, but not Device Health (the D 1. Using the Azure portal, remove the Device Health (appears as DeviceHealthProd on some pages) solution from your Log Analytics workspace. After completing this, add the Device Health solution to you workspace again. 2. Confirm that the devices are running Windows 10. 3. Verify that the Commercial ID is present in the device's registry. For details see [https://gpsearch.azurewebsites.net/#13551](https://gpsearch.azurewebsites.net/#13551). -4. Confirm that devices have opted in to provide diagnostic data by checking in the registry that **AllowTelemetry** is set to 2 (Enhanced) or 3 (Full) in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** (or **HKLM\Software\Policies\Microsoft\Windows\DataCollection**, which takes precedence if set). +4. Confirm that devices are opted in to send diagnostic data by checking in the registry that **AllowTelemetry** is set to either 2 (Enhanced) or 3 (Full). + - **AllowTelemetry** under **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is the location set by Group Policy or MDM + - **AllowTelemetry** under **HKLM\Software\Policies\Microsoft\Windows\DataCollection** is the location set by local tools such as the Settings app. + - By convention the Group Policy location would take precedence if both are set. Starting with Windows 10, version 1803, the default precedence is modified to enable a device user to lower the diagnostic data level from that set by IT. For organizations which have no requirement to allow the user to override IT, the conventional (IT wins) behavior can be re-enabled using **DisableTelemetryOptInSettingsUx**. This policy can be set via Group Policy as **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface**. 5. Verify that devices can reach the endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Also check settings for SSL inspection and proxy authentication; see [Configuring endpoint access with SSL inspection](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#configuring-endpoint-access-with-ssl-inspection) for more information. -6. Add the Device Health solution back to your Log Analytics workspace. -7. Wait 48 hours for activity to appear in the reports. -8. If you need additional troubleshooting, contact Microsoft Support. +6. Wait 48 hours for activity to appear in the reports. +7. If you need additional troubleshooting, contact Microsoft Support. ### Device crashes not appearing in Device Health Device Reliability From deeb5d921044d4aed6c6db9eb3e826cc27b0f2ab Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 May 2019 14:16:20 -0700 Subject: [PATCH 064/143] update what's new in deployment --- windows/deployment/deploy-whats-new.md | 29 +++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 3b74f5101f..7a4115d70e 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -28,7 +28,7 @@ This topic provides an overview of new solutions and online content related to d [SetupDiag](#setupdiag) 1.4.1 is released.
[MDT](#microsoft-deployment-toolkit-mdt) 8456 is released.
New [Windows Autopilot](#windows-autopilot) content is available.
-The [Microsoft 365](#microsoft-365) section was added. +[Windows 10 Subscription Activation](#windows-10-subscription-activation) now supports Windows 10 Education. ## The Modern Desktop Deployment Center @@ -45,7 +45,16 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic ## Windows 10 servicing and support -Microsoft is [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. +- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! +- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. +- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. +- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. +- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. + +Microsoft previously announced that we are [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. ![Support lifecycle](images/support-cycle.png) @@ -62,11 +71,21 @@ For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterpris ### Windows Autopilot -Windows Autopilot streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices. +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices. -Windows Autopilot joins devices to Azure Active Directory (Azure AD), optionally enrolls into MDM services, configures security policies, and sets a custom out-of-box-experience (OOBE) for the end user. For more information, see [Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md). +The following Windows Autopilot features are available in Windows 10, version 1903 and later: -Recent Autopilot content includes new instructions for CSPs and OEMs on how to [obtain and use customer authorization](windows-autopilot/registration-auth.md) to register Windows Autopilot devices on the customer’s behalf. +- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. +- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. +- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. +- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. +- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. + +### Windows 10 Subscription Activation + +Windows 10 Education support has been added to Windows 10 Subscription Activation. + +With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation). ### SetupDiag From cfba73b9a665978174817a7a221948d3d41d6746 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 May 2019 14:20:47 -0700 Subject: [PATCH 065/143] update --- windows/deployment/deploy-whats-new.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 7a4115d70e..7ca878471d 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -26,7 +26,7 @@ This topic provides an overview of new solutions and online content related to d ## Recent additions to this page [SetupDiag](#setupdiag) 1.4.1 is released.
-[MDT](#microsoft-deployment-toolkit-mdt) 8456 is released.
+The [Windows ADK for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install) is available.
New [Windows Autopilot](#windows-autopilot) content is available.
[Windows 10 Subscription Activation](#windows-10-subscription-activation) now supports Windows 10 Education. From 9d7c8b2a10ec71d6f3d1a2707048dd45f088cb84 Mon Sep 17 00:00:00 2001 From: Max Velitchko Date: Wed, 22 May 2019 16:16:36 -0700 Subject: [PATCH 066/143] Microsoft Defender for macOS: move JAMF based uninstallation to the JAMF article --- .../images/MDATP_26_Uninstall.png | Bin 22356 -> 30951 bytes ...soft-defender-atp-mac-install-with-jamf.md | 31 +++++++++++++++- .../microsoft-defender-atp-mac-resources.md | 33 ++---------------- 3 files changed, 32 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png index aa0d5c7caf671bb8d1ece4ad8a56c34427c5e530..6463593a6c9735f7ae3b2f49316860c634253eda 100644 GIT binary patch literal 30951 zcmcG$WmH|s*7v({x8SZp65O5OkPsvgEI2^|1b26L5+K2y1PJc#5IneBaCd^<+TG_l zeeO8pz2kj8+}-qUSbOcYR?VuKbJqO-s>75OWie1mP$3WqhP<5A8wdoJ0Rn+>Lq-Hg zq=dtJ!G92qUdc*99-;qaHWws-BPh0VS`H8hD=qY27}q>8XK)b7QU0|w(mDbGAr`~j zN6kZUh}cnD(^1mq<3|%~M~I}oiJ_y(dn%U?j^Uy2pFWmi&-%gyt+|vz$*e595%9(0EfHQ0>NR;R2_J& z%bc8f1g%SlBR${c(#-L(0WWEd)bWkr@r})Bs_Y_vM}dg=*FrI?w(@XQ@yIdLA(5ZV z7s?$uBM}b-^rsK@CA}ONdJ3e(e}ys%jrk)t660hMkg?cE&7Ke}xOrjH4ONf#kI!#) z&(B9^SJdEVGrqX|!@
wmlZQt*~Pa>DX)E<#b3t;Ow%OjE)A;>5?x5l{9f$?<5( zG_?rR>DLG4dJ)c_mWqa+_IT%lI}W-@a|z_G4rkQomu@f+?GnUV=G0L6opQov78`F{ zB8U838W!rc?=z;Lt=Zp;Eu}w>e-J*I>@L$nxAl0x&-Oh?J)of;l}!JOdgXOpg|u)5rhx|=4~1APx1LSp}dhjm1` zc;s5y9;C)s<*kK?XlA)Stn)6Hc6GV>J0jL<6R8~&#qf}}9acg`?rI=G37=A;i;9WPsfI7?zh_PsC4ksAWs&Pf>oGzCBQ%2*84R5j zpBd3g{SvDF;7DkaJ|J)h&yY=M| zYzwZe??3Ph8r@?PvBNx)l!EBO%nxjh7V}{p1w3#_O+pq;yJiBBBVR{$y`!WMSGDA$ zi}I~k9cTA=xf|N@Tf)ketn{P*^mAG!!@vYIyWAO;rdu!%#%zVj?t^*_)`Nkc9u@v}Fo;Cysik*-)X z!arRf8`k0$b%!?e5Onpeh9aX8tGqkAy+3yKI=;oPCXy#FV+9WxH6Nkuos9soUCgCp zPWkKyZ83O!@L*-;J^W<+>P6m(XP9bjh0|-Ul0xT#C<9xjG$I@pqr4f1_J(^coPDAQ zW2*!U+j*&WPV;m z29kLW7j2SFCDMq7O-$|@M{fx*?P zMVIvaNnT2R`;mri@hM$JPmjU!7%sSJdjQ`^+c`>D-@HD|?2)X(dt}t`y;w5BXxm0& zirEm_yo+REQA~Lb!(BUeVn;hiHcbz;<^Y z8XQt8UDJojL0Yp+Gx}<9weMu!Cp+~y4atQ`sLv6RmD+T6J~yM`wRj&CG?p16UMi{T zKnj5|O)$Ksw2lhJj=)KA`D|b&j{kMO!LXLdu$qVp;>uTw952(wclb4`UiH_CZ9NXT zskFEqxlS{MujM-3)gXu zY@(sIIxHr^a)j{cT5Qv>rNS@DSbzm~SWdNqTSAI#isq5lCwZv+7GoKZM04)kTqLD#+B`ENt(c z>BPa=7gwOnt{WK&Ilz92C&ub7&8%O9Nu3o<=^lMFu^FX)R@^Gbnc{f-=YH3nzB^DH z4*|rc!Q|x7-G-WoqnAg{Sq0Nkfyv6?!P*YuICwdp;Pc$KmUT)f$c4r5o7v@0TEw#V zM0Y;DFgHI8+&`mzdN{7X&szz@FyC-o8--L>aLk_xA;+A~bmAj++|A2$Xx{YfeUvyj zl(_vhxg|dS&H8=5%(|l)RzqrYp8|2f_lBvnAA1`{yu_K~^4rdrk*>tR=EoC03%()N z0|<~iyG{zLIXm=45$mcd7g|0cVi0NLr4$BUDtnw&^h6WedlZ|(84c^K5hsxam0{z4 z)%F+bB}ky4R;T5)V(RiUt}c5Qg5ZV!plq!UYk{!d_VIvOJ1fAH z{5iqD`iQ)1HD1uX`bh&>v&A$&L;-`Q0)F_&YiI@a9~Tux#JlWM#VU!0h}JZeA-Es8_kZ3)hZ}tTKl{GS!_C2(POV@ceIA)zh4A`B)B+GQX0 z1@6pxQeA~Pb-XAvSrBs>WIAYX+3l<%wd)j!Na0etZTpW%DUAGOFS9CY9;b`vX>+PO z-8Sj={M3J~G=#~!x^5_hX0xx&Gbzsn13vdDM9J8_t#tRWTkOYtfjyyLMA*4?)j7K->JWdHQ+G=D#JGd%1H2pwj<>YH zS&N=)b3jBo$EtcVx?te^P;y#=Kj`wl{!qyUc2AYR!rf$qN@H z%6KCQyW4mx=3(-Xo6TXIkDWWw)>Snw73|bTBmI3+L0aXNnW#coZzX?)#(H@J>l&#$ zqjJYXbHnQlJ{MZSh45%=LQd7*m77`OP|Vtn$-Q<<(#w?|H{94KgwZjVpK|h7x#QP5 zS-%&UcHg16?sd|-x_ID7NGc!;IGi$lH}ANF`y7g1**3c_<8F`Fu}^#J9}$KrtKfM3 z^oSurJfgHDH4K`Dj6BrkwQ3$e?~{w_Iqm;48cMUP=)BV1Y8}vB98%dE)o7CpJI>BZ z9O~~IAYDE4RvDvKBY4rG3#2cjAD-s+gscw@-NOk;t0*I}XLyk%jtq3%u*k;x{N}&& zM$ncI0C^E-vHs*ZJzcs0j`qYmEf|Bf8KOJOJr%X7YKel$Os5y6UG;zWioBiSmX!-( zBL?44im%fn>kIiwd2?=(x@OM97Vn>KXkjs{-wq8cPhrVC`e zrV0vDMhc8gdRmK{Ag%pGVG~?50vGYE6=T`MZzKJcW+8@Q7O%G|u2(y9cs65_gI~pd zNarL{Q9pa(z|4`x=;An1gbL+(D)a5w*2(uXBYs_LBFDLiL;FN8?~6+fgtlc~iniY; zqZe2dJ=#7m(|ov8CGRyESpTFIEU%{x+%y`MTG-H*=Z*g?xEdtk=)Xjvl9c zW&Ycf${5KN&CqQA;w8o(RzA=$DV4h1>C~g^jM7EJ7SlpLTqAU zf{cM7t)sJ$InB$QI4&K+G^qWHw|ML|wZ&UeT(fKjh5AC;L)SeVSX zH~KB*)$M&@VWIE%4w=0!(y6O3BNLM!V|d@-V4!-DNd)m)orf?*Bq<+eJYD;aV|H;d z`iBo6z`Zsw!Lrw|(Mp7&ySv-dOg%=bQw6&NY9**j{CA8e$9)LtGpK+kC@zLD8P2_4Jp!MORwC;`1 zgPaN;KN;rv`8kNx;BJ_LKT1kUTrX$M?C!4Zyc4;N^%*dkyXLlUv8zOPe3`_8VRBD ztnmqXiw&PVv>CDcl!U2vK1%;?jqv&`<8e?476(Vyqg&p}ikV&^*>`PiEmMCjJUg=t zqz&{6zMZQtjE#*)_Y~8G!x|a{6_VLu5Cg=$bmHj(0|VQvYl|M~mC_^4(%lf*nvP*l zPfw3)Tkk(AE1^U1@bKE+bN*%6t}xtkr@g668af&p*!ueVnMyM(3row8h4h*l-u;FL*f=(~J7QlF@s={+w zbRq;pQCUq5@4NwgR<~%a@RfTf+XHWNI4#2Cupa5C=?qgbl^^HaQ$vGL^x@ig@GB46 zmoHy5%M4&J$@sC=@KF4H-Oe`KH|(=AGY$H#1l-RVU%q-(?zr(NW)whx3BE`^)*0l>jWG`~$$kFVEbjJw0}{~E8FnnaF&de@=f5^dvaIl(B_EQi&p#UmO40b;h6YZ_jg zrQ(*Uy$hp(L>6%oAy5p1PSbRcLxE!bRtlFTH-?szD4Vt&$2A7AKVjNb{S}eZ`aa~P zEjQ1s8xMGe@6X4tK_^58AYrYAh}}^O3JHxgz7D}8@0f0VaN_3UTaS~aXircQ4I3R* z7C!01ovHdTj!z0FDJ2E3)6?h#p`xaS`S$G_BQtYXs(=F(GVJ%FBE!mAY<&D6`2>2y z@%-23Ha4<4I%H&+NIwS#;?mMEiY5h%uSmE|(ZPHe9UX;eB~r^j5vIVZv0e-h!(}k) z2t`}nAVSpjm3uCyF4=MHsFm2pP_?E$>DLipGji?j8}Ji*a-Zn z-K>i{7_aIj+If0CU%AXM9R_^Ub#!u3Y zJdvJ0eJUp}?>D|93@U-}yw(e$2xtU_w{fAN=4w}|fx*Ev&!3~^<>lE5rp1~N z%SMxlo0`%y6QDu;!1&I@D~{K%Ul*2?bbn$}mGR_L(9lQ{Jfu@rW7evW5^>vg6a=k3 zPlYocA0Lm)$e`qQHktmR3$g7+>=;fH;xqS*QY?T*15eRq1dpfj@$vrQh>$W(=CWC< zU0!5=kVORi`t|05Q!%rbiI?}%e~%Cc$B#)hzisQRebu(@=t?r44!m?G1fSsGM15V8 zDw;II5KynvRPdiA?-AvHDi z^{=Fsz$j8aqyG4((3yL3*m#s(QgV>3cjPE|^6M3w;lte@%_?&osJ}_lbN?`!rVehG z)4~tqd$QgO2LZ!uY-R>IrZ?czC%lWKTVO+FZS8R2^Y91>u^NJ|jV7n3b82b`n3$Nr zLMkmSZKm0SZ*6^jY+)f1%&MYCFdA{l$wjsg$;7c^Q&J+J?sBn_@Wo^D=Z+4E!4y8W zLYH-mN~>AUCg6x%59_zENl3!Mv!L)TdvZO135n?zqUy^$;JO~gS7tfQTC7!xh=fG} z9Y;S}AKX39$7JuiuyMxlU1rS)A|fI>>+IH*-@NgUj>gQ*&4tIO1dj$LNAFmUtctpN zu+UMH!;G}=z(z-kO-mSuagV`V)dz?#=)+Hmi4ut$XNo`6m6d(Z&mAv(3i9)5fDaLJ z-fzp6jwo~5Q_n3Z(6^=9p9EpUc;{E1W`iRWm{Ln_TjY0tMtpjj+|FX-;y8X=y1Tn8 zgR3+iwUExv&hD;*IMhb&vfx*{?46Q9LPOKg;I3G#{yhJ6N-*d>BQXC0Hrc|$!zEl@ z`Imeiy{c+!_0L(lV1S>3IuU448kNMN78TVaM@~skj~+_l%K`p=v^7o0#b_*BI^b{^ z1wE4G*)s`X7F0B}a@*AoL##k@{u z8~+ubd>`J0r+odYtg9?UI@oNw?C?ezWZmVu1 z@m-nQnW^yEAQyDDLp%ksop&d`ZQXgWf`~n>>p~8mB7}@6<^ zH=vVxgUv_$?OS}Pl|UMx4+0d_;ceL~!;PPn>bL5#blu$Cl$i_=$i)Y4Z*OOMzJ84{ zH#Y}PMys5S>`!1Y1|F~Q`}a3o7#JAhXPF?u(`C~5jnxBh%>>+ZKsc5-_5@6kmX_95 zQ&8QHADEASG9HP~XJ*Qc?Uuc+RyR{@)Q<#F&;y<7bu^n?Puz}fzVKKQ7#SObAg>M$ zA%ba&EbIheazVe@4ic`oPoKDp)3ZxGH=b)&Ti~~x=dpd;`?GlDO-K;&)Lf!r`_}8J`@8TjEH9CJobS~O?-;BFZ)g~Jw%qhyRAMajTL zbaTFsQ3m1qy;kt773Q-;V9k{acSClfAG_`C|D&0hcS#+>{+EvOzsjHgmSg@-xBr%7 z{#I%JPQ(9FY5rDk{#I%J^YoiLxuJr&k-LH?*JAJwVjz5snY{)>A$<8L1pH((0-xdC zs*eGmK5kL1{7ESy(P0C`6Nf>LUNY$0La2lPzy=toDsX;;H=d#wJ`vf-Q8Ktyqc5mC z|2hNu<|5$ms|}T2IoG^eJ2bnHfH|A-JDLif^nJmY`NU6IZ1~M&<7ffsTm7qH`D{js zM3d@QCMyYWXi1fg`opZ+|MRiHCabI>s$-U`Fa@$dw&QC??8`r%qdSfe5IiRrX8+?f z9)>WZ$Hgx9X3;__Vt#&JTXJMy_aSqGX@$(`pucVfeLH;Pu+}!f2gi1B{g)?a49`~Q zgKN}OzG^l$_{SD9o|{eE#xx?hAa}ZN)KjZgDt6ID`ns za0?}1L$kkI1x{?F5m1Sz1K~(35v=m4<=>2c6!mVU)GO7{4P_p